Clean up detection alert migrations Deprecated

DELETE /api/detection_engine/signals/migration
Api key auth Basic auth

Spaces method and path for this operation:

delete /s/{space_id}/api/detection_engine/signals/migration

Refer to Spaces for more information.

DEPRECATED. Cleanup API for old migration artifacts. Do not add new call sites. WARNING: This schedules deletions; ensure no production reads still point at the source index.

Migrations favor data integrity over shard size. Consequently, unused or orphaned indices are artifacts of the migration process. A successful migration can leave both the old and new indices present, so the old index may be deleted. While you can delete these indices manually, the endpoint applies a deletion policy to the relevant index, causing it to be deleted after 30 days, and removes other migration-specific artifacts.

application/json

Body Required

Array of migration_ids to cleanup

  • migration_ids array[string] Required

    Array of migration_ids to cleanup.

    At least 1 element.

Responses

  • 200 application/json

    Successful response

    Hide response attributes Show response attributes object
    • destinationIndex string Required
    • error object
      Hide error attributes Show error attributes object
      • message string Required
      • status_code integer Required
    • id string Required
    • sourceIndex string Required
    • status string Required

      Values are success, failure, or pending.

    • updated string(date-time) Required
    • version string Required
  • 400 application/json

    Invalid input data response

    One of:
    Security_Detections_API_PlatformErrorResponse object Security_Detections_API_SiemErrorResponse object
  • 401 application/json

    Unsuccessful authentication response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode integer Required
  • 500 application/json

    Internal server error response

    Hide response attributes Show response attributes object
    • message string Required
    • status_code integer Required
DELETE /api/detection_engine/signals/migration 
curl \
 --request DELETE 'https://localhost:5601/api/detection_engine/signals/migration' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"migration_ids":["924f7c50-505f-11eb-ae0a-3fa2e626a51d"]}'
Request example 
{
  "migration_ids": [
    "924f7c50-505f-11eb-ae0a-3fa2e626a51d"
  ]
}
Response examples (200) 
{
  "migrations": [
    {
      "destinationIndex": ".siem-signals-default-000002-r000016",
      "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d",
      "sourceIndex": ".siem-signals-default-000002",
      "status": "success",
      "updated": "2021-01-06T22:05:56.859Z",
      "version": 16
    }
  ]
}
Response examples (400) 
{
  "error": "Bad Request",
  "message": "[request body].migration_ids: at least one migration id is required to run cleanup",
  "statusCode": 400
}
Response examples (401) 
{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}
Response examples (500) 
{
  "message": "Internal Server Error",
  "status_code": 500
}