POST /api/detection_engine/index
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/detection_engine/index

Refer to Spaces for more information.

Creates an index for Elastic Security alerts. Calling this API is not required for the detection engine to function properly. You can create rules and alerts without calling this API.

Responses

  • 200 application/json

    Successful response

    Hide response attribute Show response attribute object
    • acknowledged boolean Required
  • 401 application/json

    Unsuccessful authentication response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode integer Required
  • 403 application/json

    Not enough permissions response

    Hide response attributes Show response attributes object
    • message string Required
    • status_code integer Required
  • 404 application/json

    Not found

    Hide response attributes Show response attributes object
    • message string Required
    • status_code integer Required
  • 500 application/json

    Internal server error response

    Hide response attributes Show response attributes object
    • message string Required
    • status_code integer Required
POST /api/detection_engine/index 
curl \
 --request POST 'https://localhost:5601/api/detection_engine/index' \
 --header "Authorization: $API_KEY"
Response examples (200) 
{
  "acknowledged": true
}
Response examples (401) 
{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}
Response examples (403) 
{
  "message": "API [POST /api/detection_engine/index] is unauthorized for the current user. The user must be able to create indices for the Elastic Security solution.",
  "status_code": 403
}
Response examples (404) 
{
  "message": "A prerequisite resource required to create the alerts index was not found.",
  "status_code": 404
}
Response examples (500) 
{
  "message": "Internal Server Error",
  "status_code": 500
}