Finalize detection alert migrations Deprecated

POST /api/detection_engine/signals/finalize_migration
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/detection_engine/signals/finalize_migration

Refer to Spaces for more information.

DEPRECATED. Completes a legacy alert index migration. Do not automate against this in new code. WARNING: Finalizing swaps read aliases; confirm the migration has finished successfully before calling.

Finalize successful migrations of detection alerts. This replaces the original index's alias with the successfully migrated index's alias. The endpoint is idempotent, so you can poll until a migration finishes and then call this operation once.

application/json

Body Required

Array of migration_ids to finalize

  • migration_ids array[string] Required

    Array of migration_ids to finalize.

    At least 1 element.

Responses

  • 200 application/json

    Successful response

    Hide response attributes Show response attributes object
    • completed boolean Required
    • destinationIndex string Required
    • error object
      Hide error attributes Show error attributes object
      • message string Required
      • status_code integer Required
    • id string Required
    • sourceIndex string Required
    • status string Required

      Values are success, failure, or pending.

    • updated string(date-time) Required
    • version string Required
  • 400 application/json

    Invalid input data response

    One of:
    Security_Detections_API_PlatformErrorResponse object Security_Detections_API_SiemErrorResponse object
  • 401 application/json

    Unsuccessful authentication response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode integer Required
  • 500 application/json

    Internal server error response

    Hide response attributes Show response attributes object
    • message string Required
    • status_code integer Required
POST /api/detection_engine/signals/finalize_migration 
curl \
 --request POST 'https://localhost:5601/api/detection_engine/signals/finalize_migration' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"migration_ids":["924f7c50-505f-11eb-ae0a-3fa2e626a51d"]}'
Request example 
{
  "migration_ids": [
    "924f7c50-505f-11eb-ae0a-3fa2e626a51d"
  ]
}
Response examples (200) 
{
  "migrations": [
    {
      "completed": true,
      "destinationIndex": ".siem-signals-default-000002-r000016",
      "id": "924f7c50-505f-11eb-ae0a-3fa2e626a51d",
      "sourceIndex": ".siem-signals-default-000002",
      "status": "success",
      "updated": "2021-01-06T22:05:56.859Z",
      "version": 16
    }
  ]
}
Response examples (400) 
{
  "error": "Bad Request",
  "message": "[request body].migration_ids: at least one migration id is required to finalize",
  "statusCode": 400
}
Response examples (401) 
{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}
Response examples (500) 
{
  "message": "Internal Server Error",
  "status_code": 500
}