Found not migrated detection alerts

Elastic Stack Kibana
1

Hello

we are planning our upgrade from 8.19.x to 9.2.x
The upgrade assistant contains a warning for Kibana: "Found not migrated detection alerts"
I have tried to migrate but this does not work (example with .reindexed-v8-siem-signals-default-000008)

I executed:

POST kbn:/api/detection_engine/signals/migration
{
"index": [".reindexed-v8-siem-signals-default-000008"],
"slices": 1,
"size": 500
}

Check progress:

GET kbn:/s/default/api/detection_engine/signals/migration_status?from=1970-01-01T00:00:00.000Z

Returns:
{
"index": ".reindexed-v8-siem-signals-default-000008",
"version": 0,
"signal_versions": [
{
"version": 0,
"count": 3279
}
],
"migrations": [
{
"id": "79f41049-aceb-436b-bf33-c6c4269fc490",
"status": "pending",
"version": 87,
"updated": "2026-02-13T12:44:47.461Z"
}
],
"is_outdated": true
}

The status keeps hanging in pending, however when I query the indices I see a new index is created with the same amount of docs as the
green open .reindexed-v8-siem-signals-default-000008 1 1 3279 0 13mb 6.5mb 0b
green open .reindexed-v8-siem-signals-default-000008-r000087 1 1 3279 0 15.3mb 7.6mb 0b

How can I migrate the detection alerts in preparation for the upgrade to version 9.2.x?

Best regards
Christophe

2

On my side, when I try the POST command, I'm getting this error:

{
  "message": "Cannot migrate due to the signals template being out of date. Latest version: [87], template version: [77]. Please visit Detections to automatically update your template, then try again.",
  "status_code": 400
}

The GET command returns this:

{
  "indices": [
    {
      "index": ".reindexed-v8-siem-signals-default-000001",
      "version": 35,
      "signal_versions": [
        {
          "version": 35,
          "count": 119
        }
      ],
      "migrations": [],
      "is_outdated": true
    }
  ]
}

Any ideas?

Regards,
Yanick

3

Hello,
I just want to let you know that I solved the Cannot migrate due to the signals template being out of date problem. The POST command worked but I'm now in the same pattern as @CD9820, where the migration status is in a pending state.

{
  "indices": [
    {
      "index": ".reindexed-v8-siem-signals-default-000001",
      "version": 35,
      "signal_versions": [
        {
          "version": 35,
          "count": 119
        }
      ],
      "migrations": [
        {
          "id": "43333ac3-1d36-4691-bfca-7634363e7f83",
          "status": "pending",
          "version": 87,
          "updated": "2026-09-10T18:47:53.450Z"
        }
      ],
      "is_outdated": true
    }
  ]
}

Regards,
Yanick