---
title: Osquery fields
description: Fields exported by the osquery module Common fields exported by the result metricset. 
url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/beats/filebeat/exported-fields-osquery
products:
  - Beats
  - Filebeat
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Osquery fields
Fields exported by the `osquery` module

## osquery


## result

Common fields exported by the result metricset.
<definitions>
  <definition term="osquery.result.name">
    The name of the query that generated this event.
    type: keyword
  </definition>
  <definition term="osquery.result.action">
    For incremental data, marks whether the entry was added or removed. It can be one of "added", "removed", or "snapshot".
    type: keyword
  </definition>
  <definition term="osquery.result.host_identifier">
    The identifier for the host on which the osquery agent is running. Normally the hostname.
    type: keyword
  </definition>
  <definition term="osquery.result.unix_time">
    Unix timestamp of the event, in seconds since the epoch. Used for computing the `@timestamp` column.
    type: long
  </definition>
  <definition term="osquery.result.calendar_time">
    String representation of the collection time, as formatted by osquery.
    type: keyword
  </definition>
</definitions>