---
title: stack kb security-osquery-api osquery-create-live-query cli command
description: Create a live query Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4089/reference/elastic-cli/cli/stack/kb/security-osquery-api/osquery-create-live-query
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-osquery-api osquery-create-live-query cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-osquery-api osquery-create-live-query [options]
```

Create a live query
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--agent-all">
    When `true`, the query runs on all agents.
  </definition>
  <definition term="--agent-ids string[]">
    A list of agent IDs to run the query on.
    **Repeatable:** pass `--agent-ids` multiple times to supply more than one value
  </definition>
  <definition term="--agent-platforms string[]">
    A list of agent platforms to run the query on.
    **Repeatable:** pass `--agent-platforms` multiple times to supply more than one value
  </definition>
  <definition term="--agent-policy-ids string[]">
    A list of agent policy IDs to run the query on.
    **Repeatable:** pass `--agent-policy-ids` multiple times to supply more than one value
  </definition>
  <definition term="--alert-ids string[]">
    A list of alert IDs associated with the live query.
    **Repeatable:** pass `--alert-ids` multiple times to supply more than one value
  </definition>
  <definition term="--case-ids string[]">
    A list of case IDs associated with the live query.
    **Repeatable:** pass `--case-ids` multiple times to supply more than one value
  </definition>
  <definition term="--ecs-mapping string">
  </definition>
  <definition term="--event-ids string[]">
    A list of event IDs associated with the live query.
    **Repeatable:** pass `--event-ids` multiple times to supply more than one value
  </definition>
  <definition term="--metadata string">
    Custom metadata object associated with the live query.
  </definition>
  <definition term="--pack-id string">
  </definition>
  <definition term="--queries string[]">
    **Repeatable:** pass `--queries` multiple times to supply more than one value
  </definition>
  <definition term="--query string">
  </definition>
  <definition term="--saved-query-id string">
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>