Get live query details

Base URL
https://{kibana_url}
Auth

Get the details of a live query using the query ID.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string required

The ID of the live query.

Example: 3c42c847-eb30-4452-80e0-728584042334

Responses

Indicates a successful call.

application/json
data object
@timestamp string · format: date-time
action_id string
agents string[]
expiration string · format: date-time
pack_id string
pack_name string
prebuilt_pack boolean
queries object[]

The queries with their execution status.

action_id string
agents string[]
docs integer

Number of result documents.

ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

failed integer

Number of failed queries.

id string
pending integer

Number of pending agents.

query string
responded integer

Total responded agents.

saved_query_id string
status enum

Status of this individual query.

Values: completed running
successful integer

Number of successful agents.

status enum

Global status of the live query (completed, running).

Values: completed running
tags string[]
user_id string
user_profile_uid string

No live query with this id exists in the current space. Live queries issued from another space also return 404.

application/json
message string
Base URL
https://{kibana_url}