Get live query results

Base URL: https://{kibana_url}

GET /api/osquery/live_queries/{id}/results/{actionId}
GET /s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}

Auth

Get the results of a live query using the query action ID.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
id string required: The ID of the live query.; Example: 3c42c847-eb30-4452-80e0-728584042334
actionId string required: The ID of the query action.; Example: 609c4c66-ba3d-43fa-afdd-53e244577aa0

Query parameters

kuery string nullable: A KQL search string to filter results.; Example: agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
page integer nullable: The page number to return.
pageSize integer nullable: The number of results to return per page.
sort string · default: createdAt nullable: The field to sort results by.
sortOrder enum: The sort order.; Values: asc desc

Responses

Indicates a successful call.

application/json

data object

Either no live query with this id exists in the current space (Action not found; live queries issued from another space also return 404), or it has no query whose action_id matches {actionId} (Live query action not found).

application/json

message string