---
type: api
title: Export scheduled query results
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryexportscheduledqueryresults
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-osqueryexportscheduledqueryresults
products:
  - Kibana
---

# Export scheduled query results

Availability: 9.5+

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export`
- `POST` `/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

#### Path Parameters

- `scheduleId` (string)
  The schedule ID of the scheduled query.
- `executionCount` (integer · min: 0)
  The execution counter for the scheduled query run whose results are exported. Must be a non-negative integer.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Export all result rows for a specific scheduled query execution as a downloadable file. The response is a streaming file attachment in the requested format.

## Query String Parameters

- `format` (enum)
  The output format of the exported file.
  Values: `ndjson`, `json`, `csv`

## Request Body

`application/json`

- `agentIds` ([] string) — optional — nullable
  An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.
- `esFilters` ([] object) — optional — nullable
  An optional array of Elasticsearch / Kibana SearchBar filter objects (the same `esFilters` payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.
- `kuery` (string) — optional — nullable
  An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.

## Responses

#### `200`

A downloadable file in the requested format. The `Content-Disposition` header contains the suggested filename.

`application/json`

- `_meta` ({})
  Metadata block produced for every export. Included as `_meta` in the JSON response body and as the first NDJSON line.
  - `action_id` (string)
    The action ID (live query) or schedule ID (scheduled query) that produced the results.
  - `csv_columns` ([] string) — nullable
    For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.
  - `execution_count` (integer) — nullable
    For scheduled query exports only: the execution counter of the scheduled run that produced the results.
  - `exported_by` (string)
    Username of the Kibana user who triggered the export.
  - `format` (enum)
    The output format for the exported file. Use `ndjson` for streaming newline-delimited JSON (recommended for large exports), `json` for a single JSON array (held in memory; suitable for smaller result sets), or `csv` for a comma-separated values file with a header row derived from the ECS mapping.
    Values: `ndjson`, `json`, `csv`
  - `query` (string) — nullable
    The SQL query text, if it could be resolved from action details.
  - `timestamp` (string)
    ISO 8601 timestamp of when the export was initiated.
  - `total_results` (integer) — nullable
    Total number of result rows included in this export.
- `results` ([] object)
`application/ndjson`

Type: `string`

`text/csv`

Type: `string`

##### Response Headers

- `Content-Disposition` (string)
  Attachment disposition with a generated filename, e.g. `attachment; filename="osquery-scheduled-results-{scheduleId}-{executionCount}-{timestamp}.csv"`.

#### `400`

Bad request. Possible causes: invalid or missing `format` query parameter, malformed KQL in the request body, invalid `esFilters`, or the result count exceeds the 500,000-row limit.

`application/json`

- `message` (string)
#### `403`

The authenticated user does not have the `osquery-read` privilege required to export scheduled query results.

## Code Examples

#### Console

```console
POST /api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export?format={format}
{
  "kuery": "agent.name: \u0022prod-host-1\u0022"
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export?format={format}" \
  -H "Content-Type: application/json" \
  -d '{
  "kuery": "agent.name: \u0022prod-host-1\u0022"
}'
```

## Response Examples

#### JSON export with metadata and results

```json
{
  "_meta": {
    "action_id": "90f342ee-9c05-4844-849b-173993234f22",
    "execution_count": 17384,
    "exported_by": "elastic",
    "format": "json",
    "timestamp": "2026-04-30T09:12:00.000Z",
    "total_results": 1
  },
  "results": [
    {
      "@timestamp": "2026-04-30T09:11:58.321Z",
      "agent": {
        "id": "5b1bb334-a23d-4006-80fe-bd129b979c9f",
        "name": "prod-host-1"
      },
      "osquery": {
        "uid": "1000",
        "username": "ubuntu"
      }
    }
  ]
}
```

#### Result count exceeds the export limit

```json
{
  "message": "Export limited to 500,000 results. Found 500,001. Please add filters to narrow results."
}
```