Export live query results
https://{kibana_url}
- POST /api/osquery/live_queries/{id}/results/{actionId}/_export
Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.
Request
-
agentIdsstringnullable -
An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.
-
esFiltersobjectnullable -
An optional array of Elasticsearch / Kibana SearchBar filter objects (the same
esFilterspayload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data. -
kuerystringnullable -
An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.
Responses
A downloadable file in the requested format. The Content-Disposition header contains the suggested filename.
-
_meta -
Metadata block produced for every export. Included as
_metain the JSON response body and as the first NDJSON line. -
action_idstringrequired -
The action ID (live query) or schedule ID (scheduled query) that produced the results.
-
csv_columnsstringnullable -
For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.
-
execution_countintegernullable -
For scheduled query exports only: the execution counter of the scheduled run that produced the results.
-
exported_bystringrequired -
Username of the Kibana user who triggered the export.
-
format -
The output format for the exported file. Use
ndjsonfor streaming newline-delimited JSON (recommended for large exports),jsonfor a single JSON array (held in memory; suitable for smaller result sets), orcsvfor a comma-separated values file with a header row derived from the ECS mapping. -
Values:
ndjsonjsoncsv -
querystringnullable -
The SQL query text, if it could be resolved from action details.
-
timestampstringrequired -
ISO 8601 timestamp of when the export was initiated.
-
total_resultsintegernullable -
Total number of result rows included in this export.
-
resultsobjectrequired
Response Type: string
Response Type: string
Response Headers
-
Content-Dispositionstring Attachment disposition with a generated filename, e.g.
attachment; filename="osquery-results-{actionId}-{timestamp}.ndjson".
Bad request. Possible causes: invalid or missing format query parameter, malformed KQL in the request body, invalid esFilters, or the result count exceeds the 500,000-row limit.
-
messagestring
The authenticated user does not have the osquery-readLiveQueries privilege required to export live query results.
The parent live query action {id} was found but does not contain a query whose action_id matches {actionId}. This typically means the id and actionId URL parameters refer to different queries.
-
messagestring