---
type: api
title: Export live query results
description: Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-osqueryexportlivequeryresults
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-osqueryexportlivequeryresults
products:
  - Kibana
---

# Export live query results

Availability: 9.5+

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/osquery/live_queries/{id}/results/{actionId}/_export`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

#### Path Parameters

- `id` (string)
  The ID of the live query (parent action ID).
- `actionId` (string)
  The query action ID whose results are exported. Filters the export to rows for this specific per-agent action.

## Description

Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.

## Query String Parameters

- `format` (enum)
  The output format of the exported file.
  Values: `ndjson`, `json`, `csv`

## Request Body

`application/json`

- `agentIds` ([] string) — optional — nullable
  An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.
- `esFilters` ([] object) — optional — nullable
  An optional array of Elasticsearch / Kibana SearchBar filter objects (the same `esFilters` payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.
- `kuery` (string) — optional — nullable
  An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.

## Responses

#### `200`

A downloadable file in the requested format. The `Content-Disposition` header contains the suggested filename.

`application/json`

- `_meta` ({})
  Metadata block produced for every export. Included as `_meta` in the JSON response body and as the first NDJSON line.
  - `action_id` (string)
    The action ID (live query) or schedule ID (scheduled query) that produced the results.
  - `csv_columns` ([] string) — nullable
    For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.
  - `execution_count` (integer) — nullable
    For scheduled query exports only: the execution counter of the scheduled run that produced the results.
  - `exported_by` (string)
    Username of the Kibana user who triggered the export.
  - `format` (enum)
    The output format for the exported file. Use `ndjson` for streaming newline-delimited JSON (recommended for large exports), `json` for a single JSON array (held in memory; suitable for smaller result sets), or `csv` for a comma-separated values file with a header row derived from the ECS mapping.
    Values: `ndjson`, `json`, `csv`
  - `query` (string) — nullable
    The SQL query text, if it could be resolved from action details.
  - `timestamp` (string)
    ISO 8601 timestamp of when the export was initiated.
  - `total_results` (integer) — nullable
    Total number of result rows included in this export.
- `results` ([] object)
`application/ndjson`

Type: `string`

`text/csv`

Type: `string`

##### Response Headers

- `Content-Disposition` (string)
  Attachment disposition with a generated filename, e.g. `attachment; filename="osquery-results-{actionId}-{timestamp}.ndjson"`.

#### `400`

Bad request. Possible causes: invalid or missing `format` query parameter, malformed KQL in the request body, invalid `esFilters`, or the result count exceeds the 500,000-row limit.

`application/json`

- `message` (string)
#### `403`

The authenticated user does not have the `osquery-readLiveQueries` privilege required to export live query results.

#### `404`

The parent live query action `{id}` was found but does not contain a query whose `action_id` matches `{actionId}`. This typically means the `id` and `actionId` URL parameters refer to different queries.

`application/json`

- `message` (string)
## Code Examples

#### Console

```console
POST /api/osquery/live_queries/{id}/results/{actionId}/_export?format={format}
{
  "kuery": "user.name: \u0022root\u0022"
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/osquery/live_queries/{id}/results/{actionId}/_export?format={format}" \
  -H "Content-Type: application/json" \
  -d '{
  "kuery": "user.name: \u0022root\u0022"
}'
```

## Response Examples

#### JSON export with metadata and results

```json
{
  "_meta": {
    "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
    "exported_by": "elastic",
    "format": "json",
    "query": "SELECT * FROM users;",
    "timestamp": "2026-04-30T09:12:00.000Z",
    "total_results": 2
  },
  "results": [
    {
      "@timestamp": "2026-04-30T09:11:58.321Z",
      "agent": {
        "id": "980a6b73-0b03-4d1e-8915-67c202e4a980",
        "name": "prod-host-1"
      },
      "user": {
        "id": "1000",
        "name": "ubuntu"
      }
    }
  ]
}
```

#### Result count exceeds the export limit

```json
{
  "message": "Export limited to 500,000 results. Found 500,001. Please add filters to narrow results."
}
```

#### The id/actionId pair refers to different queries

```json
{
  "message": "Live query action not found"
}
```