--- type: api title: Copy a pack description: **Spaces method and path for this operation:** url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-osquerycopypacks resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-osquerycopypacks products: - Kibana --- # Copy a pack Availability: 9.4+ - Server: `https://{kibana_url}` ## Paths - `POST` `/api/osquery/packs/{id}/copy` - `POST` `/s/{space_id}/api/osquery/packs/{id}/copy` - [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth) - [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth) #### Path Parameters - `id` (string) The ID of the pack to copy. ## Description Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Create a copy of a query pack with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`). The copied pack is always created with `enabled` set to `false`. ## Response Indicates a successful call. `application/json` - `data` (object) - `created_at` (string) - `created_by` (string) — nullable - `created_by_profile_uid` (string) - `description` (string) The pack description. - `enabled` (boolean) Enables the pack. - `interval` (integer · min: 1) Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`. - `name` (string) The pack name. - `policy_ids` ([] object) A list of agents policy IDs. - `queries` ([] object) Pack queries in saved-object storage format (array). Note: the read endpoint returns object format. - `ecs_mapping` ([] object) ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object format (ECSMapping). - `key` (string) The ECS field name. - `value` ({}) - `field` (string) The ECS field to map to. - `value` (union string | [] string) The value to map to the ECS field. - `id` (string) - `interval` (integer) - `platform` (string) - `query` (string) - `removed` (boolean) - `rrule_schedule` ({}) RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor. - `end_date` (string · max: 64) Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`. - `rrule` (string · max: 2048) Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim). - `splay` (string · max: 64) Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). - `start_date` (string · max: 64) RFC 3339 datetime string for the schedule's start. - `timeout` (number) Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset. - `schedule_type` (enum) Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. Values: `interval`, `rrule` - `snapshot` (boolean) - `timeout` (integer) - `version` (string) - `rrule_schedule` ({}) RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor. - `end_date` (string · max: 64) Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`. - `rrule` (string · max: 2048) Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim). - `splay` (string · max: 64) Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds). - `start_date` (string · max: 64) RFC 3339 datetime string for the schedule's start. - `timeout` (number) Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset. - `saved_object_id` (string) The saved object ID of the copied pack. - `schedule_type` (enum) Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400. Values: `interval`, `rrule` - `shards` ([] object) Shard configuration as an array of key-value pairs. - `key` (string) - `value` (number) - `updated_at` (string) - `updated_by` (string) — nullable - `updated_by_profile_uid` (string) - `version` (integer) The pack version number. ## Code Examples #### Console ```console POST /api/osquery/packs/{id}/copy ``` #### curl ```curl curl -X POST "https://{kibana_url}/api/osquery/packs/{id}/copy" ``` ## Response Examples #### Example response for copying a pack ```json { "data": { "created_at": "2025-02-26T13:37:30.452Z", "created_by": "elastic", "description": "My pack", "enabled": false, "name": "my_pack_copy", "policy_ids": [], "queries": [ { "ecs_mapping": [ { "key": "client.port", "value": { "field": "port" } } ], "id": "ports", "interval": 60, "query": "SELECT * FROM listening_ports;", "removed": false, "snapshot": true, "timeout": 120 } ], "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856", "shards": [], "updated_at": "2025-02-26T13:37:30.452Z", "updated_by": "elastic" } } ```