---
type: api
title: Get live queries
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-osqueryfindlivequeries
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-osqueryfindlivequeries
products:
  - Kibana
---

# Get live queries

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/osquery/live_queries`
- `GET` `/s/{space_id}/api/osquery/live_queries`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get a list of all live queries.

## Query String Parameters

- `kuery` (string)
  A KQL search string to filter live queries.
- `page` (integer)
  The page number to return.
- `pageSize` (integer)
  The number of results to return per page.
- `sort` (string · default: createdAt)
  The field to sort results by.
- `sortOrder` (enum)
  The sort order.
  Values: `asc`, `desc`

## Response

Indicates a successful call.

`application/json`

- `data` (object)
  - `items` ([] object)
    An array of live query action items.
    - `_source` (object)
      - `@timestamp` (string)
      - `action_id` (string)
      - `agents` ([] string)
      - `expiration` (string)
      - `pack_id` (string)
      - `queries` ([] object)
        - `action_id` (string)
        - `agents` ([] string)
        - `ecs_mapping` (object)
          Map osquery results columns or static values to Elastic Common Schema (ECS) fields
        - `id` (string)
        - `query` (string)
        - `saved_query_id` (string)
      - `result_counts` (object)
        Result count statistics (present when withResultCounts is true).
        - `error_agents` (integer)
        - `responded_agents` (integer)
        - `successful_agents` (integer)
        - `total_rows` (integer)
      - `user_id` (string)
  - `total` (integer)
    The total number of live queries.
## Code Examples

#### Console

```console
GET /api/osquery/live_queries
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/osquery/live_queries"
```

## Response Examples

#### A list of recent live queries

```json
{
  "data": {
    "items": [
      {
        "_source": {
          "@timestamp": "2023-10-31T00:00:00Z",
          "action_id": "3c42c847-eb30-4452-80e0-728584042334",
          "agents": [
            "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          ],
          "expiration": "2023-10-31T00:00:00Z",
          "queries": [
            {
              "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
              "agents": [
                "16d7caf5-efd2-4212-9b62-73dafc91fa13"
              ],
              "ecs_mapping": {
                "host.uptime": {
                  "field": "total_seconds"
                }
              },
              "id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
              "query": "select * from uptime;",
              "saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d"
            }
          ],
          "user_id": "elastic"
        }
      }
    ],
    "total": 1
  }
}
```