Get live query results

Server: https://{kibana_url}

GET /api/osquery/live_queries/{id}/results/{actionId}
GET /s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}

Api key auth Basic auth

Refer to Spaces for more information.

Get the results of a live query using the query action ID.

Path Parameters

Query Parameters

Responses

Indicates a successful call.

application/json

No live query with this id, or no query with this actionId, exists in the current space. Live queries issued from another space also return 404.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/osquery/live_queries/{id}/results/{actionId}

curl Shell

curl -X GET "https://{kibana_url}/api/osquery/live_queries/{id}/results/{actionId}"

Response

{
  "data": {
    "edges": [
      {
        "_id": "doc1",
        "_source": {
          "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
          "agent": {
            "id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          },
          "osquery": {
            "total_seconds": "12345"
          }
        }
      },
      {
        "_id": "doc2",
        "_source": {
          "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
          "agent": {
            "id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          },
          "osquery": {
            "total_seconds": "67890"
          }
        }
      }
    ],
    "total": 2
  }
}

{
  "message": "Action not found"
}

Path Parameters { id , actionId , }

Query Parameters { kuery , page , pageSize , sort , sortOrder , }

Responses

Path Parameters

Query Parameters