---
type: api
title: Get live query results
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-osquerygetlivequeryresults
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-osquerygetlivequeryresults
products:
  - Kibana
---

# Get live query results

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/osquery/live_queries/{id}/results/{actionId}`
- `GET` `/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

#### Path Parameters

- `id` (string)
  The ID of the live query.
- `actionId` (string)
  The ID of the query action.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get the results of a live query using the query action ID.

## Query String Parameters

- `kuery` (string)
  A KQL search string to filter results.
- `page` (integer)
  The page number to return.
- `pageSize` (integer)
  The number of results to return per page.
- `sort` (string · default: createdAt)
  The field to sort results by.
- `sortOrder` (enum)
  The sort order.
  Values: `asc`, `desc`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `data` (object)
  - `edges` ([] object)
    The result rows from the query execution.
    - `_id` (string)
    - `_source` (object)
      The Elasticsearch document source containing query results.
  - `total` (integer)
    The total number of result rows.
#### `404`

No live query with this `id`, or no query with this `actionId`, exists in the current space. Live queries issued from another space also return 404.

`application/json`

- `message` (string)
## Code Examples

#### Console

```console
GET /api/osquery/live_queries/{id}/results/{actionId}
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/osquery/live_queries/{id}/results/{actionId}"
```

## Response Examples

#### Result rows from a live query execution

```json
{
  "data": {
    "edges": [
      {
        "_id": "doc1",
        "_source": {
          "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
          "agent": {
            "id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          },
          "osquery": {
            "total_seconds": "12345"
          }
        }
      },
      {
        "_id": "doc2",
        "_source": {
          "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
          "agent": {
            "id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          },
          "osquery": {
            "total_seconds": "67890"
          }
        }
      }
    ],
    "total": 2
  }
}
```

#### The live query does not exist in the current space

```json
{
  "message": "Action not found"
}
```