---
type: api
title: Get live query results
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/operation/operation-osquerygetlivequeryresults
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/operation/operation-osquerygetlivequeryresults
products:
  - Kibana
---

# Get live query results

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/osquery/live_queries/{id}/results/{actionId}`
- `GET` `/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}`

#### Path parameters

- `id` (string) — required
  The ID of the live query.
  Example: `3c42c847-eb30-4452-80e0-728584042334`
- `actionId` (string) — required
  The ID of the query action.
  Example: `609c4c66-ba3d-43fa-afdd-53e244577aa0`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get the results of a live query using the query action ID.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Query string parameters

- `kuery` (string) — optional — nullable
  A KQL search string to filter results.
  Example: `agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13`
- `page` (integer) — optional — nullable
  The page number to return.
- `pageSize` (integer) — optional — nullable
  The number of results to return per page.
- `sort` (string · default: createdAt) — optional — nullable
  The field to sort results by.
- `sortOrder` (enum) — optional
  The sort order.
  Values: `asc`, `desc`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `data` (object)
  - `edges` (object[])
    The result rows from the query execution.
    - `_id` (string)
    - `_source` (object)
      The Elasticsearch document source containing query results.
  - `total` (integer)
    The total number of result rows.
#### `404`

Either no live query with this `id` exists in the current space (`Action not found`; live queries issued from another space also return 404), or it has no query whose `action_id` matches `{actionId}` (`Live query action not found`).

`application/json`

- `message` (string)
## Code examples

#### Console

```console
GET kbn:/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### Result rows from a live query execution

```json
{
  "data": {
    "edges": [
      {
        "_id": "doc1",
        "_source": {
          "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
          "agent": {
            "id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          },
          "osquery": {
            "total_seconds": "12345"
          }
        }
      },
      {
        "_id": "doc2",
        "_source": {
          "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
          "agent": {
            "id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          },
          "osquery": {
            "total_seconds": "67890"
          }
        }
      }
    ],
    "total": 2
  }
}
```

#### The live query does not exist in the current space

```json
{
  "message": "Action not found"
}
```

#### The id/actionId pair refers to different queries

```json
{
  "message": "Live query action not found"
}
```