Get saved queries

Base URL: https://{kibana_url}

GET /api/osquery/saved_queries

Get a list of all saved queries.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Response

Indicates a successful call.

application/json

data object[] required: An array of saved query objects.
page integer required: The current page number.
per_page integer required: The number of results per page.
total integer required: The total number of saved queries.

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/osquery/saved_queries

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/osquery/saved_queries" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": [
    {
      "created_at": "2025-02-26T13:37:30.452Z",
      "created_by": "elastic",
      "description": "Saved query description",
      "ecs_mapping": {
        "host.uptime": {
          "field": "total_seconds"
        }
      },
      "id": "my_saved_query",
      "interval": "60",
      "platform": "linux,darwin",
      "query": "select * from uptime;",
      "saved_object_id": "42ba1280-2172-11ee-8523-5765fca79a3c",
      "timeout": 120,
      "updated_at": "2025-02-26T13:37:30.452Z",
      "updated_by": "elastic"
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}