---
type: api
title: Get live queries
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v9/operation/operation-osqueryfindlivequeries
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v9/operation/operation-osqueryfindlivequeries
products:
  - Kibana
---

# Get live queries

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/osquery/live_queries`
- `GET` `/s/{space_id}/api/osquery/live_queries`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get a list of all live queries.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Query string parameters

- `kuery` (string) — optional — nullable
  A KQL search string to filter live queries.
  Example: `agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13`
- `page` (integer) — optional — nullable
  The page number to return.
- `pageSize` (integer) — optional — nullable
  The number of results to return per page.
- `sort` (string · default: createdAt) — optional — nullable
  The field to sort results by.
- `sortOrder` (enum) — optional
  The sort order.
  Values: `asc`, `desc`

## Response

Indicates a successful call.

`application/json`

- `data` (object)
  - `items` (object[])
    An array of live query action items.
    - `_source` (object)
      - `@timestamp` (string · format: date-time)
      - `action_id` (string)
      - `agents` (string[])
      - `expiration` (string · format: date-time)
      - `pack_id` (string)
      - `queries` (object[])
        - `action_id` (string)
        - `agents` (string[])
        - `ecs_mapping` (map string to object)
          Map osquery results columns or static values to Elastic Common Schema (ECS) fields
          Map values (object)
          - `field` (string)
            The ECS field to map to.
          - `value` (union string | string[])
            The value to map to the ECS field.
        - `id` (string)
        - `query` (string)
        - `saved_query_id` (string)
      - `result_counts` (object)
        Result count statistics (present when withResultCounts is true).
        - `error_agents` (integer)
        - `responded_agents` (integer)
        - `successful_agents` (integer)
        - `total_rows` (integer)
      - `user_id` (string)
  - `total` (integer)
    The total number of live queries.
## Code examples

#### Console

```console
GET kbn:/api/osquery/live_queries
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/osquery/live_queries" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### A list of recent live queries

```json
{
  "data": {
    "items": [
      {
        "_source": {
          "@timestamp": "2023-10-31T00:00:00Z",
          "action_id": "3c42c847-eb30-4452-80e0-728584042334",
          "agents": [
            "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          ],
          "expiration": "2023-10-31T00:00:00Z",
          "queries": [
            {
              "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
              "agents": [
                "16d7caf5-efd2-4212-9b62-73dafc91fa13"
              ],
              "ecs_mapping": {
                "host.uptime": {
                  "field": "total_seconds"
                }
              },
              "id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
              "query": "select * from uptime;",
              "saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d"
            }
          ],
          "user_id": "elastic"
        }
      }
    ],
    "total": 1
  }
}
```