Get unified query history

Base URL
https://{kibana_url}
  • GET /api/osquery/history
  • GET /s/{space_id}/api/osquery/history
Auth

Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

pageSize integer · min: 1 · max: 100 · default: 20

The number of results to return per page.

nextPage string

A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.

kuery string

A search string to filter history entries by pack name, query text, or query ID.

userIds string

Comma-separated list of user IDs to filter live query history.

Example: elastic,admin
sourceFilters string

Comma-separated list of source types to include. Valid values are live, rule, and scheduled.

Example: live,scheduled
startDate string

The start of the time range filter (ISO 8601).

Example: 2024-01-01T00:00:00Z
endDate string

The end of the time range filter (ISO 8601).

Example: 2024-12-31T23:59:59Z

Response

Indicates a successful call.

application/json
data union oneOf[] required

The list of unified history rows for the current page.

One of:
sourceType enum required

Identifies this as a live query history row.

Values: live
agentCount integer required

For live queries, the number of agents targeted by the query. For scheduled rows, the number of distinct agents that responded.

errorCount integer nullable

The number of agent responses with errors.

id string required

Unique identifier for the history row.

packId string

The ID of the pack containing the query.

packName string

The name of the pack containing the query.

queryName string

The name of the query, if available.

queryText string required

The SQL query that was executed.

spaceId string

The Kibana space ID where the query was executed.

successCount integer nullable

The number of successful agent responses.

timestamp string required

The timestamp of the query execution.

totalRows integer nullable

The total number of result rows returned across all agents.

actionId string

The Fleet action ID for the live query.

agentAll boolean

Whether the query targeted all agents.

agentIds string[]

List of targeted agent IDs.

agentPlatforms string[]

List of targeted agent platforms.

agentPolicyIds string[]

List of targeted agent policy IDs.

ecsMapping object

ECS mapping configuration used for the query.

queriesTotal integer

The total number of sub-queries in the live action.

queriesWithResults integer

The number of sub-queries that returned results.

savedQueryId string

The saved query ID, if the live query was based on a saved query.

source enum required

Whether this was a manually run live query or triggered by a rule.

Values: Live Rule
timeout integer

The query timeout in seconds.

userId string

The ID of the user who ran the query.

userProfileUid string

The user profile UID of the user who ran the query.

hasMore boolean required

Whether there are more results beyond the current page.

nextPage string

A base64-encoded cursor to fetch the next page. Absent when there are no more results.

Base URL
https://{kibana_url}