Export live query results

Base URL
https://{kibana_url}
Auth

Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.

Path parameters

id string required

The ID of the live query (parent action ID).

Example: 3c42c847-eb30-4452-80e0-728584042334
actionId string required

The query action ID whose results are exported. Filters the export to rows for this specific per-agent action.

Example: 609c4c66-ba3d-43fa-afdd-53e244577aa0

Query parameters

format enum required

The output format of the exported file.

Values: ndjson json csv

Request body

agentIds string[] nullable

An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.

esFilters object[] nullable

An optional array of Elasticsearch / Kibana SearchBar filter objects (the same esFilters payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.

kuery string nullable

An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.

Responses

A downloadable file in the requested format. The Content-Disposition header contains the suggested filename.

application/json
_meta object required

Metadata block produced for every export. Included as _meta in the JSON response body and as the first NDJSON line.

action_id string required

The action ID (live query) or schedule ID (scheduled query) that produced the results.

csv_columns string[] nullable

For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.

execution_count integer nullable

For scheduled query exports only: the execution counter of the scheduled run that produced the results.

exported_by string required

Username of the Kibana user who triggered the export.

format enum required

The output format for the exported file. Use ndjson for streaming newline-delimited JSON (recommended for large exports), json for a single JSON array (held in memory; suitable for smaller result sets), or csv for a comma-separated values file with a header row derived from the ECS mapping.

Values: ndjson json csv
query string nullable

The SQL query text, if it could be resolved from action details.

timestamp string · format: date-time required

ISO 8601 timestamp of when the export was initiated.

total_results integer nullable

Total number of result rows included in this export.

results object[] required

Response headers

Content-Disposition string

Attachment disposition with a generated filename, e.g. attachment; filename="osquery-results-{actionId}-{timestamp}.ndjson".

Bad request. Possible causes: invalid or missing format query parameter, malformed KQL in the request body, invalid esFilters, or the result count exceeds the 500,000-row limit.

application/json
message string
403

The authenticated user does not have the osquery-readLiveQueries privilege required to export live query results.

The parent live query action {id} was found but does not contain a query whose action_id matches {actionId}. This typically means the id and actionId URL parameters refer to different queries.

application/json
message string
Base URL
https://{kibana_url}