Get live query results

Base URL: https://{kibana_url}

GET /api/osquery/live_queries/{id}/results/{actionId}

Auth

Get the results of a live query using the query action ID.

Path parameters

id string required: The ID of the live query.; Example: 3c42c847-eb30-4452-80e0-728584042334
actionId string required: The ID of the query action.; Example: 609c4c66-ba3d-43fa-afdd-53e244577aa0

Query parameters

kuery string nullable: A KQL search string to filter results.; Example: agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
page integer nullable: The page number to return.
pageSize integer nullable: The number of results to return per page.
sort string · default: createdAt nullable: The field to sort results by.
sortOrder enum: The sort order.; Values: asc desc

Response

Indicates a successful call.

application/json

data object

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": {
    "edges": [
      {
        "_id": "doc1",
        "_source": {
          "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
          "agent": {
            "id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          },
          "osquery": {
            "total_seconds": "12345"
          }
        }
      },
      {
        "_id": "doc2",
        "_source": {
          "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
          "agent": {
            "id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          },
          "osquery": {
            "total_seconds": "67890"
          }
        }
      }
    ],
    "total": 2
  }
}