Export live query results

Base URL
https://{kibana_url}
Auth

Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string required

The ID of the live query (parent action ID).

Example: 3c42c847-eb30-4452-80e0-728584042334
actionId string required

The query action ID whose results are exported. Filters the export to rows for this specific per-agent action.

Example: 609c4c66-ba3d-43fa-afdd-53e244577aa0

Query parameters

format enum required

The output format of the exported file.

Values: ndjson json csv

Request body

agentIds string[] nullable

An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.

esFilters object[] nullable

An optional array of Elasticsearch / Kibana SearchBar filter objects (the same esFilters payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.

kuery string nullable

An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.

Responses

A downloadable file in the requested format. The Content-Disposition header contains the suggested filename.

application/json
_meta object required

Metadata block produced for every export. Included as _meta in the JSON response body and as the first NDJSON line.

action_id string required

The action ID (live query) or schedule ID (scheduled query) that produced the results.

csv_columns string[] nullable

For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.

execution_count integer nullable

For scheduled query exports only: the execution counter of the scheduled run that produced the results.

exported_by string required

Username of the Kibana user who triggered the export.

format enum required

The output format for the exported file. Use ndjson for streaming newline-delimited JSON (recommended for large exports), json for a single JSON array (held in memory; suitable for smaller result sets), or csv for a comma-separated values file with a header row derived from the ECS mapping.

Values: ndjson json csv
query string nullable

The SQL query text, if it could be resolved from action details.

timestamp string · format: date-time required

ISO 8601 timestamp of when the export was initiated.

total_results integer nullable

Total number of result rows included in this export.

results object[] required

Response headers

Content-Disposition string

Attachment disposition with a generated filename, e.g. attachment; filename="osquery-results-{actionId}-{timestamp}.ndjson".

Bad request. Possible causes: invalid or missing format query parameter, malformed KQL in the request body, invalid esFilters, or the result count exceeds the 500,000-row limit.

application/json
message string
403

The authenticated user does not have the osquery-readLiveQueries privilege required to export live query results.

The parent live query action {id} was found but does not contain a query whose action_id matches {actionId}. This typically means the id and actionId URL parameters refer to different queries.

application/json
message string
Base URL
https://{kibana_url}