Update a saved query

Base URL
https://{kibana_url}
Auth

Update a saved query using the query ID.

Note

You cannot update a prebuilt saved query.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string required

The saved query ID.

Example: 3c42c847-eb30-4452-80e0-728584042334

Request body

description string

The saved query description.

ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

id string

The ID of a saved query.

interval string

An interval, in seconds, on which to run the query.

platform string

Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

query string

The SQL query you want to run.

removed boolean

Indicates whether the query is removed.

snapshot boolean

Indicates whether the query is a snapshot.

version string

Uses the Osquery versions greater than or equal to the specified version string.

Response

Indicates a successful call.

application/json
data object required
created_at string · format: date-time
created_by string nullable
created_by_profile_uid string
description string

The saved query description.

ecs_mapping map string to object

Map osquery results columns or static values to Elastic Common Schema (ECS) fields

<string> object
field string

The ECS field to map to.

value union string | string[]

The value to map to the ECS field.

id string required

The ID of a saved query.

interval integer | string
platform string

Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.

prebuilt boolean
query string

The SQL query you want to run.

removed boolean

Indicates whether the query is removed.

saved_object_id string required
snapshot boolean

Indicates whether the query is a snapshot.

timeout integer
updated_at string · format: date-time
updated_by string nullable
updated_by_profile_uid string
version string

The saved query version.

Base URL
https://{kibana_url}