Type to search.

Get scheduled query results

Base URL
https://{kibana_url}
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

scheduleId string required

The schedule ID of the scheduled query.

Example: pack_my_pack_uptime
executionCount integer required

The execution count for this scheduled query run.

Query parameters

kuery string nullable

The kuery to filter the results by.

Example: agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
page integer nullable

The page number to return. The default is 1.

pageSize integer nullable

The number of results to return per page. The default is 20.

sort string · default: createdAt nullable

The field that is used to sort the results.

sortOrder enum

Specifies the sort order.

Values: asc desc
startDate string

The start date filter (ISO 8601) to narrow down results.

Example: 2024-01-01T00:00:00Z

Response

Indicates a successful call.

application/json