Copy a saved query
Base URL
https://{kibana_url}
POST
/api/osquery/saved_queries/{id} /copy
POST
/s/{space_id} /api/osquery/saved_queries/{id} /copy
Auth
Stack
9.4+
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Generally available since 9.4
This functionality is generally available and ready for production usage.
Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Create a copy of a saved query with a unique name by appending a _copy suffix. If the name already exists, a numeric suffix is added (e.g., _copy_2).
Expand all
space_id
string optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
id
string required
The ID of the saved query to copy.
Example:
3c42c847-eb30-4452-80e0-728584042334
200
Indicates a successful call.
application/json
data
object required
−
Hide 16 properties
created_at
string · format: date-time
created_by
string nullable
created_by_profile_uid
string
description
string
The saved query description.
ecs_mapping
map string to object
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
<string>
object
+
Show 2 properties
field
string
The ECS field to map to.
value
union string | string []
The value to map to the ECS field.
id
string required
The ID of a saved query.
interval
integer | string
platform
string
Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.
query
string
The SQL query you want to run.
removed
boolean
Indicates whether the query is removed.
saved_object_id
string required
snapshot
boolean
Indicates whether the query is a snapshot.
updated_at
string · format: date-time
updated_by
string nullable
updated_by_profile_uid
string
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Request
Console
1 / 2 languages
‹
›
1
POST kbn:/api/osquery/saved_queries/3c42c847-eb30-4452-80e0-728584042334/copy
Generated from the API spec
1
2
curl -X POST "${KIBANA_URL}/api/osquery/saved_queries/3c42c847-eb30-4452-80e0-728584042334/copy" \
-H "Authorization: ApiKey ${API_KEY}"
Generated from the API spec
Response
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
"data": {
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "Saved query description",
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "my_saved_query_copy",
"interval": "60",
"platform": "linux,darwin",
"query": "select * from uptime;",
"removed": false,
"saved_object_id": "42ba1280-2172-11ee-8523-5765fca79a3c",
"snapshot": true,
"timeout": 120,
"updated_at": "2025-02-26T13:37:30.452Z",
"updated_by": "elastic"
}
}