Get live queries

Base URL: https://{kibana_url}

GET /api/osquery/live_queries
GET /s/{space_id}/api/osquery/live_queries

Auth

Get a list of all live queries.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

kuery string nullable: A KQL search string to filter live queries.; Example: agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
page integer nullable: The page number to return.
pageSize integer nullable: The number of results to return per page.
sort string · default: createdAt nullable: The field to sort results by.
sortOrder enum: The sort order.; Values: asc desc

Response

Indicates a successful call.

application/json

data object

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/osquery/live_queries

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/osquery/live_queries" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": {
    "items": [
      {
        "_source": {
          "@timestamp": "2023-10-31T00:00:00Z",
          "action_id": "3c42c847-eb30-4452-80e0-728584042334",
          "agents": [
            "16d7caf5-efd2-4212-9b62-73dafc91fa13"
          ],
          "expiration": "2023-10-31T00:00:00Z",
          "queries": [
            {
              "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
              "agents": [
                "16d7caf5-efd2-4212-9b62-73dafc91fa13"
              ],
              "ecs_mapping": {
                "host.uptime": {
                  "field": "total_seconds"
                }
              },
              "id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
              "query": "select * from uptime;",
              "saved_query_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d"
            }
          ],
          "user_id": "elastic"
        }
      }
    ],
    "total": 1
  }
}