Type to search.

Export scheduled query results

Base URL
https://{kibana_url}
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Export all result rows for a specific scheduled query execution as a downloadable file. The response is a streaming file attachment in the requested format.

Path parameters

scheduleId string required

The schedule ID of the scheduled query.

Example: 90f342ee-9c05-4844-849b-173993234f22
executionCount integer · min: 0 required

The execution counter for the scheduled query run whose results are exported. Must be a non-negative integer.

Query parameters

format enum required

The output format of the exported file.

Values: ndjson json csv

Request body

agentIds string[] nullable

An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.

esFilters object[] nullable

An optional array of Elasticsearch / Kibana SearchBar filter objects (the same esFilters payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.

kuery string nullable

An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.

Responses

A downloadable file in the requested format. The Content-Disposition header contains the suggested filename.

application/json
_meta object required

Metadata block produced for every export. Included as _meta in the JSON response body and as the first NDJSON line.

action_id string required

The action ID (live query) or schedule ID (scheduled query) that produced the results.

csv_columns string[] nullable

For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.

execution_count integer nullable

For scheduled query exports only: the execution counter of the scheduled run that produced the results.

exported_by string required

Username of the Kibana user who triggered the export.

format enum required

The output format for the exported file. Use ndjson for streaming newline-delimited JSON (recommended for large exports), json for a single JSON array (held in memory; suitable for smaller result sets), or csv for a comma-separated values file with a header row derived from the ECS mapping.

Values: ndjson json csv
query string nullable

The SQL query text, if it could be resolved from action details.

timestamp string · format: date-time required

ISO 8601 timestamp of when the export was initiated.

total_results integer nullable

Total number of result rows included in this export.

results object[] required

Response headers

Content-Disposition string

Attachment disposition with a generated filename, e.g. attachment; filename="osquery-scheduled-results-{scheduleId}-{executionCount}-{timestamp}.csv".

403

The authenticated user does not have the osquery-read privilege required to export scheduled query results.