Get live query details
- Base URL
-
https://{kibana_url}
-
GET
/api/osquery/live_queries/{id}
Auth
Get the details of a live query using the query ID.
-
id
string
required
-
The ID of the live query.
-
Example:
3c42c847-eb30-4452-80e0-728584042334
Indicates a successful call.
-
data
object
-
-
@timestamp
string · format: date-time
-
expiration
string · format: date-time
-
queries
object[]
-
The queries with their execution status.
-
-
docs
integer
-
Number of result documents.
-
ecs_mapping
map string to object
-
Map osquery results columns or static values to Elastic Common Schema (ECS) fields
-
<string>
object
-
-
field
string
-
The ECS field to map to.
-
value
union string | string[]
-
The value to map to the ECS field.
-
failed
integer
-
Number of failed queries.
-
pending
integer
-
Number of pending agents.
-
responded
integer
-
Total responded agents.
-
status
enum
-
Status of this individual query.
-
Values:
completed
running
-
successful
integer
-
Number of successful agents.
-
status
enum
-
Global status of the live query (completed, running).
-
Values:
completed
running
Thank you for your feedback.