Get live query results

Base URL: https://{kibana_url}

GET /api/osquery/live_queries/{id}/results/{actionId}
GET /s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}

Auth

Get the results of a live query using the query action ID.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
id string required: Example: 3c42c847-eb30-4452-80e0-728584042334
actionId string required: Example: 609c4c66-ba3d-43fa-afdd-53e244577aa0

Query parameters

kuery string nullable: Example: agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
page integer nullable
pageSize integer nullable
sort string · default: createdAt nullable
sortOrder enum: Values: asc desc

Response

application/json

Response Type: object

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "data": {
    "edges": [
      {},
      {}
    ],
    "total": 2
  }
}

Generated from the API spec