Get live query results
Base URL
https://{kibana_url}
Auth
Get the results of a live query using the query action ID.
Expand all
space_id
string optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
id
string required
The ID of the live query.
Example:
3c42c847-eb30-4452-80e0-728584042334
actionId
string required
The ID of the query action.
Example:
609c4c66-ba3d-43fa-afdd-53e244577aa0
kuery
string nullable
A KQL search string to filter results.
Example:
agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
page
integer nullable
The page number to return.
pageSize
integer nullable
The number of results to return per page.
sort
string · default: createdAt nullable
The field to sort results by.
sortOrder
enum
The sort order.
Values:
asc
desc
200
Indicates a successful call.
application/json
data
object
+
Show 2 properties
edges
object []
The result rows from the query execution.
+
Show 2 properties
_source
object
The Elasticsearch document source containing query results.
total
integer
The total number of result rows.
404
Either no live query with this id exists in the current space (Action not found; live queries issued from another space also return 404), or it has no query whose action_id matches {actionId} (Live query action not found).
application/json
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Request
Console
1 / 2 languages
‹
›
1
GET kbn:/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0
Generated from the API spec
1
2
curl -X GET "${KIBANA_URL}/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0" \
-H "Authorization: ApiKey ${API_KEY}"
Generated from the API spec
Response
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
"data": {
"edges": [
{
"_id": "doc1",
"_source": {
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agent": {
"id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
},
"osquery": {
"total_seconds": "12345"
}
}
},
{
"_id": "doc2",
"_source": {
"action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
"agent": {
"id": "16d7caf5-efd2-4212-9b62-73dafc91fa13"
},
"osquery": {
"total_seconds": "67890"
}
}
}
],
"total": 2
}
}
1
2
3
{
"message": "Action not found"
}