Export live query results Generally available; Added in 9.5.0

POST /api/osquery/live_queries/{id}/results/{actionId}/_export
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}/_export

Refer to Spaces for more information.

Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.

Path parameters

  • id string Required

    The ID of the live query (parent action ID).

  • actionId string Required

    The query action ID whose results are exported. Filters the export to rows for this specific per-agent action.

Query parameters

  • format string Required

    The output format of the exported file.

    Values are ndjson, json, or csv.

application/json

Body

  • agentIds array[string] | null

    An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.

  • esFilters array[object] | null

    An optional array of Elasticsearch / Kibana SearchBar filter objects (the same esFilters payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.

    Additional properties are allowed.

  • kuery string | null

    An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.

Responses

  • 200

    A downloadable file in the requested format. The Content-Disposition header contains the suggested filename.

    Hide headers attribute Show headers attribute
    • Content-Disposition string

      Attachment disposition with a generated filename, e.g. attachment; filename="osquery-results-{actionId}-{timestamp}.ndjson".

    Hide response attributes Show response attributes object
    • _meta object Required

      Metadata block produced for every export. Included as _meta in the JSON response body and as the first NDJSON line.

      Hide _meta attributes Show _meta attributes object
      • action_id string Required

        The action ID (live query) or schedule ID (scheduled query) that produced the results.

      • csv_columns array[string] | null

        For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.

      • execution_count integer | null

        For scheduled query exports only: the execution counter of the scheduled run that produced the results.

      • exported_by string Required

        Username of the Kibana user who triggered the export.

      • format string Required

        The output format for the exported file. Use ndjson for streaming newline-delimited JSON (recommended for large exports), json for a single JSON array (held in memory; suitable for smaller result sets), or csv for a comma-separated values file with a header row derived from the ECS mapping.

        Values are ndjson, json, or csv.

      • query string | null

        The SQL query text, if it could be resolved from action details.

      • timestamp string(date-time) Required

        ISO 8601 timestamp of when the export was initiated.

      • total_results integer | null

        Total number of result rows included in this export.

    • results array[object] Required

      A single result row from an NDJSON or JSON export. Fields follow the Elastic Common Schema (ECS) mapping defined on the originating query when available; otherwise raw osquery column names are used under the osquery.* namespace.

      A single result row from an NDJSON or JSON export. Fields follow the Elastic Common Schema (ECS) mapping defined on the originating query when available; otherwise raw osquery column names are used under the osquery.* namespace.

      A single result row from an NDJSON or JSON export. Fields follow the Elastic Common Schema (ECS) mapping defined on the originating query when available; otherwise raw osquery column names are used under the osquery.* namespace.

      Additional properties are allowed.

    Newline-delimited JSON stream. The first line is a metadata object; each subsequent line is a result row.

    CSV file with a header row derived from the ECS mapping of the originating query (when available). No metadata block is included in CSV output.
  • 400 application/json

    Bad request. Possible causes: invalid or missing format query parameter, malformed KQL in the request body, invalid esFilters, or the result count exceeds the 500,000-row limit.

    Hide response attribute Show response attribute object
    • message string
  • 403

    The authenticated user does not have the osquery-readLiveQueries privilege required to export live query results.

  • 404 application/json

    The parent live query action {id} was found but does not contain a query whose action_id matches {actionId}. This typically means the id and actionId URL parameters refer to different queries.

    Hide response attribute Show response attribute object
    • message string
POST /api/osquery/live_queries/{id}/results/{actionId}/_export 
curl \
 --request POST 'https://localhost:5601/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0/_export?format=ndjson' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"kuery\": \"user.name: \\\"root\\\"\"\n}"'
Request example 
{
  "kuery": "user.name: \"root\""
}
Response examples (200) 
{
  "_meta": {
    "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
    "exported_by": "elastic",
    "format": "json",
    "query": "SELECT * FROM users;",
    "timestamp": "2026-04-30T09:12:00.000Z",
    "total_results": 2
  },
  "results": [
    {
      "@timestamp": "2026-04-30T09:11:58.321Z",
      "agent": {
        "id": "980a6b73-0b03-4d1e-8915-67c202e4a980",
        "name": "prod-host-1"
      },
      "user": {
        "id": "1000",
        "name": "ubuntu"
      }
    }
  ]
}
Response examples (200) 
{"_meta":{"action_id":"609c4c66-ba3d-43fa-afdd-53e244577aa0","query":"SELECT * FROM users;","timestamp":"2026-04-30T09:12:00.000Z","exported_by":"elastic","format":"ndjson","total_results":2}}
{"@timestamp":"2026-04-30T09:11:58.321Z","agent":{"id":"980a6b73-0b03-4d1e-8915-67c202e4a980","name":"prod-host-1"},"user":{"id":"1000","name":"ubuntu"}}
{"@timestamp":"2026-04-30T09:11:58.456Z","agent":{"id":"980a6b73-0b03-4d1e-8915-67c202e4a980","name":"prod-host-1"},"user":{"id":"0","name":"root"}}
Response examples (200) 
agent.name,agent.id,user.id,user.name
prod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,1000,ubuntu
prod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,0,root
Response examples (400) 
{
  "message": "Export limited to 500,000 results. Found 500,001. Please add filters to narrow results."
}
Response examples (404) 
{
  "message": "Live query action not found"
}