Path parameters

• scheduleId string Required

  The schedule ID of the scheduled query.

• executionCount integer Required

  The execution counter for the scheduled query run whose results are exported. Must be a non-negative integer.

  Minimum value is 0.

Query parameters

• format string Required

  The output format of the exported file.

  Values are ndjson, json, or csv.

Responses

• 200

  application/json

  application/json application/ndjson text/csv

  A downloadable file in the requested format. The Content-Disposition header contains the suggested filename.

  Hide headers attribute Show headers attribute

  • Content-Disposition string

    Attachment disposition with a generated filename, e.g. attachment; filename="osquery-scheduled-results-{scheduleId}-{executionCount}-{timestamp}.csv".

  Hide response attributes Show response attributes object

  • _meta object Required

    Metadata block produced for every export. Included as _meta in the JSON response body and as the first NDJSON line.

    Hide _meta attributes Show _meta attributes object

    • action_id string Required

      The action ID (live query) or schedule ID (scheduled query) that produced the results.

    • csv_columns array[string] | null

      For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.

    • execution_count integer | null

      For scheduled query exports only: the execution counter of the scheduled run that produced the results.

    • exported_by string Required

      Username of the Kibana user who triggered the export.

    • format string Required

      The output format for the exported file. Use ndjson for streaming newline-delimited JSON (recommended for large exports), json for a single JSON array (held in memory; suitable for smaller result sets), or csv for a comma-separated values file with a header row derived from the ECS mapping.

      Values are ndjson, json, or csv.

    • query string | null

      The SQL query text, if it could be resolved from action details.

    • timestamp string(date-time) Required

      ISO 8601 timestamp of when the export was initiated.

    • total_results integer | null

      Total number of result rows included in this export.

  • results array[object] Required

    A single result row from an NDJSON or JSON export. Fields follow the Elastic Common Schema (ECS) mapping defined on the originating query when available; otherwise raw osquery column names are used under the osquery.* namespace.

    A single result row from an NDJSON or JSON export. Fields follow the Elastic Common Schema (ECS) mapping defined on the originating query when available; otherwise raw osquery column names are used under the osquery.* namespace.

    A single result row from an NDJSON or JSON export. Fields follow the Elastic Common Schema (ECS) mapping defined on the originating query when available; otherwise raw osquery column names are used under the osquery.* namespace.

    Additional properties are allowed.

  Newline-delimited JSON stream. The first line is a metadata object (includes execution_count); each subsequent line is a result row.

  CSV file with a header row. No metadata block is included in CSV output.

• 400 application/json

  Bad request. Possible causes: invalid or missing format query parameter, malformed KQL in the request body, invalid esFilters, or the result count exceeds the 500,000-row limit.

  Hide response attribute Show response attribute object

  • message string
• 403

  The authenticated user does not have the osquery-read privilege required to export scheduled query results.