GET /api/osquery/live_queries/{id}
Api key auth

Spaces method and path for this operation:

get /s/{space_id}/api/osquery/live_queries/{id}

Refer to Spaces for more information.

Get the details of a live query using the query ID.

Path parameters

  • id string Required

    The ID of the live query.

Responses

  • 200 application/json

    Indicates a successful call.

    Hide response attribute Show response attribute object
    • data object
      Hide data attributes Show data attributes object
      • @timestamp string(date-time)
      • action_id string
      • agents array[string]
      • expiration string(date-time)
      • pack_id string
      • pack_name string
      • prebuilt_pack boolean
      • queries array[object]

        The queries with their execution status.

        Hide queries attributes Show queries attributes object
        • action_id string
        • agents array[string]
        • docs integer

          Number of result documents.

        • ecs_mapping object

          Map osquery results columns or static values to Elastic Common Schema (ECS) fields

          Hide ecs_mapping attribute Show ecs_mapping attribute object
          • * object Additional properties
            Hide * attributes Show * attributes object
        • failed integer

          Number of failed queries.

        • id string
        • pending integer

          Number of pending agents.

        • query string
        • responded integer

          Total responded agents.

        • saved_query_id string
        • status string

          Status of this individual query.

          Values are completed or running.

        • successful integer

          Number of successful agents.

      • status string

        Global status of the live query (completed, running).

        Values are completed or running.

      • tags array[string]
      • user_id string
      • user_profile_uid string
GET /api/osquery/live_queries/{id} 
curl \
 --request GET 'https://<KIBANA_URL>/api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334' \
 --header "Authorization: $API_KEY"
Response examples (200) 
{
  "data": {
    "@timestamp": "2022-07-26T09:59:32.220Z",
    "action_id": "3c42c847-eb30-4452-80e0-728584042334",
    "agents": [
      "16d7caf5-efd2-4212-9b62-73dafc91fa13"
    ],
    "expiration": "2022-07-26T10:04:32.220Z",
    "queries": [
      {
        "action_id": "609c4c66-ba3d-43fa-afdd-53e244577aa0",
        "agents": [
          "16d7caf5-efd2-4212-9b62-73dafc91fa13"
        ],
        "docs": 1,
        "failed": 0,
        "id": "6724a474-cbba-41ef-a1aa-66aebf0879e2",
        "pending": 0,
        "query": "select * from uptime;",
        "responded": 1,
        "status": "completed",
        "successful": 1
      }
    ],
    "status": "completed",
    "user_id": "elastic"
  }
}