stack kb security-osquery-api osquery-export-live-query-results cli command

elastic stack kb security-osquery-api osquery-export-live-query-results \
  --id <id> \
  --action-id <action-id> \
  --format <format> \
  [options]
		

Export live query results

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--id string required

The ID of the live query (parent action ID).

--action-id string required

The query action ID whose results are exported. Filters the export to rows for this specific per-agent action.

--format enum required

The output format of the exported file.

Values: ndjson, json, csv

--body string

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--json

output as JSON