IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Create saved query API
edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.
Create saved query API
edit[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Create saved queries.
Request
editPOST <kibana host>:<port>/api/osquery/saved_queries
POST <kibana host>:<port>/s/<space_id>/api/osquery/saved_queries
Path parameters
edit-
space_id -
(Optional, string) The space identifier. When
space_idis not provided in the URL, the default space is used.
Request body
edit-
id - (Required, string) The saved query name.
-
description - (Optional, string) The saved query description.
-
platform - (Optional, string) Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, linux,darwin.
-
query - (Required, string) The SQL query you want to run.
-
version - (Optional, string) Uses the Osquery versions greater than or equal to the specified version string.
-
interval - (Optional, integer) An interval, in seconds, to run the query.
-
ecs_mapping - (Optional, object) Maps Osquery results columns or static values to ECS fields.
Response code
edit-
200 - Indicates a successful call.
Examples
editCreate a saved query:
$ curl -X POST api/osquery/saved_queries \
{
"id": "saved_query_id",
"description": "Saved query description",
"query": "select * from uptime;",
"interval": "60",
"version": "2.8.0",
"platform": "linux,darwin",
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
}
}
The API returns the saved query object:
{
"data": {...}
}