You are looking at preliminary documentation for a future release.
Not what you want? See the
current release documentation.
Get live query results APIedit
[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Retrieve a single live query result by ID.
Requestedit
GET <kibana host>:<port>/api/osquery/live_queries/<id>/results/<query_action_id>
GET <kibana host>:<port>/s/<space_id>/api/osquery/live_queries/<query_action_id>
Path parametersedit
-
space_id -
(Optional, string) The space identifier. When
space_idis not provided in the URL, the default space is used. -
id - (Required, string) The ID of the live query result you want to retrieve.
-
query_action_id - (Required, string) The ID of the query action that generated the live query results.
Response codeedit
-
200 - Indicates a successful call.
-
404 - The specified live query or <query_action_id> doesn’t exist.
Exampleedit
Retrieve the live query results for 3c42c847-eb30-4452-80e0-728584042334 ID and 609c4c66-ba3d-43fa-afdd-53e244577aa0 query action ID:
$ curl -X GET api/osquery/live_queries/3c42c847-eb30-4452-80e0-728584042334/results/609c4c66-ba3d-43fa-afdd-53e244577aa0
The API returns a live query action single query result:
{
"data": {
"total": 2,
"edges": [{...}, {...}],
}
}