Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Osquery API

Export scheduled query results

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export</span></div>

Refer to Spaces for more information.

Export all result rows for a specific scheduled query execution as a downloadable file. The response is a streaming file attachment in the requested format.

post/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export

Path parameters

scheduleIdstring required

The schedule ID of the scheduled query.

Example:90f342ee-9c05-4844-849b-173993234f22

The schedule ID of the scheduled query.

executionCountinteger required

The execution counter for this scheduled query run.

Example:17384

The execution counter for the scheduled query run whose results are exported. Must be a non-negative integer.

Query parameters

format'ndjson' | 'json' | 'csv' required

The output format for the exported file. Use ndjson for streaming newline-delimited JSON (recommended for large exports), json for a single JSON array (held in memory; suitable for smaller result sets), or csv for a comma-separated values file with a header row derived from the ECS mapping.

Example:ndjson

The output format of the exported file.

Request body

agentIdsstring[] nullable

An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.

esFiltersobject[] nullable

An optional array of Elasticsearch / Kibana SearchBar filter objects (the same esFilters payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.

kuerystring nullable

An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.

Example request

{
  "agentIds": [
    "980a6b73-0b03-4d1e-8915-67c202e4a980",
    "e40fde1c-5729-4885-b0b2-16a42e9332e3"
  ],
  "esFilters": [
    {
      "meta": {
        "key": "agent.name",
        "params": {
          "query": "prod-host-1"
        },
        "type": "phrase"
      },
      "query": {
        "match_phrase": {
          "agent.name": "prod-host-1"
        }
      }
    }
  ],
  "kuery": "host.name: \"prod-host-1\""
}

Response

A downloadable file in the requested format. The Content-Disposition header contains the suggested filename.

resultsSecurityOsqueryAPIExportResultRow[] required

Example response

{
  "_meta": {
    "action_id": "e88d7652-fc3e-4544-b0e0-3d5df2be454c",
    "execution_count": 17384,
    "exported_by": "elastic",
    "format": "ndjson",
    "query": "SELECT * FROM users;",
    "timestamp": "2026-04-30T09:12:00.000Z",
    "total_results": 64
  },
  "results": [
    {
      "@timestamp": "2026-04-30T09:11:58.321Z",
      "agent": {
        "id": "980a6b73-0b03-4d1e-8915-67c202e4a980",
        "name": "prod-host-1",
        "type": "osquerybeat",
        "version": "9.4.0"
      },
      "osquery": {
        "directory": "/home/ubuntu",
        "gid": "1000",
        "shell": "/bin/bash",
        "uid": "1000",
        "username": "ubuntu"
      },
      "user": {
        "group": {
          "id": "1000"
        },
        "id": "1000",
        "name": "ubuntu"
      }
    }
  ]
}