---
title: "Export scheduled query results"
method: POST
path: "/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export"
tags: ["Security Osquery API"]
---

# Export scheduled query results

`POST /api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Export all result rows for a specific scheduled query execution as a downloadable file. The response is a streaming file attachment in the requested format.

## Path parameters

- `scheduleId` string, required — The schedule ID of the scheduled query.
- `executionCount` integer, required — The execution counter for this scheduled query run.

## Query parameters

- `format` 'ndjson' | 'json' | 'csv', required — The output format for the exported file. Use `ndjson` for streaming newline-delimited JSON (recommended for large exports), `json` for a single JSON array (held in memory; suitable for smaller result sets), or `csv` for a comma-separated values file with a header row derived from the ECS mapping.

## Request body

- SecurityOsqueryAPIExportRequestBody, nullable — Optional request body for export endpoints. All fields are optional. Omit the body or send `null` or `{}` to export all results without additional filtering.
  - `agentIds` string[], nullable — An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.
  - `esFilters` object[], nullable — An optional array of Elasticsearch / Kibana SearchBar filter objects (the same `esFilters` payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.
  - `kuery` string, nullable — An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.

## Response `200`

A downloadable file in the requested format. The `Content-Disposition` header contains the suggested filename.

- SecurityOsqueryAPIExportJsonResponse — JSON export response body. The `_meta` field contains export metadata; `results` contains all result rows. Prefer `ndjson` for large exports since rows are streamed individually rather than held in memory.
  - `_meta` SecurityOsqueryAPIExportMetadata, required — Metadata block produced for every export. Included as `_meta` in the JSON response body and as the first NDJSON line.
    - `action_id` string, required — The action ID (live query) or schedule ID (scheduled query) that produced the results.
    - `csv_columns` string[], nullable — For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.
    - `execution_count` integer, nullable — For scheduled query exports only: the execution counter of the scheduled run that produced the results.
    - `exported_by` string, required — Username of the Kibana user who triggered the export.
    - `format` 'ndjson' | 'json' | 'csv', required — The output format for the exported file. Use `ndjson` for streaming newline-delimited JSON (recommended for large exports), `json` for a single JSON array (held in memory; suitable for smaller result sets), or `csv` for a comma-separated values file with a header row derived from the ECS mapping.
    - `query` string, nullable — The SQL query text, if it could be resolved from action details.
    - `timestamp` string, date-time, required — ISO 8601 timestamp of when the export was initiated.
    - `total_results` integer, nullable — Total number of result rows included in this export.
  - `results` SecurityOsqueryAPIExportResultRow[], required

## Other responses

- `400` — Bad request. Possible causes: invalid or missing `format` query parameter, malformed KQL in the request body, invalid `esFilters`, or the result count exceeds the 500,000-row limit.
- `403` — The authenticated user does not have the `osquery-read` privilege required to export scheduled query results.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)