Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Elasticstack Provider
  4. API Docs
  5. getKibanaOsqueryPack
Viewing docs for elasticstack 0.16.3
published on Thursday, Jul 23, 2026 by elastic
Schema (JSON)
elastic/terraform-provider-elasticstack

elasticstack.getKibanaOsqueryPack

Viewing docs for elasticstack 0.16.3
published on Thursday, Jul 23, 2026 by elastic
Schema (JSON)
elastic/terraform-provider-elasticstack

    Reads any Osquery query pack from Kibana by pack_id (saved_object_id), including user-defined and prebuilt (read-only) packs. Prebuilt packs cannot be managed by the elasticstack.KibanaOsqueryPack resource. Requires Kibana 8.5.0 or later.

    Example Usage

    Example coming soon!

    Example coming soon!

    Example coming soon!

    Example coming soon!

    Example coming soon!

    resources:
  # Read a user-managed pack created in the same root module (plan-only friendly).
  example:
    type: elasticstack:KibanaOsqueryPack
    properties:
      name: example-osquery-pack
      enabled: true
      queries:
        find_procs:
          query: SELECT pid, name FROM processes LIMIT 5;
          platform:
            - linux
            - darwin
variables:
  managed:
    fn::invoke:
      function: elasticstack:getKibanaOsqueryPack
      arguments:
        packId: ${example.packId}
outputs:
  managedPackName: ${managed.name}

    Example coming soon!

    Using getKibanaOsqueryPack

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getKibanaOsqueryPack(args: GetKibanaOsqueryPackArgs, opts?: InvokeOptions): Promise<GetKibanaOsqueryPackResult>
function getKibanaOsqueryPackOutput(args: GetKibanaOsqueryPackOutputArgs, opts?: InvokeOutputOptions): Output<GetKibanaOsqueryPackResult>
    def get_kibana_osquery_pack(kibana_connections: Optional[Sequence[GetKibanaOsqueryPackKibanaConnection]] = None,
                            pack_id: Optional[str] = None,
                            space_id: Optional[str] = None,
                            opts: Optional[InvokeOptions] = None) -> GetKibanaOsqueryPackResult
def get_kibana_osquery_pack_output(kibana_connections: pulumi.Input[Optional[Sequence[pulumi.Input[GetKibanaOsqueryPackKibanaConnectionArgs]]]] = None,
                            pack_id: pulumi.Input[Optional[str]] = None,
                            space_id: pulumi.Input[Optional[str]] = None,
                            opts: Optional[InvokeOutputOptions] = None) -> Output[GetKibanaOsqueryPackResult]
    func LookupKibanaOsqueryPack(ctx *Context, args *LookupKibanaOsqueryPackArgs, opts ...InvokeOption) (*LookupKibanaOsqueryPackResult, error)
func LookupKibanaOsqueryPackOutput(ctx *Context, args *LookupKibanaOsqueryPackOutputArgs, opts ...InvokeOption) LookupKibanaOsqueryPackResultOutput

    > Note: This function is named LookupKibanaOsqueryPack in the Go SDK.

    public static class GetKibanaOsqueryPack 
{
    public static Task<GetKibanaOsqueryPackResult> InvokeAsync(GetKibanaOsqueryPackArgs args, InvokeOptions? opts = null)
    public static Output<GetKibanaOsqueryPackResult> Invoke(GetKibanaOsqueryPackInvokeArgs args, InvokeOptions? opts = null)
    public static Output<GetKibanaOsqueryPackResult> Invoke(GetKibanaOsqueryPackInvokeArgs args, InvokeOutputOptions opts)
}
    public static CompletableFuture<GetKibanaOsqueryPackResult> getKibanaOsqueryPack(GetKibanaOsqueryPackArgs args, InvokeOptions options)
public static Output<GetKibanaOsqueryPackResult> getKibanaOsqueryPack(GetKibanaOsqueryPackArgs args, InvokeOptions options)
public static Output<GetKibanaOsqueryPackResult> getKibanaOsqueryPack(GetKibanaOsqueryPackArgs args, InvokeOutputOptions options)

    fn::invoke:
  function: elasticstack:index/getKibanaOsqueryPack:getKibanaOsqueryPack
  arguments:
    # arguments dictionary
    data "elasticstack_get_kibana_osquery_pack" "name" {
    # arguments
}

    The following arguments are supported:

    PackId string
    Kibana saved object identifier for the pack (saved_object_id).
    KibanaConnections List<GetKibanaOsqueryPackKibanaConnection>
    Kibana connection configuration block.
    SpaceId string
    Kibana space identifier. When omitted, the default space is used.
    PackId string
    Kibana saved object identifier for the pack (saved_object_id).
    KibanaConnections []GetKibanaOsqueryPackKibanaConnection
    Kibana connection configuration block.
    SpaceId string
    Kibana space identifier. When omitted, the default space is used.
    pack_id string
    Kibana saved object identifier for the pack (saved_object_id).
    kibana_connections list(object)
    Kibana connection configuration block.
    space_id string
    Kibana space identifier. When omitted, the default space is used.
    packId String
    Kibana saved object identifier for the pack (saved_object_id).
    kibanaConnections List<GetKibanaOsqueryPackKibanaConnection>
    Kibana connection configuration block.
    spaceId String
    Kibana space identifier. When omitted, the default space is used.
    packId string
    Kibana saved object identifier for the pack (saved_object_id).
    kibanaConnections GetKibanaOsqueryPackKibanaConnection[]
    Kibana connection configuration block.
    spaceId string
    Kibana space identifier. When omitted, the default space is used.
    pack_id str
    Kibana saved object identifier for the pack (saved_object_id).
    kibana_connections Sequence[GetKibanaOsqueryPackKibanaConnection]
    Kibana connection configuration block.
    space_id str
    Kibana space identifier. When omitted, the default space is used.
    packId String
    Kibana saved object identifier for the pack (saved_object_id).
    kibanaConnections List<Property Map>
    Kibana connection configuration block.
    spaceId String
    Kibana space identifier. When omitted, the default space is used.

    getKibanaOsqueryPack Result

    The following output properties are available:

    Description string
    Description of the Osquery pack.
    Enabled bool
    Whether the pack is enabled.
    Id string
    Composite identifier in the form <space_id>/<pack_id>.
    Name string
    Human-readable name of the Osquery pack.
    PackId string
    Kibana saved object identifier for the pack (saved_object_id).
    PolicyIds List<string>
    Fleet agent policy IDs this pack is deployed to.
    Queries Dictionary<string, GetKibanaOsqueryPackQueries>
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    ReadOnly bool
    Whether the pack is prebuilt and read-only. Prebuilt packs can be read by this data source but not managed by the resource.
    Shards Dictionary<string, double>
    Percent (1-100) of hosts per policy ID that receive the pack.
    KibanaConnections List<GetKibanaOsqueryPackKibanaConnection>
    Kibana connection configuration block.
    SpaceId string
    Kibana space identifier. When omitted, the default space is used.
    Description string
    Description of the Osquery pack.
    Enabled bool
    Whether the pack is enabled.
    Id string
    Composite identifier in the form <space_id>/<pack_id>.
    Name string
    Human-readable name of the Osquery pack.
    PackId string
    Kibana saved object identifier for the pack (saved_object_id).
    PolicyIds []string
    Fleet agent policy IDs this pack is deployed to.
    Queries map[string]GetKibanaOsqueryPackQueries
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    ReadOnly bool
    Whether the pack is prebuilt and read-only. Prebuilt packs can be read by this data source but not managed by the resource.
    Shards map[string]float64
    Percent (1-100) of hosts per policy ID that receive the pack.
    KibanaConnections []GetKibanaOsqueryPackKibanaConnection
    Kibana connection configuration block.
    SpaceId string
    Kibana space identifier. When omitted, the default space is used.
    description string
    Description of the Osquery pack.
    enabled bool
    Whether the pack is enabled.
    id string
    Composite identifier in the form <space_id>/<pack_id>.
    name string
    Human-readable name of the Osquery pack.
    pack_id string
    Kibana saved object identifier for the pack (saved_object_id).
    policy_ids list(string)
    Fleet agent policy IDs this pack is deployed to.
    queries map(object)
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    read_only bool
    Whether the pack is prebuilt and read-only. Prebuilt packs can be read by this data source but not managed by the resource.
    shards map(number)
    Percent (1-100) of hosts per policy ID that receive the pack.
    kibana_connections list(object)
    Kibana connection configuration block.
    space_id string
    Kibana space identifier. When omitted, the default space is used.
    description String
    Description of the Osquery pack.
    enabled Boolean
    Whether the pack is enabled.
    id String
    Composite identifier in the form <space_id>/<pack_id>.
    name String
    Human-readable name of the Osquery pack.
    packId String
    Kibana saved object identifier for the pack (saved_object_id).
    policyIds List<String>
    Fleet agent policy IDs this pack is deployed to.
    queries Map<String,GetKibanaOsqueryPackQueries>
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    readOnly Boolean
    Whether the pack is prebuilt and read-only. Prebuilt packs can be read by this data source but not managed by the resource.
    shards Map<String,Double>
    Percent (1-100) of hosts per policy ID that receive the pack.
    kibanaConnections List<GetKibanaOsqueryPackKibanaConnection>
    Kibana connection configuration block.
    spaceId String
    Kibana space identifier. When omitted, the default space is used.
    description string
    Description of the Osquery pack.
    enabled boolean
    Whether the pack is enabled.
    id string
    Composite identifier in the form <space_id>/<pack_id>.
    name string
    Human-readable name of the Osquery pack.
    packId string
    Kibana saved object identifier for the pack (saved_object_id).
    policyIds string[]
    Fleet agent policy IDs this pack is deployed to.
    queries {[key: string]: GetKibanaOsqueryPackQueries}
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    readOnly boolean
    Whether the pack is prebuilt and read-only. Prebuilt packs can be read by this data source but not managed by the resource.
    shards {[key: string]: number}
    Percent (1-100) of hosts per policy ID that receive the pack.
    kibanaConnections GetKibanaOsqueryPackKibanaConnection[]
    Kibana connection configuration block.
    spaceId string
    Kibana space identifier. When omitted, the default space is used.
    description str
    Description of the Osquery pack.
    enabled bool
    Whether the pack is enabled.
    id str
    Composite identifier in the form <space_id>/<pack_id>.
    name str
    Human-readable name of the Osquery pack.
    pack_id str
    Kibana saved object identifier for the pack (saved_object_id).
    policy_ids Sequence[str]
    Fleet agent policy IDs this pack is deployed to.
    queries Mapping[str, GetKibanaOsqueryPackQueries]
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    read_only bool
    Whether the pack is prebuilt and read-only. Prebuilt packs can be read by this data source but not managed by the resource.
    shards Mapping[str, float]
    Percent (1-100) of hosts per policy ID that receive the pack.
    kibana_connections Sequence[GetKibanaOsqueryPackKibanaConnection]
    Kibana connection configuration block.
    space_id str
    Kibana space identifier. When omitted, the default space is used.
    description String
    Description of the Osquery pack.
    enabled Boolean
    Whether the pack is enabled.
    id String
    Composite identifier in the form <space_id>/<pack_id>.
    name String
    Human-readable name of the Osquery pack.
    packId String
    Kibana saved object identifier for the pack (saved_object_id).
    policyIds List<String>
    Fleet agent policy IDs this pack is deployed to.
    queries Map<Property Map>
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    readOnly Boolean
    Whether the pack is prebuilt and read-only. Prebuilt packs can be read by this data source but not managed by the resource.
    shards Map<Number>
    Percent (1-100) of hosts per policy ID that receive the pack.
    kibanaConnections List<Property Map>
    Kibana connection configuration block.
    spaceId String
    Kibana space identifier. When omitted, the default space is used.

    Supporting Types

    GetKibanaOsqueryPackKibanaConnection

    ApiKey string
    API Key to use for authentication to Kibana
    BearerToken string
    Bearer Token to use for authentication to Kibana
    CaCerts List<string>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    Endpoints List<string>
    Insecure bool
    Disable TLS certificate validation
    Password string
    Password to use for API authentication to Kibana.
    Username string
    Username to use for API authentication to Kibana.
    ApiKey string
    API Key to use for authentication to Kibana
    BearerToken string
    Bearer Token to use for authentication to Kibana
    CaCerts []string
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    Endpoints []string
    Insecure bool
    Disable TLS certificate validation
    Password string
    Password to use for API authentication to Kibana.
    Username string
    Username to use for API authentication to Kibana.
    api_key string
    API Key to use for authentication to Kibana
    bearer_token string
    Bearer Token to use for authentication to Kibana
    ca_certs list(string)
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints list(string)
    insecure bool
    Disable TLS certificate validation
    password string
    Password to use for API authentication to Kibana.
    username string
    Username to use for API authentication to Kibana.
    apiKey String
    API Key to use for authentication to Kibana
    bearerToken String
    Bearer Token to use for authentication to Kibana
    caCerts List<String>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints List<String>
    insecure Boolean
    Disable TLS certificate validation
    password String
    Password to use for API authentication to Kibana.
    username String
    Username to use for API authentication to Kibana.
    apiKey string
    API Key to use for authentication to Kibana
    bearerToken string
    Bearer Token to use for authentication to Kibana
    caCerts string[]
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints string[]
    insecure boolean
    Disable TLS certificate validation
    password string
    Password to use for API authentication to Kibana.
    username string
    Username to use for API authentication to Kibana.
    api_key str
    API Key to use for authentication to Kibana
    bearer_token str
    Bearer Token to use for authentication to Kibana
    ca_certs Sequence[str]
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints Sequence[str]
    insecure bool
    Disable TLS certificate validation
    password str
    Password to use for API authentication to Kibana.
    username str
    Username to use for API authentication to Kibana.
    apiKey String
    API Key to use for authentication to Kibana
    bearerToken String
    Bearer Token to use for authentication to Kibana
    caCerts List<String>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints List<String>
    insecure Boolean
    Disable TLS certificate validation
    password String
    Password to use for API authentication to Kibana.
    username String
    Username to use for API authentication to Kibana.

    GetKibanaOsqueryPackQueries

    EcsMapping Dictionary<string, GetKibanaOsqueryPackQueriesEcsMapping>
    Maps query result columns to ECS field paths.
    Platforms List<string>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    Query string
    Osquery SQL query text.
    Removed bool
    Whether the query is marked removed.
    SavedQueryId string
    References an elasticstack.KibanaOsquerySavedQuery resource.
    Snapshot bool
    Whether the query is a snapshot.
    Version string
    Query version string.
    EcsMapping map[string]GetKibanaOsqueryPackQueriesEcsMapping
    Maps query result columns to ECS field paths.
    Platforms []string
    Target platforms for the query. Allowed values: linux, darwin, windows.
    Query string
    Osquery SQL query text.
    Removed bool
    Whether the query is marked removed.
    SavedQueryId string
    References an elasticstack.KibanaOsquerySavedQuery resource.
    Snapshot bool
    Whether the query is a snapshot.
    Version string
    Query version string.
    ecs_mapping map(object)
    Maps query result columns to ECS field paths.
    platforms list(string)
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query string
    Osquery SQL query text.
    removed bool
    Whether the query is marked removed.
    saved_query_id string
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot bool
    Whether the query is a snapshot.
    version string
    Query version string.
    ecsMapping Map<String,GetKibanaOsqueryPackQueriesEcsMapping>
    Maps query result columns to ECS field paths.
    platforms List<String>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query String
    Osquery SQL query text.
    removed Boolean
    Whether the query is marked removed.
    savedQueryId String
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot Boolean
    Whether the query is a snapshot.
    version String
    Query version string.
    ecsMapping {[key: string]: GetKibanaOsqueryPackQueriesEcsMapping}
    Maps query result columns to ECS field paths.
    platforms string[]
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query string
    Osquery SQL query text.
    removed boolean
    Whether the query is marked removed.
    savedQueryId string
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot boolean
    Whether the query is a snapshot.
    version string
    Query version string.
    ecs_mapping Mapping[str, GetKibanaOsqueryPackQueriesEcsMapping]
    Maps query result columns to ECS field paths.
    platforms Sequence[str]
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query str
    Osquery SQL query text.
    removed bool
    Whether the query is marked removed.
    saved_query_id str
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot bool
    Whether the query is a snapshot.
    version str
    Query version string.
    ecsMapping Map<Property Map>
    Maps query result columns to ECS field paths.
    platforms List<String>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query String
    Osquery SQL query text.
    removed Boolean
    Whether the query is marked removed.
    savedQueryId String
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot Boolean
    Whether the query is a snapshot.
    version String
    Query version string.

    GetKibanaOsqueryPackQueriesEcsMapping

    Field string
    Query result column name to map from.
    Value string
    Static scalar ECS mapping value.
    Values List<string>
    Static array ECS mapping values.
    Field string
    Query result column name to map from.
    Value string
    Static scalar ECS mapping value.
    Values []string
    Static array ECS mapping values.
    field string
    Query result column name to map from.
    value string
    Static scalar ECS mapping value.
    values list(string)
    Static array ECS mapping values.
    field String
    Query result column name to map from.
    value String
    Static scalar ECS mapping value.
    values List<String>
    Static array ECS mapping values.
    field string
    Query result column name to map from.
    value string
    Static scalar ECS mapping value.
    values string[]
    Static array ECS mapping values.
    field str
    Query result column name to map from.
    value str
    Static scalar ECS mapping value.
    values Sequence[str]
    Static array ECS mapping values.
    field String
    Query result column name to map from.
    value String
    Static scalar ECS mapping value.
    values List<String>
    Static array ECS mapping values.

    Package Details

    Repository
    elasticstack elastic/terraform-provider-elasticstack
    License
    Notes
    This Pulumi package is based on the elasticstack Terraform Provider.
    Viewing docs for elasticstack 0.16.3
    published on Thursday, Jul 23, 2026 by elastic
    Schema (JSON)
    elastic/terraform-provider-elasticstack

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial