Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Elasticstack Provider
  4. API Docs
  5. getKibanaOsquerySavedQuery
Viewing docs for elasticstack 0.16.3
published on Thursday, Jul 23, 2026 by elastic
Schema (JSON)
elastic/terraform-provider-elasticstack

elasticstack.getKibanaOsquerySavedQuery

Viewing docs for elasticstack 0.16.3
published on Thursday, Jul 23, 2026 by elastic
Schema (JSON)
elastic/terraform-provider-elasticstack

    Reads an Osquery saved query from Kibana, including prebuilt queries shipped with the osquery_manager integration. Requires Kibana 8.5.0 or later. A common use is looking up saved query IDs referenced by Security detection rule response actions.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as elasticstack from "@pulumi/elasticstack";

export = async () => {
    const example = new elasticstack.KibanaOsquerySavedQuery("example", {
        savedQueryId: "list_processes",
        query: "SELECT pid, name FROM processes LIMIT 10;",
        interval: 3600,
    });
    // Read a user-managed query by ID (created above or outside Terraform).
    // A common use is looking up saved query IDs referenced by Security detection
    // rule response actions (response_actions[].params.saved_query_id).
    const managed = elasticstack.getKibanaOsquerySavedQueryOutput({
        savedQueryId: example.savedQueryId,
    });
    // Read a prebuilt query from the osquery_manager integration.
    // Prebuilt IDs vary by integration version; replace with an ID from your deployment
    // (for example processes_elastic from the Kibana API client examples).
    const prebuilt = await elasticstack.getKibanaOsquerySavedQuery({
        savedQueryId: "processes_elastic",
    });
    return {
        managedQuery: managed.apply(managed => managed.query),
        prebuilt: prebuilt.prebuilt,
    };
}

    import pulumi
import pulumi_elasticstack as elasticstack

example = elasticstack.KibanaOsquerySavedQuery("example",
    saved_query_id="list_processes",
    query="SELECT pid, name FROM processes LIMIT 10;",
    interval=3600)
# Read a user-managed query by ID (created above or outside Terraform).
# A common use is looking up saved query IDs referenced by Security detection
# rule response actions (response_actions[].params.saved_query_id).
managed = elasticstack.get_kibana_osquery_saved_query_output(saved_query_id=example.saved_query_id)
# Read a prebuilt query from the osquery_manager integration.
# Prebuilt IDs vary by integration version; replace with an ID from your deployment
# (for example processes_elastic from the Kibana API client examples).
prebuilt = elasticstack.get_kibana_osquery_saved_query(saved_query_id="processes_elastic")
pulumi.export("managedQuery", managed.query)
pulumi.export("prebuilt", prebuilt.prebuilt)

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/elasticstack/elasticstack"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := elasticstack.NewKibanaOsquerySavedQuery(ctx, "example", &elasticstack.KibanaOsquerySavedQueryArgs{
			SavedQueryId: pulumi.String("list_processes"),
			Query:        pulumi.String("SELECT pid, name FROM processes LIMIT 10;"),
			Interval:     pulumi.Float64(3600),
		})
		if err != nil {
			return err
		}
		// Read a user-managed query by ID (created above or outside Terraform).
		// A common use is looking up saved query IDs referenced by Security detection
		// rule response actions (response_actions[].params.saved_query_id).
		managed := elasticstack.LookupKibanaOsquerySavedQueryOutput(ctx, elasticstack.GetKibanaOsquerySavedQueryOutputArgs{
			SavedQueryId: example.SavedQueryId,
		}, nil)
		// Read a prebuilt query from the osquery_manager integration.
		// Prebuilt IDs vary by integration version; replace with an ID from your deployment
		// (for example processes_elastic from the Kibana API client examples).
		prebuilt, err := elasticstack.LookupKibanaOsquerySavedQuery(ctx, &elasticstack.LookupKibanaOsquerySavedQueryArgs{
			SavedQueryId: "processes_elastic",
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("managedQuery", managed.ApplyT(func(managed elasticstack.GetKibanaOsquerySavedQueryResult) (*string, error) {
			return &managed.Query, nil
		}).(pulumi.StringPtrOutput))
		ctx.Export("prebuilt", prebuilt.Prebuilt)
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Elasticstack = Pulumi.Elasticstack;

return await Deployment.RunAsync(() => 
{
    var example = new Elasticstack.KibanaOsquerySavedQuery("example", new()
    {
        SavedQueryId = "list_processes",
        Query = "SELECT pid, name FROM processes LIMIT 10;",
        Interval = 3600,
    });

    // Read a user-managed query by ID (created above or outside Terraform).
    // A common use is looking up saved query IDs referenced by Security detection
    // rule response actions (response_actions[].params.saved_query_id).
    var managed = Elasticstack.GetKibanaOsquerySavedQuery.Invoke(new()
    {
        SavedQueryId = example.SavedQueryId,
    });

    // Read a prebuilt query from the osquery_manager integration.
    // Prebuilt IDs vary by integration version; replace with an ID from your deployment
    // (for example processes_elastic from the Kibana API client examples).
    var prebuilt = Elasticstack.GetKibanaOsquerySavedQuery.Invoke(new()
    {
        SavedQueryId = "processes_elastic",
    });

    return new Dictionary<string, object?>
    {
        ["managedQuery"] = managed.Apply(getKibanaOsquerySavedQueryResult => getKibanaOsquerySavedQueryResult.Query),
        ["prebuilt"] = prebuilt.Apply(getKibanaOsquerySavedQueryResult => getKibanaOsquerySavedQueryResult.Prebuilt),
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.elasticstack.KibanaOsquerySavedQuery;
import com.pulumi.elasticstack.KibanaOsquerySavedQueryArgs;
import com.pulumi.elasticstack.ElasticstackFunctions;
import com.pulumi.elasticstack.inputs.GetKibanaOsquerySavedQueryArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new KibanaOsquerySavedQuery("example", KibanaOsquerySavedQueryArgs.builder()
            .savedQueryId("list_processes")
            .query("SELECT pid, name FROM processes LIMIT 10;")
            .interval(3600.0)
            .build());

        // Read a user-managed query by ID (created above or outside Terraform).
        // A common use is looking up saved query IDs referenced by Security detection
        // rule response actions (response_actions[].params.saved_query_id).
        final var managed = ElasticstackFunctions.getKibanaOsquerySavedQuery(GetKibanaOsquerySavedQueryArgs.builder()
            .savedQueryId(example.savedQueryId())
            .build());

        // Read a prebuilt query from the osquery_manager integration.
        // Prebuilt IDs vary by integration version; replace with an ID from your deployment
        // (for example processes_elastic from the Kibana API client examples).
        final var prebuilt = ElasticstackFunctions.getKibanaOsquerySavedQuery(GetKibanaOsquerySavedQueryArgs.builder()
            .savedQueryId("processes_elastic")
            .build());

        ctx.export("managedQuery", managed.applyValue(_managed -> _managed.query()));
        ctx.export("prebuilt", prebuilt.prebuilt());
    }
}

    resources:
  example:
    type: elasticstack:KibanaOsquerySavedQuery
    properties:
      savedQueryId: list_processes
      query: SELECT pid, name FROM processes LIMIT 10;
      interval: 3600
variables:
  # Read a user-managed query by ID (created above or outside Terraform).
  # A common use is looking up saved query IDs referenced by Security detection
  # rule response actions (response_actions[].params.saved_query_id).
  managed:
    fn::invoke:
      function: elasticstack:getKibanaOsquerySavedQuery
      arguments:
        savedQueryId: ${example.savedQueryId}
  # Read a prebuilt query from the osquery_manager integration.
  # Prebuilt IDs vary by integration version; replace with an ID from your deployment
  # (for example processes_elastic from the Kibana API client examples).
  prebuilt:
    fn::invoke:
      function: elasticstack:getKibanaOsquerySavedQuery
      arguments:
        savedQueryId: processes_elastic
outputs:
  managedQuery: ${managed.query}
  prebuilt: ${prebuilt.prebuilt}

    Example coming soon!

    Using getKibanaOsquerySavedQuery

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getKibanaOsquerySavedQuery(args: GetKibanaOsquerySavedQueryArgs, opts?: InvokeOptions): Promise<GetKibanaOsquerySavedQueryResult>
function getKibanaOsquerySavedQueryOutput(args: GetKibanaOsquerySavedQueryOutputArgs, opts?: InvokeOutputOptions): Output<GetKibanaOsquerySavedQueryResult>
    def get_kibana_osquery_saved_query(kibana_connections: Optional[Sequence[GetKibanaOsquerySavedQueryKibanaConnection]] = None,
                                   saved_query_id: Optional[str] = None,
                                   space_id: Optional[str] = None,
                                   opts: Optional[InvokeOptions] = None) -> GetKibanaOsquerySavedQueryResult
def get_kibana_osquery_saved_query_output(kibana_connections: pulumi.Input[Optional[Sequence[pulumi.Input[GetKibanaOsquerySavedQueryKibanaConnectionArgs]]]] = None,
                                   saved_query_id: pulumi.Input[Optional[str]] = None,
                                   space_id: pulumi.Input[Optional[str]] = None,
                                   opts: Optional[InvokeOutputOptions] = None) -> Output[GetKibanaOsquerySavedQueryResult]
    func LookupKibanaOsquerySavedQuery(ctx *Context, args *LookupKibanaOsquerySavedQueryArgs, opts ...InvokeOption) (*LookupKibanaOsquerySavedQueryResult, error)
func LookupKibanaOsquerySavedQueryOutput(ctx *Context, args *LookupKibanaOsquerySavedQueryOutputArgs, opts ...InvokeOption) LookupKibanaOsquerySavedQueryResultOutput

    > Note: This function is named LookupKibanaOsquerySavedQuery in the Go SDK.

    public static class GetKibanaOsquerySavedQuery 
{
    public static Task<GetKibanaOsquerySavedQueryResult> InvokeAsync(GetKibanaOsquerySavedQueryArgs args, InvokeOptions? opts = null)
    public static Output<GetKibanaOsquerySavedQueryResult> Invoke(GetKibanaOsquerySavedQueryInvokeArgs args, InvokeOptions? opts = null)
    public static Output<GetKibanaOsquerySavedQueryResult> Invoke(GetKibanaOsquerySavedQueryInvokeArgs args, InvokeOutputOptions opts)
}
    public static CompletableFuture<GetKibanaOsquerySavedQueryResult> getKibanaOsquerySavedQuery(GetKibanaOsquerySavedQueryArgs args, InvokeOptions options)
public static Output<GetKibanaOsquerySavedQueryResult> getKibanaOsquerySavedQuery(GetKibanaOsquerySavedQueryArgs args, InvokeOptions options)
public static Output<GetKibanaOsquerySavedQueryResult> getKibanaOsquerySavedQuery(GetKibanaOsquerySavedQueryArgs args, InvokeOutputOptions options)

    fn::invoke:
  function: elasticstack:index/getKibanaOsquerySavedQuery:getKibanaOsquerySavedQuery
  arguments:
    # arguments dictionary
    data "elasticstack_get_kibana_osquery_saved_query" "name" {
    # arguments
}

    The following arguments are supported:

    SavedQueryId string
    Stable identifier for the saved query to look up.
    KibanaConnections List<GetKibanaOsquerySavedQueryKibanaConnection>
    Kibana connection configuration block.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    SavedQueryId string
    Stable identifier for the saved query to look up.
    KibanaConnections []GetKibanaOsquerySavedQueryKibanaConnection
    Kibana connection configuration block.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    saved_query_id string
    Stable identifier for the saved query to look up.
    kibana_connections list(object)
    Kibana connection configuration block.
    space_id string
    An identifier for the space. If space_id is not provided, the default space is used.
    savedQueryId String
    Stable identifier for the saved query to look up.
    kibanaConnections List<GetKibanaOsquerySavedQueryKibanaConnection>
    Kibana connection configuration block.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    savedQueryId string
    Stable identifier for the saved query to look up.
    kibanaConnections GetKibanaOsquerySavedQueryKibanaConnection[]
    Kibana connection configuration block.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    saved_query_id str
    Stable identifier for the saved query to look up.
    kibana_connections Sequence[GetKibanaOsquerySavedQueryKibanaConnection]
    Kibana connection configuration block.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    savedQueryId String
    Stable identifier for the saved query to look up.
    kibanaConnections List<Property Map>
    Kibana connection configuration block.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.

    getKibanaOsquerySavedQuery Result

    The following output properties are available:

    Description string
    Human-readable description of the saved query.
    EcsMapping Dictionary<string, GetKibanaOsquerySavedQueryEcsMapping>
    Maps query result columns to ECS field paths.
    Id string
    Composite identifier in the form <space_id>/<saved_query_id>.
    Interval double
    Query execution interval in seconds.
    Platforms List<string>
    Target platforms for the query.
    Prebuilt bool
    Whether the saved query is prebuilt by the osquery_manager integration package.
    Query string
    Osquery SQL query text.
    Removed bool
    Whether the saved query is marked removed.
    SavedObjectId string
    Kibana saved object identifier used by Kibana's Osquery saved query detail API.
    SavedQueryId string
    Stable identifier for the saved query to look up.
    Snapshot bool
    Whether the saved query is a snapshot.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Version string
    Saved query version string.
    KibanaConnections List<GetKibanaOsquerySavedQueryKibanaConnection>
    Kibana connection configuration block.
    Description string
    Human-readable description of the saved query.
    EcsMapping map[string]GetKibanaOsquerySavedQueryEcsMapping
    Maps query result columns to ECS field paths.
    Id string
    Composite identifier in the form <space_id>/<saved_query_id>.
    Interval float64
    Query execution interval in seconds.
    Platforms []string
    Target platforms for the query.
    Prebuilt bool
    Whether the saved query is prebuilt by the osquery_manager integration package.
    Query string
    Osquery SQL query text.
    Removed bool
    Whether the saved query is marked removed.
    SavedObjectId string
    Kibana saved object identifier used by Kibana's Osquery saved query detail API.
    SavedQueryId string
    Stable identifier for the saved query to look up.
    Snapshot bool
    Whether the saved query is a snapshot.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Version string
    Saved query version string.
    KibanaConnections []GetKibanaOsquerySavedQueryKibanaConnection
    Kibana connection configuration block.
    description string
    Human-readable description of the saved query.
    ecs_mapping map(object)
    Maps query result columns to ECS field paths.
    id string
    Composite identifier in the form <space_id>/<saved_query_id>.
    interval number
    Query execution interval in seconds.
    platforms list(string)
    Target platforms for the query.
    prebuilt bool
    Whether the saved query is prebuilt by the osquery_manager integration package.
    query string
    Osquery SQL query text.
    removed bool
    Whether the saved query is marked removed.
    saved_object_id string
    Kibana saved object identifier used by Kibana's Osquery saved query detail API.
    saved_query_id string
    Stable identifier for the saved query to look up.
    snapshot bool
    Whether the saved query is a snapshot.
    space_id string
    An identifier for the space. If space_id is not provided, the default space is used.
    version string
    Saved query version string.
    kibana_connections list(object)
    Kibana connection configuration block.
    description String
    Human-readable description of the saved query.
    ecsMapping Map<String,GetKibanaOsquerySavedQueryEcsMapping>
    Maps query result columns to ECS field paths.
    id String
    Composite identifier in the form <space_id>/<saved_query_id>.
    interval Double
    Query execution interval in seconds.
    platforms List<String>
    Target platforms for the query.
    prebuilt Boolean
    Whether the saved query is prebuilt by the osquery_manager integration package.
    query String
    Osquery SQL query text.
    removed Boolean
    Whether the saved query is marked removed.
    savedObjectId String
    Kibana saved object identifier used by Kibana's Osquery saved query detail API.
    savedQueryId String
    Stable identifier for the saved query to look up.
    snapshot Boolean
    Whether the saved query is a snapshot.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    version String
    Saved query version string.
    kibanaConnections List<GetKibanaOsquerySavedQueryKibanaConnection>
    Kibana connection configuration block.
    description string
    Human-readable description of the saved query.
    ecsMapping {[key: string]: GetKibanaOsquerySavedQueryEcsMapping}
    Maps query result columns to ECS field paths.
    id string
    Composite identifier in the form <space_id>/<saved_query_id>.
    interval number
    Query execution interval in seconds.
    platforms string[]
    Target platforms for the query.
    prebuilt boolean
    Whether the saved query is prebuilt by the osquery_manager integration package.
    query string
    Osquery SQL query text.
    removed boolean
    Whether the saved query is marked removed.
    savedObjectId string
    Kibana saved object identifier used by Kibana's Osquery saved query detail API.
    savedQueryId string
    Stable identifier for the saved query to look up.
    snapshot boolean
    Whether the saved query is a snapshot.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    version string
    Saved query version string.
    kibanaConnections GetKibanaOsquerySavedQueryKibanaConnection[]
    Kibana connection configuration block.
    description str
    Human-readable description of the saved query.
    ecs_mapping Mapping[str, GetKibanaOsquerySavedQueryEcsMapping]
    Maps query result columns to ECS field paths.
    id str
    Composite identifier in the form <space_id>/<saved_query_id>.
    interval float
    Query execution interval in seconds.
    platforms Sequence[str]
    Target platforms for the query.
    prebuilt bool
    Whether the saved query is prebuilt by the osquery_manager integration package.
    query str
    Osquery SQL query text.
    removed bool
    Whether the saved query is marked removed.
    saved_object_id str
    Kibana saved object identifier used by Kibana's Osquery saved query detail API.
    saved_query_id str
    Stable identifier for the saved query to look up.
    snapshot bool
    Whether the saved query is a snapshot.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    version str
    Saved query version string.
    kibana_connections Sequence[GetKibanaOsquerySavedQueryKibanaConnection]
    Kibana connection configuration block.
    description String
    Human-readable description of the saved query.
    ecsMapping Map<Property Map>
    Maps query result columns to ECS field paths.
    id String
    Composite identifier in the form <space_id>/<saved_query_id>.
    interval Number
    Query execution interval in seconds.
    platforms List<String>
    Target platforms for the query.
    prebuilt Boolean
    Whether the saved query is prebuilt by the osquery_manager integration package.
    query String
    Osquery SQL query text.
    removed Boolean
    Whether the saved query is marked removed.
    savedObjectId String
    Kibana saved object identifier used by Kibana's Osquery saved query detail API.
    savedQueryId String
    Stable identifier for the saved query to look up.
    snapshot Boolean
    Whether the saved query is a snapshot.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    version String
    Saved query version string.
    kibanaConnections List<Property Map>
    Kibana connection configuration block.

    Supporting Types

    GetKibanaOsquerySavedQueryEcsMapping

    Field string
    Query result column name to map from.
    Value string
    Static scalar ECS mapping value.
    Values List<string>
    Static array ECS mapping values.
    Field string
    Query result column name to map from.
    Value string
    Static scalar ECS mapping value.
    Values []string
    Static array ECS mapping values.
    field string
    Query result column name to map from.
    value string
    Static scalar ECS mapping value.
    values list(string)
    Static array ECS mapping values.
    field String
    Query result column name to map from.
    value String
    Static scalar ECS mapping value.
    values List<String>
    Static array ECS mapping values.
    field string
    Query result column name to map from.
    value string
    Static scalar ECS mapping value.
    values string[]
    Static array ECS mapping values.
    field str
    Query result column name to map from.
    value str
    Static scalar ECS mapping value.
    values Sequence[str]
    Static array ECS mapping values.
    field String
    Query result column name to map from.
    value String
    Static scalar ECS mapping value.
    values List<String>
    Static array ECS mapping values.

    GetKibanaOsquerySavedQueryKibanaConnection

    ApiKey string
    API Key to use for authentication to Kibana
    BearerToken string
    Bearer Token to use for authentication to Kibana
    CaCerts List<string>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    Endpoints List<string>
    Insecure bool
    Disable TLS certificate validation
    Password string
    Password to use for API authentication to Kibana.
    Username string
    Username to use for API authentication to Kibana.
    ApiKey string
    API Key to use for authentication to Kibana
    BearerToken string
    Bearer Token to use for authentication to Kibana
    CaCerts []string
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    Endpoints []string
    Insecure bool
    Disable TLS certificate validation
    Password string
    Password to use for API authentication to Kibana.
    Username string
    Username to use for API authentication to Kibana.
    api_key string
    API Key to use for authentication to Kibana
    bearer_token string
    Bearer Token to use for authentication to Kibana
    ca_certs list(string)
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints list(string)
    insecure bool
    Disable TLS certificate validation
    password string
    Password to use for API authentication to Kibana.
    username string
    Username to use for API authentication to Kibana.
    apiKey String
    API Key to use for authentication to Kibana
    bearerToken String
    Bearer Token to use for authentication to Kibana
    caCerts List<String>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints List<String>
    insecure Boolean
    Disable TLS certificate validation
    password String
    Password to use for API authentication to Kibana.
    username String
    Username to use for API authentication to Kibana.
    apiKey string
    API Key to use for authentication to Kibana
    bearerToken string
    Bearer Token to use for authentication to Kibana
    caCerts string[]
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints string[]
    insecure boolean
    Disable TLS certificate validation
    password string
    Password to use for API authentication to Kibana.
    username string
    Username to use for API authentication to Kibana.
    api_key str
    API Key to use for authentication to Kibana
    bearer_token str
    Bearer Token to use for authentication to Kibana
    ca_certs Sequence[str]
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints Sequence[str]
    insecure bool
    Disable TLS certificate validation
    password str
    Password to use for API authentication to Kibana.
    username str
    Username to use for API authentication to Kibana.
    apiKey String
    API Key to use for authentication to Kibana
    bearerToken String
    Bearer Token to use for authentication to Kibana
    caCerts List<String>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints List<String>
    insecure Boolean
    Disable TLS certificate validation
    password String
    Password to use for API authentication to Kibana.
    username String
    Username to use for API authentication to Kibana.

    Package Details

    Repository
    elasticstack elastic/terraform-provider-elasticstack
    License
    Notes
    This Pulumi package is based on the elasticstack Terraform Provider.
    Viewing docs for elasticstack 0.16.3
    published on Thursday, Jul 23, 2026 by elastic
    Schema (JSON)
    elastic/terraform-provider-elasticstack

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial