Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Elasticstack Provider
  4. API Docs
  5. KibanaOsqueryPack
Viewing docs for elasticstack 0.16.3
published on Thursday, Jul 23, 2026 by elastic
Schema (JSON)
elastic/terraform-provider-elasticstack

elasticstack.KibanaOsqueryPack

Viewing docs for elasticstack 0.16.3
published on Thursday, Jul 23, 2026 by elastic
Schema (JSON)
elastic/terraform-provider-elasticstack

    Manages a user-defined Osquery query pack in Kibana. Requires Kibana 8.5.0 or later. Prebuilt packs shipped with the osquery_manager integration cannot be managed by this resource; use the elasticstack.KibanaOsqueryPack data source to read them instead.

    Example Usage

    Example coming soon!

    Example coming soon!

    Example coming soon!

    Example coming soon!

    Example coming soon!

    resources:
  example:
    type: elasticstack:KibanaOsqueryPack
    properties:
      name: example-osquery-pack
      description: Example Osquery pack managed by Terraform
      enabled: true
      queries:
        find_procs:
          query: SELECT pid, name FROM processes LIMIT 5;
          platform:
            - linux
            - darwin
          version: 1.0.0
          ecsMapping:
            process.name:
              field: name
            process.pid:
              value: '0'
            host.name:
              values:
                - host-a
                - host-b

    Example coming soon!

    Create KibanaOsqueryPack Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KibanaOsqueryPack(name: string, args: KibanaOsqueryPackArgs, opts?: CustomResourceOptions);
    @overload
def KibanaOsqueryPack(resource_name: str,
                      args: KibanaOsqueryPackArgs,
                      opts: Optional[ResourceOptions] = None)

@overload
def KibanaOsqueryPack(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      queries: Optional[Mapping[str, KibanaOsqueryPackQueriesArgs]] = None,
                      description: Optional[str] = None,
                      enabled: Optional[bool] = None,
                      kibana_connections: Optional[Sequence[KibanaOsqueryPackKibanaConnectionArgs]] = None,
                      name: Optional[str] = None,
                      policy_ids: Optional[Sequence[str]] = None,
                      shards: Optional[Mapping[str, float]] = None,
                      space_id: Optional[str] = None,
                      timeouts: Optional[KibanaOsqueryPackTimeoutsArgs] = None)
    func NewKibanaOsqueryPack(ctx *Context, name string, args KibanaOsqueryPackArgs, opts ...ResourceOption) (*KibanaOsqueryPack, error)
    public KibanaOsqueryPack(string name, KibanaOsqueryPackArgs args, CustomResourceOptions? opts = null)
    public KibanaOsqueryPack(String name, KibanaOsqueryPackArgs args)
public KibanaOsqueryPack(String name, KibanaOsqueryPackArgs args, CustomResourceOptions options)

    type: elasticstack:KibanaOsqueryPack
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "elasticstack_kibana_osquery_pack" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KibanaOsqueryPackArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KibanaOsqueryPackArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KibanaOsqueryPackArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KibanaOsqueryPackArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KibanaOsqueryPackArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kibanaOsqueryPackResource = new Elasticstack.KibanaOsqueryPack("kibanaOsqueryPackResource", new()
{
    Queries = 
    {
        { "string", new Elasticstack.Inputs.KibanaOsqueryPackQueriesArgs
        {
            Query = "string",
            EcsMapping = 
            {
                { "string", new Elasticstack.Inputs.KibanaOsqueryPackQueriesEcsMappingArgs
                {
                    Field = "string",
                    Value = "string",
                    Values = new[]
                    {
                        "string",
                    },
                } },
            },
            Platforms = new[]
            {
                "string",
            },
            Removed = false,
            SavedQueryId = "string",
            Snapshot = false,
            Version = "string",
        } },
    },
    Description = "string",
    Enabled = false,
    KibanaConnections = new[]
    {
        new Elasticstack.Inputs.KibanaOsqueryPackKibanaConnectionArgs
        {
            ApiKey = "string",
            BearerToken = "string",
            CaCerts = new[]
            {
                "string",
            },
            Endpoints = new[]
            {
                "string",
            },
            Insecure = false,
            Password = "string",
            Username = "string",
        },
    },
    Name = "string",
    PolicyIds = new[]
    {
        "string",
    },
    Shards = 
    {
        { "string", 0 },
    },
    SpaceId = "string",
    Timeouts = new Elasticstack.Inputs.KibanaOsqueryPackTimeoutsArgs
    {
        Create = "string",
        Delete = "string",
        Read = "string",
        Update = "string",
    },
});

    example, err := elasticstack.NewKibanaOsqueryPack(ctx, "kibanaOsqueryPackResource", &elasticstack.KibanaOsqueryPackArgs{
	Queries: elasticstack.KibanaOsqueryPackQueriesMap{
		"string": &elasticstack.KibanaOsqueryPackQueriesArgs{
			Query: pulumi.String("string"),
			EcsMapping: elasticstack.KibanaOsqueryPackQueriesEcsMappingMap{
				"string": &elasticstack.KibanaOsqueryPackQueriesEcsMappingArgs{
					Field: pulumi.String("string"),
					Value: pulumi.String("string"),
					Values: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
			},
			Platforms: pulumi.StringArray{
				pulumi.String("string"),
			},
			Removed:      pulumi.Bool(false),
			SavedQueryId: pulumi.String("string"),
			Snapshot:     pulumi.Bool(false),
			Version:      pulumi.String("string"),
		},
	},
	Description: pulumi.String("string"),
	Enabled:     pulumi.Bool(false),
	KibanaConnections: elasticstack.KibanaOsqueryPackKibanaConnectionArray{
		&elasticstack.KibanaOsqueryPackKibanaConnectionArgs{
			ApiKey:      pulumi.String("string"),
			BearerToken: pulumi.String("string"),
			CaCerts: pulumi.StringArray{
				pulumi.String("string"),
			},
			Endpoints: pulumi.StringArray{
				pulumi.String("string"),
			},
			Insecure: pulumi.Bool(false),
			Password: pulumi.String("string"),
			Username: pulumi.String("string"),
		},
	},
	Name: pulumi.String("string"),
	PolicyIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	Shards: pulumi.Float64Map{
		"string": pulumi.Float64(0),
	},
	SpaceId: pulumi.String("string"),
	Timeouts: &elasticstack.KibanaOsqueryPackTimeoutsArgs{
		Create: pulumi.String("string"),
		Delete: pulumi.String("string"),
		Read:   pulumi.String("string"),
		Update: pulumi.String("string"),
	},
})

    resource "elasticstack_kibana_osquery_pack" "kibanaOsqueryPackResource" {
  lifecycle {
    create_before_destroy = true
  }
  queries = {
    "string" = {
      query = "string"
      ecs_mapping = {
        "string" = {
          field  = "string"
          value  = "string"
          values = ["string"]
        }
      }
      platforms      = ["string"]
      removed        = false
      saved_query_id = "string"
      snapshot       = false
      version        = "string"
    }
  }
  description = "string"
  enabled     = false
  kibana_connections {
    api_key      = "string"
    bearer_token = "string"
    ca_certs     = ["string"]
    endpoints    = ["string"]
    insecure     = false
    password     = "string"
    username     = "string"
  }
  name       = "string"
  policy_ids = ["string"]
  shards = {
    "string" = 0
  }
  space_id = "string"
  timeouts = {
    create = "string"
    delete = "string"
    read   = "string"
    update = "string"
  }
}

    var kibanaOsqueryPackResource = new KibanaOsqueryPack("kibanaOsqueryPackResource", KibanaOsqueryPackArgs.builder()
    .queries(Map.of("string", KibanaOsqueryPackQueriesArgs.builder()
        .query("string")
        .ecsMapping(Map.of("string", KibanaOsqueryPackQueriesEcsMappingArgs.builder()
            .field("string")
            .value("string")
            .values("string")
            .build()))
        .platforms("string")
        .removed(false)
        .savedQueryId("string")
        .snapshot(false)
        .version("string")
        .build()))
    .description("string")
    .enabled(false)
    .kibanaConnections(KibanaOsqueryPackKibanaConnectionArgs.builder()
        .apiKey("string")
        .bearerToken("string")
        .caCerts("string")
        .endpoints("string")
        .insecure(false)
        .password("string")
        .username("string")
        .build())
    .name("string")
    .policyIds("string")
    .shards(Map.of("string", 0.0))
    .spaceId("string")
    .timeouts(KibanaOsqueryPackTimeoutsArgs.builder()
        .create("string")
        .delete("string")
        .read("string")
        .update("string")
        .build())
    .build());

    kibana_osquery_pack_resource = elasticstack.KibanaOsqueryPack("kibanaOsqueryPackResource",
    queries={
        "string": {
            "query": "string",
            "ecs_mapping": {
                "string": {
                    "field": "string",
                    "value": "string",
                    "values": ["string"],
                },
            },
            "platforms": ["string"],
            "removed": False,
            "saved_query_id": "string",
            "snapshot": False,
            "version": "string",
        },
    },
    description="string",
    enabled=False,
    kibana_connections=[{
        "api_key": "string",
        "bearer_token": "string",
        "ca_certs": ["string"],
        "endpoints": ["string"],
        "insecure": False,
        "password": "string",
        "username": "string",
    }],
    name="string",
    policy_ids=["string"],
    shards={
        "string": float(0),
    },
    space_id="string",
    timeouts={
        "create": "string",
        "delete": "string",
        "read": "string",
        "update": "string",
    })

    const kibanaOsqueryPackResource = new elasticstack.KibanaOsqueryPack("kibanaOsqueryPackResource", {
    queries: {
        string: {
            query: "string",
            ecsMapping: {
                string: {
                    field: "string",
                    value: "string",
                    values: ["string"],
                },
            },
            platforms: ["string"],
            removed: false,
            savedQueryId: "string",
            snapshot: false,
            version: "string",
        },
    },
    description: "string",
    enabled: false,
    kibanaConnections: [{
        apiKey: "string",
        bearerToken: "string",
        caCerts: ["string"],
        endpoints: ["string"],
        insecure: false,
        password: "string",
        username: "string",
    }],
    name: "string",
    policyIds: ["string"],
    shards: {
        string: 0,
    },
    spaceId: "string",
    timeouts: {
        create: "string",
        "delete": "string",
        read: "string",
        update: "string",
    },
});

    type: elasticstack:KibanaOsqueryPack
properties:
    description: string
    enabled: false
    kibanaConnections:
        - apiKey: string
          bearerToken: string
          caCerts:
            - string
          endpoints:
            - string
          insecure: false
          password: string
          username: string
    name: string
    policyIds:
        - string
    queries:
        string:
            ecsMapping:
                string:
                    field: string
                    value: string
                    values:
                        - string
            platforms:
                - string
            query: string
            removed: false
            savedQueryId: string
            snapshot: false
            version: string
    shards:
        string: 0
    spaceId: string
    timeouts:
        create: string
        delete: string
        read: string
        update: string

    KibanaOsqueryPack Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KibanaOsqueryPack resource accepts the following input properties:

    Queries Dictionary<string, KibanaOsqueryPackQueriesArgs>
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    Description string
    Description of the Osquery pack.
    Enabled bool
    Whether the pack is enabled.
    KibanaConnections List<KibanaOsqueryPackKibanaConnection>
    Kibana connection configuration block.
    Name string
    Human-readable name of the Osquery pack.
    PolicyIds List<string>
    Fleet agent policy IDs this pack is deployed to.
    Shards Dictionary<string, double>
    Percent (1-100) of hosts per policy ID that receive the pack.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Timeouts KibanaOsqueryPackTimeouts
    Queries map[string]KibanaOsqueryPackQueriesArgs
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    Description string
    Description of the Osquery pack.
    Enabled bool
    Whether the pack is enabled.
    KibanaConnections []KibanaOsqueryPackKibanaConnectionArgs
    Kibana connection configuration block.
    Name string
    Human-readable name of the Osquery pack.
    PolicyIds []string
    Fleet agent policy IDs this pack is deployed to.
    Shards map[string]float64
    Percent (1-100) of hosts per policy ID that receive the pack.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Timeouts KibanaOsqueryPackTimeoutsArgs
    queries map(object)
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    description string
    Description of the Osquery pack.
    enabled bool
    Whether the pack is enabled.
    kibana_connections list(object)
    Kibana connection configuration block.
    name string
    Human-readable name of the Osquery pack.
    policy_ids list(string)
    Fleet agent policy IDs this pack is deployed to.
    shards map(number)
    Percent (1-100) of hosts per policy ID that receive the pack.
    space_id string
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts object
    queries Map<String,KibanaOsqueryPackQueriesArgs>
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    description String
    Description of the Osquery pack.
    enabled Boolean
    Whether the pack is enabled.
    kibanaConnections List<KibanaOsqueryPackKibanaConnection>
    Kibana connection configuration block.
    name String
    Human-readable name of the Osquery pack.
    policyIds List<String>
    Fleet agent policy IDs this pack is deployed to.
    shards Map<String,Double>
    Percent (1-100) of hosts per policy ID that receive the pack.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsqueryPackTimeouts
    queries {[key: string]: KibanaOsqueryPackQueriesArgs}
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    description string
    Description of the Osquery pack.
    enabled boolean
    Whether the pack is enabled.
    kibanaConnections KibanaOsqueryPackKibanaConnection[]
    Kibana connection configuration block.
    name string
    Human-readable name of the Osquery pack.
    policyIds string[]
    Fleet agent policy IDs this pack is deployed to.
    shards {[key: string]: number}
    Percent (1-100) of hosts per policy ID that receive the pack.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsqueryPackTimeouts
    queries Mapping[str, KibanaOsqueryPackQueriesArgs]
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    description str
    Description of the Osquery pack.
    enabled bool
    Whether the pack is enabled.
    kibana_connections Sequence[KibanaOsqueryPackKibanaConnectionArgs]
    Kibana connection configuration block.
    name str
    Human-readable name of the Osquery pack.
    policy_ids Sequence[str]
    Fleet agent policy IDs this pack is deployed to.
    shards Mapping[str, float]
    Percent (1-100) of hosts per policy ID that receive the pack.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsqueryPackTimeoutsArgs
    queries Map<Property Map>
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    description String
    Description of the Osquery pack.
    enabled Boolean
    Whether the pack is enabled.
    kibanaConnections List<Property Map>
    Kibana connection configuration block.
    name String
    Human-readable name of the Osquery pack.
    policyIds List<String>
    Fleet agent policy IDs this pack is deployed to.
    shards Map<Number>
    Percent (1-100) of hosts per policy ID that receive the pack.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts Property Map

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KibanaOsqueryPack resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    PackId string
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    Id string
    The provider-assigned unique ID for this managed resource.
    PackId string
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    id string
    The provider-assigned unique ID for this managed resource.
    pack_id string
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    id String
    The provider-assigned unique ID for this managed resource.
    packId String
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    id string
    The provider-assigned unique ID for this managed resource.
    packId string
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    id str
    The provider-assigned unique ID for this managed resource.
    pack_id str
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    id String
    The provider-assigned unique ID for this managed resource.
    packId String
    Server-generated Kibana saved object identifier for the pack (saved_object_id).

    Look up Existing KibanaOsqueryPack Resource

    Get an existing KibanaOsqueryPack resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KibanaOsqueryPackState, opts?: CustomResourceOptions): KibanaOsqueryPack
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        description: Optional[str] = None,
        enabled: Optional[bool] = None,
        kibana_connections: Optional[Sequence[KibanaOsqueryPackKibanaConnectionArgs]] = None,
        name: Optional[str] = None,
        pack_id: Optional[str] = None,
        policy_ids: Optional[Sequence[str]] = None,
        queries: Optional[Mapping[str, KibanaOsqueryPackQueriesArgs]] = None,
        shards: Optional[Mapping[str, float]] = None,
        space_id: Optional[str] = None,
        timeouts: Optional[KibanaOsqueryPackTimeoutsArgs] = None) -> KibanaOsqueryPack
    func GetKibanaOsqueryPack(ctx *Context, name string, id IDInput, state *KibanaOsqueryPackState, opts ...ResourceOption) (*KibanaOsqueryPack, error)
    public static KibanaOsqueryPack Get(string name, Input<string> id, KibanaOsqueryPackState? state, CustomResourceOptions? opts = null)
    public static KibanaOsqueryPack get(String name, Output<String> id, KibanaOsqueryPackState state, CustomResourceOptions options)
    resources:  _:    type: elasticstack:KibanaOsqueryPack    get:      id: ${id}
    import {
  to = elasticstack_kibana_osquery_pack.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Description string
    Description of the Osquery pack.
    Enabled bool
    Whether the pack is enabled.
    KibanaConnections List<KibanaOsqueryPackKibanaConnection>
    Kibana connection configuration block.
    Name string
    Human-readable name of the Osquery pack.
    PackId string
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    PolicyIds List<string>
    Fleet agent policy IDs this pack is deployed to.
    Queries Dictionary<string, KibanaOsqueryPackQueriesArgs>
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    Shards Dictionary<string, double>
    Percent (1-100) of hosts per policy ID that receive the pack.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Timeouts KibanaOsqueryPackTimeouts
    Description string
    Description of the Osquery pack.
    Enabled bool
    Whether the pack is enabled.
    KibanaConnections []KibanaOsqueryPackKibanaConnectionArgs
    Kibana connection configuration block.
    Name string
    Human-readable name of the Osquery pack.
    PackId string
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    PolicyIds []string
    Fleet agent policy IDs this pack is deployed to.
    Queries map[string]KibanaOsqueryPackQueriesArgs
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    Shards map[string]float64
    Percent (1-100) of hosts per policy ID that receive the pack.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Timeouts KibanaOsqueryPackTimeoutsArgs
    description string
    Description of the Osquery pack.
    enabled bool
    Whether the pack is enabled.
    kibana_connections list(object)
    Kibana connection configuration block.
    name string
    Human-readable name of the Osquery pack.
    pack_id string
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    policy_ids list(string)
    Fleet agent policy IDs this pack is deployed to.
    queries map(object)
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    shards map(number)
    Percent (1-100) of hosts per policy ID that receive the pack.
    space_id string
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts object
    description String
    Description of the Osquery pack.
    enabled Boolean
    Whether the pack is enabled.
    kibanaConnections List<KibanaOsqueryPackKibanaConnection>
    Kibana connection configuration block.
    name String
    Human-readable name of the Osquery pack.
    packId String
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    policyIds List<String>
    Fleet agent policy IDs this pack is deployed to.
    queries Map<String,KibanaOsqueryPackQueriesArgs>
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    shards Map<String,Double>
    Percent (1-100) of hosts per policy ID that receive the pack.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsqueryPackTimeouts
    description string
    Description of the Osquery pack.
    enabled boolean
    Whether the pack is enabled.
    kibanaConnections KibanaOsqueryPackKibanaConnection[]
    Kibana connection configuration block.
    name string
    Human-readable name of the Osquery pack.
    packId string
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    policyIds string[]
    Fleet agent policy IDs this pack is deployed to.
    queries {[key: string]: KibanaOsqueryPackQueriesArgs}
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    shards {[key: string]: number}
    Percent (1-100) of hosts per policy ID that receive the pack.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsqueryPackTimeouts
    description str
    Description of the Osquery pack.
    enabled bool
    Whether the pack is enabled.
    kibana_connections Sequence[KibanaOsqueryPackKibanaConnectionArgs]
    Kibana connection configuration block.
    name str
    Human-readable name of the Osquery pack.
    pack_id str
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    policy_ids Sequence[str]
    Fleet agent policy IDs this pack is deployed to.
    queries Mapping[str, KibanaOsqueryPackQueriesArgs]
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    shards Mapping[str, float]
    Percent (1-100) of hosts per policy ID that receive the pack.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsqueryPackTimeoutsArgs
    description String
    Description of the Osquery pack.
    enabled Boolean
    Whether the pack is enabled.
    kibanaConnections List<Property Map>
    Kibana connection configuration block.
    name String
    Human-readable name of the Osquery pack.
    packId String
    Server-generated Kibana saved object identifier for the pack (saved_object_id).
    policyIds List<String>
    Fleet agent policy IDs this pack is deployed to.
    queries Map<Property Map>
    Osquery queries in the pack. Map keys are query names (canonical identifiers in Kibana).
    shards Map<Number>
    Percent (1-100) of hosts per policy ID that receive the pack.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts Property Map

    Supporting Types

    KibanaOsqueryPackKibanaConnection, KibanaOsqueryPackKibanaConnectionArgs

    ApiKey string
    API Key to use for authentication to Kibana
    BearerToken string
    Bearer Token to use for authentication to Kibana
    CaCerts List<string>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    Endpoints List<string>
    Insecure bool
    Disable TLS certificate validation
    Password string
    Password to use for API authentication to Kibana.
    Username string
    Username to use for API authentication to Kibana.
    ApiKey string
    API Key to use for authentication to Kibana
    BearerToken string
    Bearer Token to use for authentication to Kibana
    CaCerts []string
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    Endpoints []string
    Insecure bool
    Disable TLS certificate validation
    Password string
    Password to use for API authentication to Kibana.
    Username string
    Username to use for API authentication to Kibana.
    api_key string
    API Key to use for authentication to Kibana
    bearer_token string
    Bearer Token to use for authentication to Kibana
    ca_certs list(string)
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints list(string)
    insecure bool
    Disable TLS certificate validation
    password string
    Password to use for API authentication to Kibana.
    username string
    Username to use for API authentication to Kibana.
    apiKey String
    API Key to use for authentication to Kibana
    bearerToken String
    Bearer Token to use for authentication to Kibana
    caCerts List<String>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints List<String>
    insecure Boolean
    Disable TLS certificate validation
    password String
    Password to use for API authentication to Kibana.
    username String
    Username to use for API authentication to Kibana.
    apiKey string
    API Key to use for authentication to Kibana
    bearerToken string
    Bearer Token to use for authentication to Kibana
    caCerts string[]
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints string[]
    insecure boolean
    Disable TLS certificate validation
    password string
    Password to use for API authentication to Kibana.
    username string
    Username to use for API authentication to Kibana.
    api_key str
    API Key to use for authentication to Kibana
    bearer_token str
    Bearer Token to use for authentication to Kibana
    ca_certs Sequence[str]
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints Sequence[str]
    insecure bool
    Disable TLS certificate validation
    password str
    Password to use for API authentication to Kibana.
    username str
    Username to use for API authentication to Kibana.
    apiKey String
    API Key to use for authentication to Kibana
    bearerToken String
    Bearer Token to use for authentication to Kibana
    caCerts List<String>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints List<String>
    insecure Boolean
    Disable TLS certificate validation
    password String
    Password to use for API authentication to Kibana.
    username String
    Username to use for API authentication to Kibana.

    KibanaOsqueryPackQueries, KibanaOsqueryPackQueriesArgs

    Query string
    Osquery SQL query text.
    EcsMapping Dictionary<string, KibanaOsqueryPackQueriesEcsMapping>
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    Platforms List<string>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    Removed bool
    Whether the query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    SavedQueryId string
    References an elasticstack.KibanaOsquerySavedQuery resource.
    Snapshot bool
    Whether the query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    Version string
    Query version string.
    Query string
    Osquery SQL query text.
    EcsMapping map[string]KibanaOsqueryPackQueriesEcsMapping
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    Platforms []string
    Target platforms for the query. Allowed values: linux, darwin, windows.
    Removed bool
    Whether the query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    SavedQueryId string
    References an elasticstack.KibanaOsquerySavedQuery resource.
    Snapshot bool
    Whether the query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    Version string
    Query version string.
    query string
    Osquery SQL query text.
    ecs_mapping map(object)
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    platforms list(string)
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed bool
    Whether the query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    saved_query_id string
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot bool
    Whether the query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    version string
    Query version string.
    query String
    Osquery SQL query text.
    ecsMapping Map<String,KibanaOsqueryPackQueriesEcsMapping>
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    platforms List<String>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed Boolean
    Whether the query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    savedQueryId String
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot Boolean
    Whether the query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    version String
    Query version string.
    query string
    Osquery SQL query text.
    ecsMapping {[key: string]: KibanaOsqueryPackQueriesEcsMapping}
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    platforms string[]
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed boolean
    Whether the query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    savedQueryId string
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot boolean
    Whether the query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    version string
    Query version string.
    query str
    Osquery SQL query text.
    ecs_mapping Mapping[str, KibanaOsqueryPackQueriesEcsMapping]
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    platforms Sequence[str]
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed bool
    Whether the query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    saved_query_id str
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot bool
    Whether the query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    version str
    Query version string.
    query String
    Osquery SQL query text.
    ecsMapping Map<Property Map>
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    platforms List<String>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed Boolean
    Whether the query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    savedQueryId String
    References an elasticstack.KibanaOsquerySavedQuery resource.
    snapshot Boolean
    Whether the query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    version String
    Query version string.

    KibanaOsqueryPackQueriesEcsMapping, KibanaOsqueryPackQueriesEcsMappingArgs

    Field string
    Query result column name to map from.
    Value string
    Static scalar ECS mapping value.
    Values List<string>
    Static array ECS mapping values.
    Field string
    Query result column name to map from.
    Value string
    Static scalar ECS mapping value.
    Values []string
    Static array ECS mapping values.
    field string
    Query result column name to map from.
    value string
    Static scalar ECS mapping value.
    values list(string)
    Static array ECS mapping values.
    field String
    Query result column name to map from.
    value String
    Static scalar ECS mapping value.
    values List<String>
    Static array ECS mapping values.
    field string
    Query result column name to map from.
    value string
    Static scalar ECS mapping value.
    values string[]
    Static array ECS mapping values.
    field str
    Query result column name to map from.
    value str
    Static scalar ECS mapping value.
    values Sequence[str]
    Static array ECS mapping values.
    field String
    Query result column name to map from.
    value String
    Static scalar ECS mapping value.
    values List<String>
    Static array ECS mapping values.

    KibanaOsqueryPackTimeouts, KibanaOsqueryPackTimeoutsArgs

    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    Read string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    Read string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

    Import

    The pulumi import command can be used, for example:

    Import user-managed Osquery packs only. Prebuilt/read-only packs cannot be imported

    into the resource; read them with the elasticstack_kibana_osquery_pack data source.

    pack_id is the Kibana saved_object_id (UUID) for the pack.

    $ pulumi import elasticstack:index/kibanaOsqueryPack:KibanaOsqueryPack example <space_id>/<pack_id>

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    elasticstack elastic/terraform-provider-elasticstack
    License
    Notes
    This Pulumi package is based on the elasticstack Terraform Provider.
    Viewing docs for elasticstack 0.16.3
    published on Thursday, Jul 23, 2026 by elastic
    Schema (JSON)
    elastic/terraform-provider-elasticstack

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial