published on Thursday, Jul 23, 2026 by elastic
published on Thursday, Jul 23, 2026 by elastic
Manages a user-defined Osquery saved query in Kibana. Requires Kibana 8.5.0 or later. Prebuilt queries shipped with the osquery_manager integration cannot be managed by this resource; use the elasticstack.KibanaOsquerySavedQuery data source to read them instead. Import of prebuilt queries fails; use the data source for prebuilt queries.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as elasticstack from "@pulumi/elasticstack";
const listProcesses = new elasticstack.KibanaOsquerySavedQuery("list_processes", {
savedQueryId: "list_processes",
query: "SELECT pid, name, cmdline FROM processes LIMIT 100;",
description: "List running processes with command lines",
platforms: [
"linux",
"darwin",
],
interval: 3600,
version: "1.0.0",
ecsMapping: {
"process.name": {
field: "name",
},
"process.command_line": {
field: "cmdline",
},
"event.category": {
value: "process",
},
"event.type": {
values: [
"start",
"end",
],
},
},
});
import pulumi
import pulumi_elasticstack as elasticstack
list_processes = elasticstack.KibanaOsquerySavedQuery("list_processes",
saved_query_id="list_processes",
query="SELECT pid, name, cmdline FROM processes LIMIT 100;",
description="List running processes with command lines",
platforms=[
"linux",
"darwin",
],
interval=3600,
version="1.0.0",
ecs_mapping={
"process.name": {
"field": "name",
},
"process.command_line": {
"field": "cmdline",
},
"event.category": {
"value": "process",
},
"event.type": {
"values": [
"start",
"end",
],
},
})
package main
import (
"github.com/pulumi/pulumi-terraform-provider/sdks/go/elasticstack/elasticstack"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := elasticstack.NewKibanaOsquerySavedQuery(ctx, "list_processes", &elasticstack.KibanaOsquerySavedQueryArgs{
SavedQueryId: pulumi.String("list_processes"),
Query: pulumi.String("SELECT pid, name, cmdline FROM processes LIMIT 100;"),
Description: pulumi.String("List running processes with command lines"),
Platforms: pulumi.StringArray{
pulumi.String("linux"),
pulumi.String("darwin"),
},
Interval: pulumi.Float64(3600),
Version: pulumi.String("1.0.0"),
EcsMapping: elasticstack.KibanaOsquerySavedQueryEcsMappingMap{
"process.name": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
Field: pulumi.String("name"),
},
"process.command_line": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
Field: pulumi.String("cmdline"),
},
"event.category": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
Value: pulumi.String("process"),
},
"event.type": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
Values: pulumi.StringArray{
pulumi.String("start"),
pulumi.String("end"),
},
},
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Elasticstack = Pulumi.Elasticstack;
return await Deployment.RunAsync(() =>
{
var listProcesses = new Elasticstack.KibanaOsquerySavedQuery("list_processes", new()
{
SavedQueryId = "list_processes",
Query = "SELECT pid, name, cmdline FROM processes LIMIT 100;",
Description = "List running processes with command lines",
Platforms = new[]
{
"linux",
"darwin",
},
Interval = 3600,
Version = "1.0.0",
EcsMapping =
{
{ "process.name", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
{
Field = "name",
} },
{ "process.command_line", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
{
Field = "cmdline",
} },
{ "event.category", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
{
Value = "process",
} },
{ "event.type", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
{
Values = new[]
{
"start",
"end",
},
} },
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.elasticstack.KibanaOsquerySavedQuery;
import com.pulumi.elasticstack.KibanaOsquerySavedQueryArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var listProcesses = new KibanaOsquerySavedQuery("listProcesses", KibanaOsquerySavedQueryArgs.builder()
.savedQueryId("list_processes")
.query("SELECT pid, name, cmdline FROM processes LIMIT 100;")
.description("List running processes with command lines")
.platforms(
"linux",
"darwin")
.interval(3600.0)
.version("1.0.0")
.ecsMapping(Map.ofEntries(
Map.entry("process.name", KibanaOsquerySavedQueryEcsMappingArgs.builder()
.field("name")
.build()),
Map.entry("process.command_line", KibanaOsquerySavedQueryEcsMappingArgs.builder()
.field("cmdline")
.build()),
Map.entry("event.category", KibanaOsquerySavedQueryEcsMappingArgs.builder()
.value("process")
.build()),
Map.entry("event.type", KibanaOsquerySavedQueryEcsMappingArgs.builder()
.values(
"start",
"end")
.build())
))
.build());
}
}
resources:
listProcesses:
type: elasticstack:KibanaOsquerySavedQuery
name: list_processes
properties:
savedQueryId: list_processes
query: SELECT pid, name, cmdline FROM processes LIMIT 100;
description: List running processes with command lines
platforms:
- linux
- darwin
interval: 3600
version: 1.0.0
ecsMapping:
process.name:
field: name
process.command_line:
field: cmdline
event.category:
value: process
event.type:
values:
- start
- end
Example coming soon!
Create KibanaOsquerySavedQuery Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new KibanaOsquerySavedQuery(name: string, args: KibanaOsquerySavedQueryArgs, opts?: CustomResourceOptions);@overload
def KibanaOsquerySavedQuery(resource_name: str,
args: KibanaOsquerySavedQueryArgs,
opts: Optional[ResourceOptions] = None)
@overload
def KibanaOsquerySavedQuery(resource_name: str,
opts: Optional[ResourceOptions] = None,
interval: Optional[float] = None,
query: Optional[str] = None,
saved_query_id: Optional[str] = None,
description: Optional[str] = None,
ecs_mapping: Optional[Mapping[str, KibanaOsquerySavedQueryEcsMappingArgs]] = None,
kibana_connections: Optional[Sequence[KibanaOsquerySavedQueryKibanaConnectionArgs]] = None,
platforms: Optional[Sequence[str]] = None,
removed: Optional[bool] = None,
snapshot: Optional[bool] = None,
space_id: Optional[str] = None,
timeouts: Optional[KibanaOsquerySavedQueryTimeoutsArgs] = None,
version: Optional[str] = None)func NewKibanaOsquerySavedQuery(ctx *Context, name string, args KibanaOsquerySavedQueryArgs, opts ...ResourceOption) (*KibanaOsquerySavedQuery, error)public KibanaOsquerySavedQuery(string name, KibanaOsquerySavedQueryArgs args, CustomResourceOptions? opts = null)
public KibanaOsquerySavedQuery(String name, KibanaOsquerySavedQueryArgs args)
public KibanaOsquerySavedQuery(String name, KibanaOsquerySavedQueryArgs args, CustomResourceOptions options)
type: elasticstack:KibanaOsquerySavedQuery
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "elasticstack_kibana_osquery_saved_query" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args KibanaOsquerySavedQueryArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args KibanaOsquerySavedQueryArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args KibanaOsquerySavedQueryArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args KibanaOsquerySavedQueryArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args KibanaOsquerySavedQueryArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var kibanaOsquerySavedQueryResource = new Elasticstack.KibanaOsquerySavedQuery("kibanaOsquerySavedQueryResource", new()
{
Interval = 0,
Query = "string",
SavedQueryId = "string",
Description = "string",
EcsMapping =
{
{ "string", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
{
Field = "string",
Value = "string",
Values = new[]
{
"string",
},
} },
},
KibanaConnections = new[]
{
new Elasticstack.Inputs.KibanaOsquerySavedQueryKibanaConnectionArgs
{
ApiKey = "string",
BearerToken = "string",
CaCerts = new[]
{
"string",
},
Endpoints = new[]
{
"string",
},
Insecure = false,
Password = "string",
Username = "string",
},
},
Platforms = new[]
{
"string",
},
Removed = false,
Snapshot = false,
SpaceId = "string",
Timeouts = new Elasticstack.Inputs.KibanaOsquerySavedQueryTimeoutsArgs
{
Create = "string",
Delete = "string",
Read = "string",
Update = "string",
},
Version = "string",
});
example, err := elasticstack.NewKibanaOsquerySavedQuery(ctx, "kibanaOsquerySavedQueryResource", &elasticstack.KibanaOsquerySavedQueryArgs{
Interval: pulumi.Float64(0),
Query: pulumi.String("string"),
SavedQueryId: pulumi.String("string"),
Description: pulumi.String("string"),
EcsMapping: elasticstack.KibanaOsquerySavedQueryEcsMappingMap{
"string": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
Field: pulumi.String("string"),
Value: pulumi.String("string"),
Values: pulumi.StringArray{
pulumi.String("string"),
},
},
},
KibanaConnections: elasticstack.KibanaOsquerySavedQueryKibanaConnectionArray{
&elasticstack.KibanaOsquerySavedQueryKibanaConnectionArgs{
ApiKey: pulumi.String("string"),
BearerToken: pulumi.String("string"),
CaCerts: pulumi.StringArray{
pulumi.String("string"),
},
Endpoints: pulumi.StringArray{
pulumi.String("string"),
},
Insecure: pulumi.Bool(false),
Password: pulumi.String("string"),
Username: pulumi.String("string"),
},
},
Platforms: pulumi.StringArray{
pulumi.String("string"),
},
Removed: pulumi.Bool(false),
Snapshot: pulumi.Bool(false),
SpaceId: pulumi.String("string"),
Timeouts: &elasticstack.KibanaOsquerySavedQueryTimeoutsArgs{
Create: pulumi.String("string"),
Delete: pulumi.String("string"),
Read: pulumi.String("string"),
Update: pulumi.String("string"),
},
Version: pulumi.String("string"),
})
resource "elasticstack_kibana_osquery_saved_query" "kibanaOsquerySavedQueryResource" {
lifecycle {
create_before_destroy = true
}
interval = 0
query = "string"
saved_query_id = "string"
description = "string"
ecs_mapping = {
"string" = {
field = "string"
value = "string"
values = ["string"]
}
}
kibana_connections {
api_key = "string"
bearer_token = "string"
ca_certs = ["string"]
endpoints = ["string"]
insecure = false
password = "string"
username = "string"
}
platforms = ["string"]
removed = false
snapshot = false
space_id = "string"
timeouts = {
create = "string"
delete = "string"
read = "string"
update = "string"
}
version = "string"
}
var kibanaOsquerySavedQueryResource = new KibanaOsquerySavedQuery("kibanaOsquerySavedQueryResource", KibanaOsquerySavedQueryArgs.builder()
.interval(0.0)
.query("string")
.savedQueryId("string")
.description("string")
.ecsMapping(Map.of("string", KibanaOsquerySavedQueryEcsMappingArgs.builder()
.field("string")
.value("string")
.values("string")
.build()))
.kibanaConnections(KibanaOsquerySavedQueryKibanaConnectionArgs.builder()
.apiKey("string")
.bearerToken("string")
.caCerts("string")
.endpoints("string")
.insecure(false)
.password("string")
.username("string")
.build())
.platforms("string")
.removed(false)
.snapshot(false)
.spaceId("string")
.timeouts(KibanaOsquerySavedQueryTimeoutsArgs.builder()
.create("string")
.delete("string")
.read("string")
.update("string")
.build())
.version("string")
.build());
kibana_osquery_saved_query_resource = elasticstack.KibanaOsquerySavedQuery("kibanaOsquerySavedQueryResource",
interval=float(0),
query="string",
saved_query_id="string",
description="string",
ecs_mapping={
"string": {
"field": "string",
"value": "string",
"values": ["string"],
},
},
kibana_connections=[{
"api_key": "string",
"bearer_token": "string",
"ca_certs": ["string"],
"endpoints": ["string"],
"insecure": False,
"password": "string",
"username": "string",
}],
platforms=["string"],
removed=False,
snapshot=False,
space_id="string",
timeouts={
"create": "string",
"delete": "string",
"read": "string",
"update": "string",
},
version="string")
const kibanaOsquerySavedQueryResource = new elasticstack.KibanaOsquerySavedQuery("kibanaOsquerySavedQueryResource", {
interval: 0,
query: "string",
savedQueryId: "string",
description: "string",
ecsMapping: {
string: {
field: "string",
value: "string",
values: ["string"],
},
},
kibanaConnections: [{
apiKey: "string",
bearerToken: "string",
caCerts: ["string"],
endpoints: ["string"],
insecure: false,
password: "string",
username: "string",
}],
platforms: ["string"],
removed: false,
snapshot: false,
spaceId: "string",
timeouts: {
create: "string",
"delete": "string",
read: "string",
update: "string",
},
version: "string",
});
type: elasticstack:KibanaOsquerySavedQuery
properties:
description: string
ecsMapping:
string:
field: string
value: string
values:
- string
interval: 0
kibanaConnections:
- apiKey: string
bearerToken: string
caCerts:
- string
endpoints:
- string
insecure: false
password: string
username: string
platforms:
- string
query: string
removed: false
savedQueryId: string
snapshot: false
spaceId: string
timeouts:
create: string
delete: string
read: string
update: string
version: string
KibanaOsquerySavedQuery Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The KibanaOsquerySavedQuery resource accepts the following input properties:
- Interval double
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- Query string
- Osquery SQL query text.
- Saved
Query stringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- Description string
- Human-readable description of the saved query.
- Ecs
Mapping Dictionary<string, KibanaOsquery Saved Query Ecs Mapping Args> - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - Kibana
Connections List<KibanaOsquery Saved Query Kibana Connection> - Kibana connection configuration block.
- Platforms List<string>
- Target platforms for the query. Allowed values:
linux,darwin,windows. - Removed bool
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - Snapshot bool
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - Space
Id string - An identifier for the space. If space_id is not provided, the default space is used.
- Timeouts
Kibana
Osquery Saved Query Timeouts - Version string
- Saved query version string.
- Interval float64
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- Query string
- Osquery SQL query text.
- Saved
Query stringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- Description string
- Human-readable description of the saved query.
- Ecs
Mapping map[string]KibanaOsquery Saved Query Ecs Mapping Args - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - Kibana
Connections []KibanaOsquery Saved Query Kibana Connection Args - Kibana connection configuration block.
- Platforms []string
- Target platforms for the query. Allowed values:
linux,darwin,windows. - Removed bool
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - Snapshot bool
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - Space
Id string - An identifier for the space. If space_id is not provided, the default space is used.
- Timeouts
Kibana
Osquery Saved Query Timeouts Args - Version string
- Saved query version string.
- interval number
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- query string
- Osquery SQL query text.
- saved_
query_ stringid - Stable user-facing identifier for the saved query. Forces replacement when changed.
- description string
- Human-readable description of the saved query.
- ecs_
mapping map(object) - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - kibana_
connections list(object) - Kibana connection configuration block.
- platforms list(string)
- Target platforms for the query. Allowed values:
linux,darwin,windows. - removed bool
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - snapshot bool
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space_
id string - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts object
- version string
- Saved query version string.
- interval Double
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- query String
- Osquery SQL query text.
- saved
Query StringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- description String
- Human-readable description of the saved query.
- ecs
Mapping Map<String,KibanaOsquery Saved Query Ecs Mapping Args> - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - kibana
Connections List<KibanaOsquery Saved Query Kibana Connection> - Kibana connection configuration block.
- platforms List<String>
- Target platforms for the query. Allowed values:
linux,darwin,windows. - removed Boolean
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - snapshot Boolean
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space
Id String - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts
Kibana
Osquery Saved Query Timeouts - version String
- Saved query version string.
- interval number
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- query string
- Osquery SQL query text.
- saved
Query stringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- description string
- Human-readable description of the saved query.
- ecs
Mapping {[key: string]: KibanaOsquery Saved Query Ecs Mapping Args} - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - kibana
Connections KibanaOsquery Saved Query Kibana Connection[] - Kibana connection configuration block.
- platforms string[]
- Target platforms for the query. Allowed values:
linux,darwin,windows. - removed boolean
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - snapshot boolean
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space
Id string - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts
Kibana
Osquery Saved Query Timeouts - version string
- Saved query version string.
- interval float
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- query str
- Osquery SQL query text.
- saved_
query_ strid - Stable user-facing identifier for the saved query. Forces replacement when changed.
- description str
- Human-readable description of the saved query.
- ecs_
mapping Mapping[str, KibanaOsquery Saved Query Ecs Mapping Args] - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - kibana_
connections Sequence[KibanaOsquery Saved Query Kibana Connection Args] - Kibana connection configuration block.
- platforms Sequence[str]
- Target platforms for the query. Allowed values:
linux,darwin,windows. - removed bool
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - snapshot bool
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space_
id str - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts
Kibana
Osquery Saved Query Timeouts Args - version str
- Saved query version string.
- interval Number
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- query String
- Osquery SQL query text.
- saved
Query StringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- description String
- Human-readable description of the saved query.
- ecs
Mapping Map<Property Map> - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - kibana
Connections List<Property Map> - Kibana connection configuration block.
- platforms List<String>
- Target platforms for the query. Allowed values:
linux,darwin,windows. - removed Boolean
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - snapshot Boolean
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space
Id String - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts Property Map
- version String
- Saved query version string.
Outputs
All input properties are implicitly available as output properties. Additionally, the KibanaOsquerySavedQuery resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Saved
Object stringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- Id string
- The provider-assigned unique ID for this managed resource.
- Saved
Object stringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- id string
- The provider-assigned unique ID for this managed resource.
- saved_
object_ stringid - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- id String
- The provider-assigned unique ID for this managed resource.
- saved
Object StringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- id string
- The provider-assigned unique ID for this managed resource.
- saved
Object stringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- id str
- The provider-assigned unique ID for this managed resource.
- saved_
object_ strid - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- id String
- The provider-assigned unique ID for this managed resource.
- saved
Object StringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
Look up Existing KibanaOsquerySavedQuery Resource
Get an existing KibanaOsquerySavedQuery resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: KibanaOsquerySavedQueryState, opts?: CustomResourceOptions): KibanaOsquerySavedQuery@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
description: Optional[str] = None,
ecs_mapping: Optional[Mapping[str, KibanaOsquerySavedQueryEcsMappingArgs]] = None,
interval: Optional[float] = None,
kibana_connections: Optional[Sequence[KibanaOsquerySavedQueryKibanaConnectionArgs]] = None,
platforms: Optional[Sequence[str]] = None,
query: Optional[str] = None,
removed: Optional[bool] = None,
saved_object_id: Optional[str] = None,
saved_query_id: Optional[str] = None,
snapshot: Optional[bool] = None,
space_id: Optional[str] = None,
timeouts: Optional[KibanaOsquerySavedQueryTimeoutsArgs] = None,
version: Optional[str] = None) -> KibanaOsquerySavedQueryfunc GetKibanaOsquerySavedQuery(ctx *Context, name string, id IDInput, state *KibanaOsquerySavedQueryState, opts ...ResourceOption) (*KibanaOsquerySavedQuery, error)public static KibanaOsquerySavedQuery Get(string name, Input<string> id, KibanaOsquerySavedQueryState? state, CustomResourceOptions? opts = null)public static KibanaOsquerySavedQuery get(String name, Output<String> id, KibanaOsquerySavedQueryState state, CustomResourceOptions options)resources: _: type: elasticstack:KibanaOsquerySavedQuery get: id: ${id}import {
to = elasticstack_kibana_osquery_saved_query.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Description string
- Human-readable description of the saved query.
- Ecs
Mapping Dictionary<string, KibanaOsquery Saved Query Ecs Mapping Args> - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - Interval double
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- Kibana
Connections List<KibanaOsquery Saved Query Kibana Connection> - Kibana connection configuration block.
- Platforms List<string>
- Target platforms for the query. Allowed values:
linux,darwin,windows. - Query string
- Osquery SQL query text.
- Removed bool
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - Saved
Object stringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- Saved
Query stringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- Snapshot bool
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - Space
Id string - An identifier for the space. If space_id is not provided, the default space is used.
- Timeouts
Kibana
Osquery Saved Query Timeouts - Version string
- Saved query version string.
- Description string
- Human-readable description of the saved query.
- Ecs
Mapping map[string]KibanaOsquery Saved Query Ecs Mapping Args - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - Interval float64
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- Kibana
Connections []KibanaOsquery Saved Query Kibana Connection Args - Kibana connection configuration block.
- Platforms []string
- Target platforms for the query. Allowed values:
linux,darwin,windows. - Query string
- Osquery SQL query text.
- Removed bool
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - Saved
Object stringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- Saved
Query stringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- Snapshot bool
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - Space
Id string - An identifier for the space. If space_id is not provided, the default space is used.
- Timeouts
Kibana
Osquery Saved Query Timeouts Args - Version string
- Saved query version string.
- description string
- Human-readable description of the saved query.
- ecs_
mapping map(object) - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - interval number
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- kibana_
connections list(object) - Kibana connection configuration block.
- platforms list(string)
- Target platforms for the query. Allowed values:
linux,darwin,windows. - query string
- Osquery SQL query text.
- removed bool
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - saved_
object_ stringid - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- saved_
query_ stringid - Stable user-facing identifier for the saved query. Forces replacement when changed.
- snapshot bool
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space_
id string - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts object
- version string
- Saved query version string.
- description String
- Human-readable description of the saved query.
- ecs
Mapping Map<String,KibanaOsquery Saved Query Ecs Mapping Args> - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - interval Double
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- kibana
Connections List<KibanaOsquery Saved Query Kibana Connection> - Kibana connection configuration block.
- platforms List<String>
- Target platforms for the query. Allowed values:
linux,darwin,windows. - query String
- Osquery SQL query text.
- removed Boolean
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - saved
Object StringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- saved
Query StringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- snapshot Boolean
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space
Id String - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts
Kibana
Osquery Saved Query Timeouts - version String
- Saved query version string.
- description string
- Human-readable description of the saved query.
- ecs
Mapping {[key: string]: KibanaOsquery Saved Query Ecs Mapping Args} - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - interval number
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- kibana
Connections KibanaOsquery Saved Query Kibana Connection[] - Kibana connection configuration block.
- platforms string[]
- Target platforms for the query. Allowed values:
linux,darwin,windows. - query string
- Osquery SQL query text.
- removed boolean
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - saved
Object stringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- saved
Query stringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- snapshot boolean
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space
Id string - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts
Kibana
Osquery Saved Query Timeouts - version string
- Saved query version string.
- description str
- Human-readable description of the saved query.
- ecs_
mapping Mapping[str, KibanaOsquery Saved Query Ecs Mapping Args] - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - interval float
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- kibana_
connections Sequence[KibanaOsquery Saved Query Kibana Connection Args] - Kibana connection configuration block.
- platforms Sequence[str]
- Target platforms for the query. Allowed values:
linux,darwin,windows. - query str
- Osquery SQL query text.
- removed bool
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - saved_
object_ strid - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- saved_
query_ strid - Stable user-facing identifier for the saved query. Forces replacement when changed.
- snapshot bool
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space_
id str - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts
Kibana
Osquery Saved Query Timeouts Args - version str
- Saved query version string.
- description String
- Human-readable description of the saved query.
- ecs
Mapping Map<Property Map> - Maps query result columns to ECS field paths. Each map value must set exactly one of
field,value, orvalues. - interval Number
- Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
- kibana
Connections List<Property Map> - Kibana connection configuration block.
- platforms List<String>
- Target platforms for the query. Allowed values:
linux,darwin,windows. - query String
- Osquery SQL query text.
- removed Boolean
- Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - saved
Object StringId - Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
- saved
Query StringId - Stable user-facing identifier for the saved query. Forces replacement when changed.
- snapshot Boolean
- Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (
UseStateForUnknown). - space
Id String - An identifier for the space. If space_id is not provided, the default space is used.
- timeouts Property Map
- version String
- Saved query version string.
Supporting Types
KibanaOsquerySavedQueryEcsMapping, KibanaOsquerySavedQueryEcsMappingArgs
KibanaOsquerySavedQueryKibanaConnection, KibanaOsquerySavedQueryKibanaConnectionArgs
- Api
Key string - API Key to use for authentication to Kibana
- Bearer
Token string - Bearer Token to use for authentication to Kibana
- Ca
Certs List<string> - A list of paths to CA certificates to validate the certificate presented by the Kibana server.
- Endpoints List<string>
- Insecure bool
- Disable TLS certificate validation
- Password string
- Password to use for API authentication to Kibana.
- Username string
- Username to use for API authentication to Kibana.
- Api
Key string - API Key to use for authentication to Kibana
- Bearer
Token string - Bearer Token to use for authentication to Kibana
- Ca
Certs []string - A list of paths to CA certificates to validate the certificate presented by the Kibana server.
- Endpoints []string
- Insecure bool
- Disable TLS certificate validation
- Password string
- Password to use for API authentication to Kibana.
- Username string
- Username to use for API authentication to Kibana.
- api_
key string - API Key to use for authentication to Kibana
- bearer_
token string - Bearer Token to use for authentication to Kibana
- ca_
certs list(string) - A list of paths to CA certificates to validate the certificate presented by the Kibana server.
- endpoints list(string)
- insecure bool
- Disable TLS certificate validation
- password string
- Password to use for API authentication to Kibana.
- username string
- Username to use for API authentication to Kibana.
- api
Key String - API Key to use for authentication to Kibana
- bearer
Token String - Bearer Token to use for authentication to Kibana
- ca
Certs List<String> - A list of paths to CA certificates to validate the certificate presented by the Kibana server.
- endpoints List<String>
- insecure Boolean
- Disable TLS certificate validation
- password String
- Password to use for API authentication to Kibana.
- username String
- Username to use for API authentication to Kibana.
- api
Key string - API Key to use for authentication to Kibana
- bearer
Token string - Bearer Token to use for authentication to Kibana
- ca
Certs string[] - A list of paths to CA certificates to validate the certificate presented by the Kibana server.
- endpoints string[]
- insecure boolean
- Disable TLS certificate validation
- password string
- Password to use for API authentication to Kibana.
- username string
- Username to use for API authentication to Kibana.
- api_
key str - API Key to use for authentication to Kibana
- bearer_
token str - Bearer Token to use for authentication to Kibana
- ca_
certs Sequence[str] - A list of paths to CA certificates to validate the certificate presented by the Kibana server.
- endpoints Sequence[str]
- insecure bool
- Disable TLS certificate validation
- password str
- Password to use for API authentication to Kibana.
- username str
- Username to use for API authentication to Kibana.
- api
Key String - API Key to use for authentication to Kibana
- bearer
Token String - Bearer Token to use for authentication to Kibana
- ca
Certs List<String> - A list of paths to CA certificates to validate the certificate presented by the Kibana server.
- endpoints List<String>
- insecure Boolean
- Disable TLS certificate validation
- password String
- Password to use for API authentication to Kibana.
- username String
- Username to use for API authentication to Kibana.
KibanaOsquerySavedQueryTimeouts, KibanaOsquerySavedQueryTimeoutsArgs
- Create string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- Delete string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
- Read string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
- Update string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- Create string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- Delete string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
- Read string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
- Update string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- create string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- delete string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
- read string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
- update string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- create String
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- delete String
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
- read String
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
- update String
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- create string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- delete string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
- read string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
- update string
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- create str
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- delete str
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
- read str
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
- update str
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- create String
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
- delete String
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
- read String
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
- update String
- A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
Import
The pulumi import command can be used, for example:
$ pulumi import elasticstack:index/kibanaOsquerySavedQuery:KibanaOsquerySavedQuery list_processes <space id>/<saved query id>
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- elasticstack elastic/terraform-provider-elasticstack
- License
- Notes
- This Pulumi package is based on the
elasticstackTerraform Provider.
published on Thursday, Jul 23, 2026 by elastic