1. Registry
  2. Packages
  3. Elasticstack Provider
  4. API Docs
  5. KibanaOsquerySavedQuery
Viewing docs for elasticstack 0.16.3
published on Thursday, Jul 23, 2026 by elastic
Viewing docs for elasticstack 0.16.3
published on Thursday, Jul 23, 2026 by elastic

    Manages a user-defined Osquery saved query in Kibana. Requires Kibana 8.5.0 or later. Prebuilt queries shipped with the osquery_manager integration cannot be managed by this resource; use the elasticstack.KibanaOsquerySavedQuery data source to read them instead. Import of prebuilt queries fails; use the data source for prebuilt queries.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
    import * as elasticstack from "@pulumi/elasticstack";
    
    const listProcesses = new elasticstack.KibanaOsquerySavedQuery("list_processes", {
        savedQueryId: "list_processes",
        query: "SELECT pid, name, cmdline FROM processes LIMIT 100;",
        description: "List running processes with command lines",
        platforms: [
            "linux",
            "darwin",
        ],
        interval: 3600,
        version: "1.0.0",
        ecsMapping: {
            "process.name": {
                field: "name",
            },
            "process.command_line": {
                field: "cmdline",
            },
            "event.category": {
                value: "process",
            },
            "event.type": {
                values: [
                    "start",
                    "end",
                ],
            },
        },
    });
    
    import pulumi
    import pulumi_elasticstack as elasticstack
    
    list_processes = elasticstack.KibanaOsquerySavedQuery("list_processes",
        saved_query_id="list_processes",
        query="SELECT pid, name, cmdline FROM processes LIMIT 100;",
        description="List running processes with command lines",
        platforms=[
            "linux",
            "darwin",
        ],
        interval=3600,
        version="1.0.0",
        ecs_mapping={
            "process.name": {
                "field": "name",
            },
            "process.command_line": {
                "field": "cmdline",
            },
            "event.category": {
                "value": "process",
            },
            "event.type": {
                "values": [
                    "start",
                    "end",
                ],
            },
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/elasticstack/elasticstack"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := elasticstack.NewKibanaOsquerySavedQuery(ctx, "list_processes", &elasticstack.KibanaOsquerySavedQueryArgs{
    			SavedQueryId: pulumi.String("list_processes"),
    			Query:        pulumi.String("SELECT pid, name, cmdline FROM processes LIMIT 100;"),
    			Description:  pulumi.String("List running processes with command lines"),
    			Platforms: pulumi.StringArray{
    				pulumi.String("linux"),
    				pulumi.String("darwin"),
    			},
    			Interval: pulumi.Float64(3600),
    			Version:  pulumi.String("1.0.0"),
    			EcsMapping: elasticstack.KibanaOsquerySavedQueryEcsMappingMap{
    				"process.name": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
    					Field: pulumi.String("name"),
    				},
    				"process.command_line": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
    					Field: pulumi.String("cmdline"),
    				},
    				"event.category": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
    					Value: pulumi.String("process"),
    				},
    				"event.type": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
    					Values: pulumi.StringArray{
    						pulumi.String("start"),
    						pulumi.String("end"),
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Elasticstack = Pulumi.Elasticstack;
    
    return await Deployment.RunAsync(() => 
    {
        var listProcesses = new Elasticstack.KibanaOsquerySavedQuery("list_processes", new()
        {
            SavedQueryId = "list_processes",
            Query = "SELECT pid, name, cmdline FROM processes LIMIT 100;",
            Description = "List running processes with command lines",
            Platforms = new[]
            {
                "linux",
                "darwin",
            },
            Interval = 3600,
            Version = "1.0.0",
            EcsMapping = 
            {
                { "process.name", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
                {
                    Field = "name",
                } },
                { "process.command_line", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
                {
                    Field = "cmdline",
                } },
                { "event.category", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
                {
                    Value = "process",
                } },
                { "event.type", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
                {
                    Values = new[]
                    {
                        "start",
                        "end",
                    },
                } },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.elasticstack.KibanaOsquerySavedQuery;
    import com.pulumi.elasticstack.KibanaOsquerySavedQueryArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var listProcesses = new KibanaOsquerySavedQuery("listProcesses", KibanaOsquerySavedQueryArgs.builder()
                .savedQueryId("list_processes")
                .query("SELECT pid, name, cmdline FROM processes LIMIT 100;")
                .description("List running processes with command lines")
                .platforms(            
                    "linux",
                    "darwin")
                .interval(3600.0)
                .version("1.0.0")
                .ecsMapping(Map.ofEntries(
                    Map.entry("process.name", KibanaOsquerySavedQueryEcsMappingArgs.builder()
                        .field("name")
                        .build()),
                    Map.entry("process.command_line", KibanaOsquerySavedQueryEcsMappingArgs.builder()
                        .field("cmdline")
                        .build()),
                    Map.entry("event.category", KibanaOsquerySavedQueryEcsMappingArgs.builder()
                        .value("process")
                        .build()),
                    Map.entry("event.type", KibanaOsquerySavedQueryEcsMappingArgs.builder()
                        .values(                    
                            "start",
                            "end")
                        .build())
                ))
                .build());
    
        }
    }
    
    resources:
      listProcesses:
        type: elasticstack:KibanaOsquerySavedQuery
        name: list_processes
        properties:
          savedQueryId: list_processes
          query: SELECT pid, name, cmdline FROM processes LIMIT 100;
          description: List running processes with command lines
          platforms:
            - linux
            - darwin
          interval: 3600
          version: 1.0.0
          ecsMapping:
            process.name:
              field: name
            process.command_line:
              field: cmdline
            event.category:
              value: process
            event.type:
              values:
                - start
                - end
    
    Example coming soon!
    

    Create KibanaOsquerySavedQuery Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KibanaOsquerySavedQuery(name: string, args: KibanaOsquerySavedQueryArgs, opts?: CustomResourceOptions);
    @overload
    def KibanaOsquerySavedQuery(resource_name: str,
                                args: KibanaOsquerySavedQueryArgs,
                                opts: Optional[ResourceOptions] = None)
    
    @overload
    def KibanaOsquerySavedQuery(resource_name: str,
                                opts: Optional[ResourceOptions] = None,
                                interval: Optional[float] = None,
                                query: Optional[str] = None,
                                saved_query_id: Optional[str] = None,
                                description: Optional[str] = None,
                                ecs_mapping: Optional[Mapping[str, KibanaOsquerySavedQueryEcsMappingArgs]] = None,
                                kibana_connections: Optional[Sequence[KibanaOsquerySavedQueryKibanaConnectionArgs]] = None,
                                platforms: Optional[Sequence[str]] = None,
                                removed: Optional[bool] = None,
                                snapshot: Optional[bool] = None,
                                space_id: Optional[str] = None,
                                timeouts: Optional[KibanaOsquerySavedQueryTimeoutsArgs] = None,
                                version: Optional[str] = None)
    func NewKibanaOsquerySavedQuery(ctx *Context, name string, args KibanaOsquerySavedQueryArgs, opts ...ResourceOption) (*KibanaOsquerySavedQuery, error)
    public KibanaOsquerySavedQuery(string name, KibanaOsquerySavedQueryArgs args, CustomResourceOptions? opts = null)
    public KibanaOsquerySavedQuery(String name, KibanaOsquerySavedQueryArgs args)
    public KibanaOsquerySavedQuery(String name, KibanaOsquerySavedQueryArgs args, CustomResourceOptions options)
    
    type: elasticstack:KibanaOsquerySavedQuery
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    
    resource "elasticstack_kibana_osquery_saved_query" "name" {
        # resource properties
    }

    Parameters

    name string
    The unique name of the resource.
    args KibanaOsquerySavedQueryArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KibanaOsquerySavedQueryArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KibanaOsquerySavedQueryArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KibanaOsquerySavedQueryArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KibanaOsquerySavedQueryArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kibanaOsquerySavedQueryResource = new Elasticstack.KibanaOsquerySavedQuery("kibanaOsquerySavedQueryResource", new()
    {
        Interval = 0,
        Query = "string",
        SavedQueryId = "string",
        Description = "string",
        EcsMapping = 
        {
            { "string", new Elasticstack.Inputs.KibanaOsquerySavedQueryEcsMappingArgs
            {
                Field = "string",
                Value = "string",
                Values = new[]
                {
                    "string",
                },
            } },
        },
        KibanaConnections = new[]
        {
            new Elasticstack.Inputs.KibanaOsquerySavedQueryKibanaConnectionArgs
            {
                ApiKey = "string",
                BearerToken = "string",
                CaCerts = new[]
                {
                    "string",
                },
                Endpoints = new[]
                {
                    "string",
                },
                Insecure = false,
                Password = "string",
                Username = "string",
            },
        },
        Platforms = new[]
        {
            "string",
        },
        Removed = false,
        Snapshot = false,
        SpaceId = "string",
        Timeouts = new Elasticstack.Inputs.KibanaOsquerySavedQueryTimeoutsArgs
        {
            Create = "string",
            Delete = "string",
            Read = "string",
            Update = "string",
        },
        Version = "string",
    });
    
    example, err := elasticstack.NewKibanaOsquerySavedQuery(ctx, "kibanaOsquerySavedQueryResource", &elasticstack.KibanaOsquerySavedQueryArgs{
    	Interval:     pulumi.Float64(0),
    	Query:        pulumi.String("string"),
    	SavedQueryId: pulumi.String("string"),
    	Description:  pulumi.String("string"),
    	EcsMapping: elasticstack.KibanaOsquerySavedQueryEcsMappingMap{
    		"string": &elasticstack.KibanaOsquerySavedQueryEcsMappingArgs{
    			Field: pulumi.String("string"),
    			Value: pulumi.String("string"),
    			Values: pulumi.StringArray{
    				pulumi.String("string"),
    			},
    		},
    	},
    	KibanaConnections: elasticstack.KibanaOsquerySavedQueryKibanaConnectionArray{
    		&elasticstack.KibanaOsquerySavedQueryKibanaConnectionArgs{
    			ApiKey:      pulumi.String("string"),
    			BearerToken: pulumi.String("string"),
    			CaCerts: pulumi.StringArray{
    				pulumi.String("string"),
    			},
    			Endpoints: pulumi.StringArray{
    				pulumi.String("string"),
    			},
    			Insecure: pulumi.Bool(false),
    			Password: pulumi.String("string"),
    			Username: pulumi.String("string"),
    		},
    	},
    	Platforms: pulumi.StringArray{
    		pulumi.String("string"),
    	},
    	Removed:  pulumi.Bool(false),
    	Snapshot: pulumi.Bool(false),
    	SpaceId:  pulumi.String("string"),
    	Timeouts: &elasticstack.KibanaOsquerySavedQueryTimeoutsArgs{
    		Create: pulumi.String("string"),
    		Delete: pulumi.String("string"),
    		Read:   pulumi.String("string"),
    		Update: pulumi.String("string"),
    	},
    	Version: pulumi.String("string"),
    })
    
    resource "elasticstack_kibana_osquery_saved_query" "kibanaOsquerySavedQueryResource" {
      lifecycle {
        create_before_destroy = true
      }
      interval       = 0
      query          = "string"
      saved_query_id = "string"
      description    = "string"
      ecs_mapping = {
        "string" = {
          field  = "string"
          value  = "string"
          values = ["string"]
        }
      }
      kibana_connections {
        api_key      = "string"
        bearer_token = "string"
        ca_certs     = ["string"]
        endpoints    = ["string"]
        insecure     = false
        password     = "string"
        username     = "string"
      }
      platforms = ["string"]
      removed   = false
      snapshot  = false
      space_id  = "string"
      timeouts = {
        create = "string"
        delete = "string"
        read   = "string"
        update = "string"
      }
      version = "string"
    }
    
    var kibanaOsquerySavedQueryResource = new KibanaOsquerySavedQuery("kibanaOsquerySavedQueryResource", KibanaOsquerySavedQueryArgs.builder()
        .interval(0.0)
        .query("string")
        .savedQueryId("string")
        .description("string")
        .ecsMapping(Map.of("string", KibanaOsquerySavedQueryEcsMappingArgs.builder()
            .field("string")
            .value("string")
            .values("string")
            .build()))
        .kibanaConnections(KibanaOsquerySavedQueryKibanaConnectionArgs.builder()
            .apiKey("string")
            .bearerToken("string")
            .caCerts("string")
            .endpoints("string")
            .insecure(false)
            .password("string")
            .username("string")
            .build())
        .platforms("string")
        .removed(false)
        .snapshot(false)
        .spaceId("string")
        .timeouts(KibanaOsquerySavedQueryTimeoutsArgs.builder()
            .create("string")
            .delete("string")
            .read("string")
            .update("string")
            .build())
        .version("string")
        .build());
    
    kibana_osquery_saved_query_resource = elasticstack.KibanaOsquerySavedQuery("kibanaOsquerySavedQueryResource",
        interval=float(0),
        query="string",
        saved_query_id="string",
        description="string",
        ecs_mapping={
            "string": {
                "field": "string",
                "value": "string",
                "values": ["string"],
            },
        },
        kibana_connections=[{
            "api_key": "string",
            "bearer_token": "string",
            "ca_certs": ["string"],
            "endpoints": ["string"],
            "insecure": False,
            "password": "string",
            "username": "string",
        }],
        platforms=["string"],
        removed=False,
        snapshot=False,
        space_id="string",
        timeouts={
            "create": "string",
            "delete": "string",
            "read": "string",
            "update": "string",
        },
        version="string")
    
    const kibanaOsquerySavedQueryResource = new elasticstack.KibanaOsquerySavedQuery("kibanaOsquerySavedQueryResource", {
        interval: 0,
        query: "string",
        savedQueryId: "string",
        description: "string",
        ecsMapping: {
            string: {
                field: "string",
                value: "string",
                values: ["string"],
            },
        },
        kibanaConnections: [{
            apiKey: "string",
            bearerToken: "string",
            caCerts: ["string"],
            endpoints: ["string"],
            insecure: false,
            password: "string",
            username: "string",
        }],
        platforms: ["string"],
        removed: false,
        snapshot: false,
        spaceId: "string",
        timeouts: {
            create: "string",
            "delete": "string",
            read: "string",
            update: "string",
        },
        version: "string",
    });
    
    type: elasticstack:KibanaOsquerySavedQuery
    properties:
        description: string
        ecsMapping:
            string:
                field: string
                value: string
                values:
                    - string
        interval: 0
        kibanaConnections:
            - apiKey: string
              bearerToken: string
              caCerts:
                - string
              endpoints:
                - string
              insecure: false
              password: string
              username: string
        platforms:
            - string
        query: string
        removed: false
        savedQueryId: string
        snapshot: false
        spaceId: string
        timeouts:
            create: string
            delete: string
            read: string
            update: string
        version: string
    

    KibanaOsquerySavedQuery Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KibanaOsquerySavedQuery resource accepts the following input properties:

    Interval double
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    Query string
    Osquery SQL query text.
    SavedQueryId string
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    Description string
    Human-readable description of the saved query.
    EcsMapping Dictionary<string, KibanaOsquerySavedQueryEcsMappingArgs>
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    KibanaConnections List<KibanaOsquerySavedQueryKibanaConnection>
    Kibana connection configuration block.
    Platforms List<string>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    Removed bool
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    Snapshot bool
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Timeouts KibanaOsquerySavedQueryTimeouts
    Version string
    Saved query version string.
    Interval float64
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    Query string
    Osquery SQL query text.
    SavedQueryId string
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    Description string
    Human-readable description of the saved query.
    EcsMapping map[string]KibanaOsquerySavedQueryEcsMappingArgs
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    KibanaConnections []KibanaOsquerySavedQueryKibanaConnectionArgs
    Kibana connection configuration block.
    Platforms []string
    Target platforms for the query. Allowed values: linux, darwin, windows.
    Removed bool
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    Snapshot bool
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Timeouts KibanaOsquerySavedQueryTimeoutsArgs
    Version string
    Saved query version string.
    interval number
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    query string
    Osquery SQL query text.
    saved_query_id string
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    description string
    Human-readable description of the saved query.
    ecs_mapping map(object)
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    kibana_connections list(object)
    Kibana connection configuration block.
    platforms list(string)
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed bool
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    snapshot bool
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    space_id string
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts object
    version string
    Saved query version string.
    interval Double
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    query String
    Osquery SQL query text.
    savedQueryId String
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    description String
    Human-readable description of the saved query.
    ecsMapping Map<String,KibanaOsquerySavedQueryEcsMappingArgs>
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    kibanaConnections List<KibanaOsquerySavedQueryKibanaConnection>
    Kibana connection configuration block.
    platforms List<String>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed Boolean
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    snapshot Boolean
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsquerySavedQueryTimeouts
    version String
    Saved query version string.
    interval number
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    query string
    Osquery SQL query text.
    savedQueryId string
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    description string
    Human-readable description of the saved query.
    ecsMapping {[key: string]: KibanaOsquerySavedQueryEcsMappingArgs}
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    kibanaConnections KibanaOsquerySavedQueryKibanaConnection[]
    Kibana connection configuration block.
    platforms string[]
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed boolean
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    snapshot boolean
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsquerySavedQueryTimeouts
    version string
    Saved query version string.
    interval float
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    query str
    Osquery SQL query text.
    saved_query_id str
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    description str
    Human-readable description of the saved query.
    ecs_mapping Mapping[str, KibanaOsquerySavedQueryEcsMappingArgs]
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    kibana_connections Sequence[KibanaOsquerySavedQueryKibanaConnectionArgs]
    Kibana connection configuration block.
    platforms Sequence[str]
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed bool
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    snapshot bool
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsquerySavedQueryTimeoutsArgs
    version str
    Saved query version string.
    interval Number
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    query String
    Osquery SQL query text.
    savedQueryId String
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    description String
    Human-readable description of the saved query.
    ecsMapping Map<Property Map>
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    kibanaConnections List<Property Map>
    Kibana connection configuration block.
    platforms List<String>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    removed Boolean
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    snapshot Boolean
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts Property Map
    version String
    Saved query version string.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KibanaOsquerySavedQuery resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    SavedObjectId string
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    Id string
    The provider-assigned unique ID for this managed resource.
    SavedObjectId string
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    id string
    The provider-assigned unique ID for this managed resource.
    saved_object_id string
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    id String
    The provider-assigned unique ID for this managed resource.
    savedObjectId String
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    id string
    The provider-assigned unique ID for this managed resource.
    savedObjectId string
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    id str
    The provider-assigned unique ID for this managed resource.
    saved_object_id str
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    id String
    The provider-assigned unique ID for this managed resource.
    savedObjectId String
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.

    Look up Existing KibanaOsquerySavedQuery Resource

    Get an existing KibanaOsquerySavedQuery resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KibanaOsquerySavedQueryState, opts?: CustomResourceOptions): KibanaOsquerySavedQuery
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            description: Optional[str] = None,
            ecs_mapping: Optional[Mapping[str, KibanaOsquerySavedQueryEcsMappingArgs]] = None,
            interval: Optional[float] = None,
            kibana_connections: Optional[Sequence[KibanaOsquerySavedQueryKibanaConnectionArgs]] = None,
            platforms: Optional[Sequence[str]] = None,
            query: Optional[str] = None,
            removed: Optional[bool] = None,
            saved_object_id: Optional[str] = None,
            saved_query_id: Optional[str] = None,
            snapshot: Optional[bool] = None,
            space_id: Optional[str] = None,
            timeouts: Optional[KibanaOsquerySavedQueryTimeoutsArgs] = None,
            version: Optional[str] = None) -> KibanaOsquerySavedQuery
    func GetKibanaOsquerySavedQuery(ctx *Context, name string, id IDInput, state *KibanaOsquerySavedQueryState, opts ...ResourceOption) (*KibanaOsquerySavedQuery, error)
    public static KibanaOsquerySavedQuery Get(string name, Input<string> id, KibanaOsquerySavedQueryState? state, CustomResourceOptions? opts = null)
    public static KibanaOsquerySavedQuery get(String name, Output<String> id, KibanaOsquerySavedQueryState state, CustomResourceOptions options)
    resources:  _:    type: elasticstack:KibanaOsquerySavedQuery    get:      id: ${id}
    import {
      to = elasticstack_kibana_osquery_saved_query.example
      id = "${id}"
    }
    
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Description string
    Human-readable description of the saved query.
    EcsMapping Dictionary<string, KibanaOsquerySavedQueryEcsMappingArgs>
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    Interval double
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    KibanaConnections List<KibanaOsquerySavedQueryKibanaConnection>
    Kibana connection configuration block.
    Platforms List<string>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    Query string
    Osquery SQL query text.
    Removed bool
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    SavedObjectId string
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    SavedQueryId string
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    Snapshot bool
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Timeouts KibanaOsquerySavedQueryTimeouts
    Version string
    Saved query version string.
    Description string
    Human-readable description of the saved query.
    EcsMapping map[string]KibanaOsquerySavedQueryEcsMappingArgs
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    Interval float64
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    KibanaConnections []KibanaOsquerySavedQueryKibanaConnectionArgs
    Kibana connection configuration block.
    Platforms []string
    Target platforms for the query. Allowed values: linux, darwin, windows.
    Query string
    Osquery SQL query text.
    Removed bool
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    SavedObjectId string
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    SavedQueryId string
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    Snapshot bool
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Timeouts KibanaOsquerySavedQueryTimeoutsArgs
    Version string
    Saved query version string.
    description string
    Human-readable description of the saved query.
    ecs_mapping map(object)
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    interval number
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    kibana_connections list(object)
    Kibana connection configuration block.
    platforms list(string)
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query string
    Osquery SQL query text.
    removed bool
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    saved_object_id string
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    saved_query_id string
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    snapshot bool
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    space_id string
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts object
    version string
    Saved query version string.
    description String
    Human-readable description of the saved query.
    ecsMapping Map<String,KibanaOsquerySavedQueryEcsMappingArgs>
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    interval Double
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    kibanaConnections List<KibanaOsquerySavedQueryKibanaConnection>
    Kibana connection configuration block.
    platforms List<String>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query String
    Osquery SQL query text.
    removed Boolean
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    savedObjectId String
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    savedQueryId String
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    snapshot Boolean
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsquerySavedQueryTimeouts
    version String
    Saved query version string.
    description string
    Human-readable description of the saved query.
    ecsMapping {[key: string]: KibanaOsquerySavedQueryEcsMappingArgs}
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    interval number
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    kibanaConnections KibanaOsquerySavedQueryKibanaConnection[]
    Kibana connection configuration block.
    platforms string[]
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query string
    Osquery SQL query text.
    removed boolean
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    savedObjectId string
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    savedQueryId string
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    snapshot boolean
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsquerySavedQueryTimeouts
    version string
    Saved query version string.
    description str
    Human-readable description of the saved query.
    ecs_mapping Mapping[str, KibanaOsquerySavedQueryEcsMappingArgs]
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    interval float
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    kibana_connections Sequence[KibanaOsquerySavedQueryKibanaConnectionArgs]
    Kibana connection configuration block.
    platforms Sequence[str]
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query str
    Osquery SQL query text.
    removed bool
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    saved_object_id str
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    saved_query_id str
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    snapshot bool
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts KibanaOsquerySavedQueryTimeoutsArgs
    version str
    Saved query version string.
    description String
    Human-readable description of the saved query.
    ecsMapping Map<Property Map>
    Maps query result columns to ECS field paths. Each map value must set exactly one of field, value, or values.
    interval Number
    Query execution interval in seconds. Required by the Kibana Osquery API on create and update.
    kibanaConnections List<Property Map>
    Kibana connection configuration block.
    platforms List<String>
    Target platforms for the query. Allowed values: linux, darwin, windows.
    query String
    Osquery SQL query text.
    removed Boolean
    Whether the saved query is marked removed. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    savedObjectId String
    Kibana saved object identifier used internally by Kibana's Osquery saved query detail, update, and delete APIs.
    savedQueryId String
    Stable user-facing identifier for the saved query. Forces replacement when changed.
    snapshot Boolean
    Whether the saved query is a snapshot. Returned by the API and may be set explicitly in configuration. When omitted or unknown at plan time, the prior state value is preserved (UseStateForUnknown).
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    timeouts Property Map
    version String
    Saved query version string.

    Supporting Types

    KibanaOsquerySavedQueryEcsMapping, KibanaOsquerySavedQueryEcsMappingArgs

    Field string
    Query result column name to map from.
    Value string
    Static scalar ECS mapping value.
    Values List<string>
    Static array ECS mapping values.
    Field string
    Query result column name to map from.
    Value string
    Static scalar ECS mapping value.
    Values []string
    Static array ECS mapping values.
    field string
    Query result column name to map from.
    value string
    Static scalar ECS mapping value.
    values list(string)
    Static array ECS mapping values.
    field String
    Query result column name to map from.
    value String
    Static scalar ECS mapping value.
    values List<String>
    Static array ECS mapping values.
    field string
    Query result column name to map from.
    value string
    Static scalar ECS mapping value.
    values string[]
    Static array ECS mapping values.
    field str
    Query result column name to map from.
    value str
    Static scalar ECS mapping value.
    values Sequence[str]
    Static array ECS mapping values.
    field String
    Query result column name to map from.
    value String
    Static scalar ECS mapping value.
    values List<String>
    Static array ECS mapping values.

    KibanaOsquerySavedQueryKibanaConnection, KibanaOsquerySavedQueryKibanaConnectionArgs

    ApiKey string
    API Key to use for authentication to Kibana
    BearerToken string
    Bearer Token to use for authentication to Kibana
    CaCerts List<string>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    Endpoints List<string>
    Insecure bool
    Disable TLS certificate validation
    Password string
    Password to use for API authentication to Kibana.
    Username string
    Username to use for API authentication to Kibana.
    ApiKey string
    API Key to use for authentication to Kibana
    BearerToken string
    Bearer Token to use for authentication to Kibana
    CaCerts []string
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    Endpoints []string
    Insecure bool
    Disable TLS certificate validation
    Password string
    Password to use for API authentication to Kibana.
    Username string
    Username to use for API authentication to Kibana.
    api_key string
    API Key to use for authentication to Kibana
    bearer_token string
    Bearer Token to use for authentication to Kibana
    ca_certs list(string)
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints list(string)
    insecure bool
    Disable TLS certificate validation
    password string
    Password to use for API authentication to Kibana.
    username string
    Username to use for API authentication to Kibana.
    apiKey String
    API Key to use for authentication to Kibana
    bearerToken String
    Bearer Token to use for authentication to Kibana
    caCerts List<String>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints List<String>
    insecure Boolean
    Disable TLS certificate validation
    password String
    Password to use for API authentication to Kibana.
    username String
    Username to use for API authentication to Kibana.
    apiKey string
    API Key to use for authentication to Kibana
    bearerToken string
    Bearer Token to use for authentication to Kibana
    caCerts string[]
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints string[]
    insecure boolean
    Disable TLS certificate validation
    password string
    Password to use for API authentication to Kibana.
    username string
    Username to use for API authentication to Kibana.
    api_key str
    API Key to use for authentication to Kibana
    bearer_token str
    Bearer Token to use for authentication to Kibana
    ca_certs Sequence[str]
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints Sequence[str]
    insecure bool
    Disable TLS certificate validation
    password str
    Password to use for API authentication to Kibana.
    username str
    Username to use for API authentication to Kibana.
    apiKey String
    API Key to use for authentication to Kibana
    bearerToken String
    Bearer Token to use for authentication to Kibana
    caCerts List<String>
    A list of paths to CA certificates to validate the certificate presented by the Kibana server.
    endpoints List<String>
    insecure Boolean
    Disable TLS certificate validation
    password String
    Password to use for API authentication to Kibana.
    username String
    Username to use for API authentication to Kibana.

    KibanaOsquerySavedQueryTimeouts, KibanaOsquerySavedQueryTimeoutsArgs

    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    Read string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    Delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    Read string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    Update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update string
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update str
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    create String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
    delete String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
    read String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
    update String
    A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

    Import

    The pulumi import command can be used, for example:

    $ pulumi import elasticstack:index/kibanaOsquerySavedQuery:KibanaOsquerySavedQuery list_processes <space id>/<saved query id>
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    elasticstack elastic/terraform-provider-elasticstack
    License
    Notes
    This Pulumi package is based on the elasticstack Terraform Provider.
    Viewing docs for elasticstack 0.16.3
    published on Thursday, Jul 23, 2026 by elastic

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial