Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hey all,
Has the live query API endpoint changed? I can seem to get it to work:
<https://fleetdm.com/docs/using-fleet/rest-api#run-live-query>
I get the error "one of query or query_id must be specified"
I did find this: <https://fleetdm.com/docs/contributing/api-for-contributors#run-live-query>
But my setup does not allow for opening a websocket to get the results. is there a solution that will work over only HTTP?

Hi <@U02NCP0SC7M> Can you show me the request you're sending?

As well as what version of Fleet you are running.

Here is the cURL:
```curl -v \
-X POST \
--location \
"<https://internalfleet/api/v1/fleet/queries/run>" \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer TOKEN' \
-d '{"query_ids":["21"],"host_ids":["523"]}'```

Heres the version string I got from the "my account" page:
`Fleet 0.0.0-SNAPSHOT-77d8b0b • Go go1.19.8`

But i pulled the container about a week ago

The error is odd for the incorrect method, definitely something to look at. The same request gets me results:

```curl -v \
-X GET \
--location \
'<https://dogfood.fleetdm.com/api/v1/fleet/queries/run>' \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer H176qK4ANbTMZDEPM0UG2lTM5mt87wAZHlsxWXJ8PUzi1gG8YHVPIeWp0We3fhqDL4nRZbD8bkoo1ag/TZACIQ==' \
-d '{"query_ids": [1], "host_ids":[1]}'```


```[...]
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
* We are completely uploaded and fine
&lt; HTTP/2 200 
&lt; date: Thu, 11 May 2023 21:26:27 GMT
&lt; content-type: application/json; charset=utf-8
&lt; 
{
  "summary": {
    "targeted_host_count": 1,
    "responded_host_count": 1
  },
  "live_query_results": [
    {
      "query_id": 778,
      "results": [
        {
          "host_id": 125,
          "rows": [
            {
              "action": "add",
              "datetime": "2023-05-09 21:56:47",
              "path": "/Volumes/DataGrip",
              "vendor": "Apple"
            },
            {
              "action": "add",
[...]```