Skip to content

Osquerybeat: emit pack_name and query_name in scheduled query results#51781

Open
marc-gr wants to merge 1 commit into
elastic:mainfrom
marc-gr:feat/osquerybeat-pack-name-query-name
Open

Osquerybeat: emit pack_name and query_name in scheduled query results#51781
marc-gr wants to merge 1 commit into
elastic:mainfrom
marc-gr:feat/osquerybeat-pack-name-query-name

Conversation

@marc-gr

@marc-gr marc-gr commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Proposed commit message

Emit pack_name and query_name in osquerybeat scheduled query results.

WHAT:

  • Add a new optional pack_name config field to packs, next to the existing pack_id.
  • Scheduled pack queries — both osquery native interval schedules (handleQueryResult) and osquerybeat RRULE schedules (recurrenceQueryHandler) — now include two additional fields in their result documents and their synthetic response documents:
    • pack_name: from the new pack_name pack config field.
    • query_name: from the pack's queries config map key.
  • Both fields are threaded through QueryInfo and emitted only when set. Live/ad-hoc queries are unaffected (they emit neither).

WHY:
The Osquery Manager dashboards group and label scheduled query results by pack and query name. Without pack_name/query_name on the documents, those dashboards cannot render scheduled pack results correctly.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works.
  • I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

None. The pack_name field is opt-in and both fields are additive; documents without the new config keep their previous shape. pack_id and the existing correlation fields are unchanged.

How to test this PR locally

  1. Build osquerybeat from this branch.
  2. Configure a pack with a pack_name and one or more scheduled queries (native interval and/or rrule_schedule): 
    osquery:
  packs:
    my_pack:
      pack_id: "pack-uuid-123"
      pack_name: "My Pack"
      default_native_schedule:
        interval: 60
        start_date: "2026-01-01T00:00:00Z"
      queries:
        uptime:
          query: "select * from uptime"
  3. Confirm the osquery_manager.result documents include pack_name: "My Pack" and query_name: "uptime", and the osquery_manager.action.responses synthetic response document includes the same fields.
  4. Confirm live/ad-hoc query results do not include pack_name/query_name.

Related issues

Use cases

  • The Osquery Manager dashboards group scheduled results by pack and query name using the new pack_name/query_name fields.

@marc-gr
Osquerybeat: emit pack_name and query_name in scheduled query results
3cab8d0 
Scheduled pack queries (both osquery native interval schedules and osquerybeat
RRULE schedules) now include pack_name and query_name in their result and
response documents. pack_name comes from a new optional `pack_name` config
field on a pack (alongside the existing pack_id); query_name comes from the
pack's queries config map key. Both fields are only emitted when set.

These fields are required by the Osquery Manager dashboards, which group and
label scheduled query results by pack and query name.
@marc-gr marc-gr requested a review from a team as a code owner July 7, 2026 12:44
@marc-gr marc-gr added Osquerybeat Team:Security-Windows Platform Windows Platform Team in Security Solution backport-9.3 Automated backport to the 9.3 branch backport-9.4 bug-fix labels Jul 7, 2026
@botelastic botelastic Bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jul 7, 2026
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 7, 2026

Copy link
Copy Markdown

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

@botelastic botelastic Bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jul 7, 2026
@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

🤖 GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
  • /test : Run the Buildkite pipeline.

@mergify mergify Bot assigned marc-gr Jul 7, 2026
@marc-gr marc-gr removed the backport-9.3 Automated backport to the 9.3 branch label Jul 7, 2026
tomsonpl
tomsonpl reviewed Jul 9, 2026
View reviewed changes

@tomsonpl tomsonpl left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed together with the Kibana (elastic/kibana#276690) and integrations (elastic/integrations#20017) PRs. The pack_name config field and the query_name derived from the queries map key line up cleanly with what Kibana emits and what the integrations mappings expect, so the end-to-end contract looks consistent to me. A couple of clarifying questions inline.

Comment thread x-pack/osquerybeat/beater/config_plugin.go
return fmt.Errorf("osquery.schedule[%q]: %w", name, err)
}
qi, err = registerQuery(name, p.namespace, qi, "")
qi, err = registerQuery(name, p.namespace, qi, "", "", name)

@tomsonpl tomsonpl Jul 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to confirm my understanding: for top-level (non-pack) scheduled queries this passes queryName = name with an empty packName, so those docs would get query_name but no pack_name. Is emitting query_name on non-pack scheduled queries intended? I ask because the integrations field description phrases both fields as "for scheduled queries that belong to a pack" (elastic/integrations#20017), so I wanted to check whether the behavior or that description should be the source of truth.

Comment thread x-pack/osquerybeat/beater/config_plugin.go
}

qi, err = registerQuery(getPackQueryName(input.Name, stream.ID), p.namespace, qi, input.Name)
qi, err = registerQuery(getPackQueryName(input.Name, stream.ID), p.namespace, qi, input.Name, "", stream.ID)

@tomsonpl tomsonpl Jul 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For this input/stream-based pack path, packName is passed as "" (so pack_name won't be stamped) while pack_id is set from input.Name. Is this path reachable for Fleet-managed osquery_manager packs, or only for standalone/legacy beats input config? I'm trying to understand whether scheduled docs flowing through here would be missing pack_name and therefore not match the updated dashboard filters, or whether that's expected because Fleet always uses the packs map above.

@tomsonpl tomsonpl mentioned this pull request Jul 9, 2026
Open
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tomsonpl tomsonpl tomsonpl approved these changes

At least 1 approving review is required to merge this pull request.

Assignees

@marc-gr marc-gr

Labels

backport-9.4 bug-fix Osquerybeat Team:Security-Windows Platform Windows Platform Team in Security Solution

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@marc-gr @tomsonpl