# Dec 6th, 2021: \[en\] Using OSQuery in Elastic Stack

**URL:** <https://discuss.elastic.co/t/dec-6th-2021-en-using-osquery-in-elastic-stack/290456>\
**Category:** Advent Calendar\
**Created:** [December 6, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-6th-2021-en-using-osquery-in-elastic-stack/290456 "2021-12-06T08:00:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aravindputrevu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aravindputrevu/32/24816_2.png) [@aravindputrevu](https://discuss.elastic.co/u/aravindputrevu)\
**Post date:** [December 6, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-6th-2021-en-using-osquery-in-elastic-stack/290456/1 "2021-12-06T08:00:42Z")

</div>

## What is Osquery?

Osquery is a [Opensource project](https://github.com/osquery/osquery) developed from Facebook. As the name suggests, Osquery helps in querying the Operating System resources using SQL. It exposes the underlying Operating system concepts like processes, files, network like SQL tables.

You can write a simple SQL query to see the actively running processes in your system.

```
> SELECT pid, name, path FROM processes;

```

The same SQL query can be scheduled to run periodically and observe the changes in the system. This makes it easy to observe low-level operating system metrics.

## How it works?

Osquery is compatible with most Linux-based distributions, windows, and mac. Osquery can be downloaded from [here](https://osquery.io/downloads/).

Osquery has two components:

- **osqueryd**

- **osqueryi**

To talk to `osqueryd`, you can integrate the [SDK](https://osquery.readthedocs.io/en/stable/development/osquery-sdk/) from the tool of your choice.

## Using Osquery in Elastic Stack

Once you install the Osquery in your respective host system using instructions from the official docs. You need to spin up a [Elasticsearch](http://elastic.co/downloads/elasticsearch), [Kibana](http://elastic.co/downloads/kibana) & [Fleet Server](https://www.elastic.co/guide/en/fleet/current/fleet-quick-start.html) for the `osqueryd` result logs to be streamed.

There are a couple of ways to communicate with `osqueryd` and visualize the data in Elastic Stack.

- [Filebeat + OSQquery module](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-osquery.html)

- [Elastic Agent + Osquery Integration](https://docs.elastic.co/en/integrations/osquery_manager)

Once you enable the integration to run a live query, you could head over to the metrics app in the Kibana, click on the machine you want to run the query.

 ![Screenshot_2021-12-01_at_13.24.10](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea33683de167c2acb95f28fe2c2e5287874be8ab.png)

Results collected from the scheduled queries can be visualized in the "Kibana lens" & "discover" from the Osquery app under the management tab. In addition, you can add such custom osquery packs from [here](https://github.com/osquery/osquery/tree/master/packs).

 ![Screenshot_2021-12-02_at_10.52.39](https://us1.discourse-cdn.com/elastic/original/3X/e/8/e84ea93051fc8802d20ad92257dc755840aec12d.png)

Feel free to comment on this post for further questions!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2022, 8:00am UTC](https://discuss.elastic.co/t/dec-6th-2021-en-using-osquery-in-elastic-stack/290456/2 "2022-01-03T08:00:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.