# How to query list of offline agents using the Fleet API? **URL:** \ **Category:** Kibana\ **Tags:** fleet\ **Created:** [August 14, 2023, 9:48pm UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783 "2023-08-14T21:48:18Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 14, 2023, 9:48pm UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/1 "2023-08-14T21:48:18Z")
I looked at these two docs: > **[Kibana Fleet APIs | Fleet and Elastic Agent Guide \[8.9\] | Elastic](https://www.elastic.co/guide/en/fleet/8.9/fleet-api-docs.html)** > **[Fleet APIs | Fleet and Elastic Agent Guide \[8.9\] | Elastic](https://www.elastic.co/guide/en/fleet/8.9/fleet-apis.html#getAgents)** and came up with this query: ```auto curl --request GET --url 'https://mykibana/api/fleet/agents?kuery=status:offline' \ --header 'Accept: */*' \ --header 'Authorization: ApiKey mykey' \ --header 'Cache-Control: no-cache' \ --header 'Connection: keep-alive' \ --header 'Content-Type: application/json' \ --header 'kbn-xsrf: xx ``` but that returned: ```auto { "list": [], "items": [], "total": 0, "totalInactive": 0, "page": 1, "perPage": 20 } ``` What is the correct query for listing all **offline** agents? Also can someone tell me how to get the Elasticsearch schema for Fleet agents, so that I can do arbitrary queries via the `kuery` parameter? ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 14, 2023, 11:01pm UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/2 "2023-08-14T23:01:24Z")
I notice in the code for fleet: > that certain queries are being constructed: ```auto status:unenrolled status.online (status:error or status:degraded) (status:updating or status:unenrolling or status:enrolling) status:inactive ``` I don't understand how to pass those queries to the `kuery` parameter in the Fleet API ---
**Author:** ![JillG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jillg/32/122488_2.png) [@JillG](https://discuss.elastic.co/u/JillG)\ **Post date:** [August 15, 2023, 2:22pm UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/3 "2023-08-15T14:22:09Z")
Hey Craig, The `api/fleet/agents?kuery=status:offline` query should work fine. Could you share the agent statuses in the output of `api/fleet/agents`? ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 16, 2023, 6:30am UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/4 "2023-08-16T06:30:38Z")
> [@Craig\_Rodrigues](#): > > `https://mykibana/api/fleet/agents` If I just do: `https://mykibana/api/fleet/agents` I get hundreds of agents (since I am running hundreds). A bit too big to post here. One of the offline agents looks like this: ```json { "list": [ { "id": "xxx", "access_api_key_id": "xxx", "action_seq_no": [ -1 ], "active": true, "agent": { "id": "xxx", "version": "8.4.2" }, "enrolled_at": "2023-08-16T05:52:59Z", "local_metadata": { "elastic": { "agent": { "build.original": "8.4.2 (build: d3eb3e8a02d96bf48d11145fb089e118f75bd202 at 2022-09-14 22:33:40 +0000 UTC)", "id": "xxx, "log_level": "info", "snapshot": false, "upgradeable": false, "version": "8.4.2" } }, "host": { "architecture": "x86_64", "hostname": "xxx", "id": "xxx", "ip": [ "xxx" ], "mac": [ "xxx" ], "name": "xxx" }, "os": { "family": "debian", "full": "Ubuntu focal(20.04.5 LTS (Focal Fossa))", "kernel": "5.4.209-116.367.amzn2.x86_64", "name": "Ubuntu", "platform": "ubuntu", "version": "20.04.5 LTS (Focal Fossa)" } }, "policy_id": "8fab94c0-69e4-11ed-be84-13a1190e0b89", "type": "PERMANENT", "default_api_key": "xxx", "default_api_key_id": "xxx", "policy_output_permissions_hash": "dc9401abb0dfda2c534789e7b1758981eb78621b4ea9c548b40cdb3c42d351a0", "policy_revision_idx": 12, "policy_coordinator_idx": 1, "updated_at": "2023-08-16T06:19:14Z", "last_checkin_status": "degraded", "last_checkin": "2023-08-16T06:19:06Z", "policy_revision": 12, "status": "offline", "packages": [], "sort": [ 1692165179000, "xxx" ] } ] } ``` If I do: `https://mykibana/api/fleet/agents?kuery=status:offline` I get: ```json {"list":[],"items":[],"total":0,"totalInactive":0,"page":1,"perPage":20} ``` ---
**Author:** ![JillG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jillg/32/122488_2.png) [@JillG](https://discuss.elastic.co/u/JillG)\ **Post date:** [August 16, 2023, 12:59pm UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/5 "2023-08-16T12:59:51Z")
Quick check: does the query work for other status types, e.g. `status:online`? ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 16, 2023, 1:19pm UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/6 "2023-08-16T13:19:34Z")
I checked for other query times such as kuery=status:online kuery=status:degraded and those queries did not work either I don't know if it makes a difference but I am using Elastic 8.4.2 ---
**Author:** ![JillG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jillg/32/122488_2.png) [@JillG](https://discuss.elastic.co/u/JillG)\ **Post date:** [August 16, 2023, 1:48pm UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/7 "2023-08-16T13:48:32Z")
What's the output of `/api/fleet/agent_status`? ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 16, 2023, 2:46pm UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/8 "2023-08-16T14:46:26Z")
If I access /api/fleet/agent\_status I get: ```json { "results": { "total": 207, "inactive": 11861, "online": 92, "error": 9, "offline": 106, "updating": 0, "other": 11861, "events": 0 } } ``` ---
**Author:** ![JillG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jillg/32/122488_2.png) [@JillG](https://discuss.elastic.co/u/JillG)\ **Post date:** [August 17, 2023, 1:03pm UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/9 "2023-08-17T13:03:17Z")
Could you try grabbing the query from the browser's dev tools Network tab when you load the Fleet page in the UI? You can filter by agent status, although that's probably beside the point at this stage. The query will be more complex than what you need, but it would be good to validate whether that works with `curl`. ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 19, 2023, 8:16am UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/10 "2023-08-19T08:16:47Z")
On my Elastic 8.4.2 system, in the Fleet UI, if I try to select offline agents, I get a browser query (which I found in the network console) that looks like: kbn:/api/fleet/agents?page=1&perPage=20&kuery=last\_checkin%20%3C%20now-300s%20AND%20not%20((last\_checkin\_status%3Aerror%20or%20last\_checkin\_status%3Adegraded)%20AND%20not%20(((upgrade\_started\_at%3A\*)%20and%20not%20(upgraded\_at%3A\*))%20or%20(not%20(last\_checkin%3A\*))%20or%20(unenrollment\_started\_at%3A\*)))%20AND%20not%20(%20((upgrade\_started\_at%3A\*)%20and%20not%20(upgraded\_at%3A\*))%20or%20(not%20(last\_checkin%3A\*))%20or%20(unenrollment\_started\_at%3A\*)%20)&sortField=enrolled\_at&sortOrder=desc&showInactive=false&showUpgradeable=false When I executed the curl from the command-line with that query that seemed to work. However at this time, I am in the middle of de-registering all agents from this Elastic 8.4.2 system, so this query is irrelevant at this time. ---
**Author:** ![Craig\_Rodrigues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/craig_rodrigues/32/121875_2.png) [@Craig\_Rodrigues](https://discuss.elastic.co/u/Craig_Rodrigues)\ **Post date:** [August 19, 2023, 8:23am UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/11 "2023-08-19T08:23:50Z")
As an additional data point, from my Elastic 8.4.2 system where I was having this problem, I have migrated almost 2000 elastic agents to a new system running Elastic 8.9.0. On that system, if I run this query: kbn:///api/fleet/agents?kuery=status:offline this query works totally fine, and I can absolutely verify that the API response returns all offline agents. In the Fleet UI for 8.9.0, if I toggle Status -\> Offline, in the browser inspector, I see the query generated is: /api/fleet/agents?page=1&perPage=20&kuery=status%3Aoffline&sortField=enrolled\_at&sortOrder=desc&showInactive=false&showUpgradeable=false&getStatusSummary=true&withMetrics=true So even the query generated in the UI is different in 8.9.0. Without doing any deeper investigation, I can only conclude that there are some UI and API differences for Fleet between 8.4.2 and 8.9.0 that make these queries behave differently. I understand that the Fleet APIs are subject to change so that is OK. I am in the progress of migrating off of 8.4.2 to 8.9.0, so if the Fleet APIs behave more consistently there, that is fine by me. Thanks for the feedback and following up. ---
**Author:** ![JillG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jillg/32/122488_2.png) [@JillG](https://discuss.elastic.co/u/JillG)\ **Post date:** [August 21, 2023, 8:36am UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/12 "2023-08-21T08:36:03Z")
Great stuff, thanks for sharing the outcome. I'll remember to check the version sooner next time! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 18, 2023, 8:36am UTC](https://discuss.elastic.co/t/how-to-query-list-of-offline-agents-using-the-fleet-api/340783/13 "2023-09-18T08:36:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.