# Osquery exported fields

**URL:** <https://discuss.elastic.co/t/osquery-exported-fields/293608>\
**Category:** Elastic Security\
**Tags:** osquery-manager\
**Created:** [January 6, 2022, 3:40am UTC](https://discuss.elastic.co/t/osquery-exported-fields/293608 "2022-01-06T03:40:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![michaelv](https://avatars.discourse-cdn.com/v4/letter/m/90db22/32.png) [@michaelv](https://discuss.elastic.co/u/michaelv)\
**Post date:** [January 6, 2022, 3:40am UTC](https://discuss.elastic.co/t/osquery-exported-fields/293608/1 "2022-01-06T03:40:17Z")

</div>

I'm running 7.16.1 for everything.  
including elastic-agent-7.16.1-linux-x86\_64.tar.gz

I have a question on osquery exported fields.  
From this URL: [Osquery Manager | Elastic Docs](https://docs.elastic.co/en/integrations/osquery_manager#exported-fields)  
It states that fields like  
interface\_details.ibytes should be mapped as ibytes, "keyword, number.long"

When I imported it via fleet, osquery packs. With a simple  
id: interface\_details  
interval: 60  
query: select \* from interface\_details;

From the kibana gui on the retrieved data.  
All the osquery.idrops , ipackets etc are mapped as text fields.

I thought it was suppose to be mapped as number.long?  
Or am I missing something?

Regards,

Michael

---

<div class="post-metadata">

**Author:** ![michaelv](https://avatars.discourse-cdn.com/v4/letter/m/90db22/32.png) [@michaelv](https://discuss.elastic.co/u/michaelv)\
**Post date:** [January 6, 2022, 4:07am UTC](https://discuss.elastic.co/t/osquery-exported-fields/293608/2 "2022-01-06T04:07:12Z")

</div>

Sorry.. my mistake.. apparently when you visualise you actually see the value as  
osquery.ibytes  
osquery.ibytes.number

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 3, 2022, 4:07am UTC](https://discuss.elastic.co/t/osquery-exported-fields/293608/3 "2022-02-03T04:07:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.