# Osquery results don't come in: "matching app is not found for action input: osquery" **URL:** \ **Category:** Elastic Security\ **Tags:** fleet, osquery-manager\ **Created:** [December 18, 2021, 10:56am UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381 "2021-12-18T10:56:02Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![nemhods](https://avatars.discourse-cdn.com/v4/letter/n/48db29/32.png) [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Post date:** [December 18, 2021, 10:56am UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381/1 "2021-12-18T10:56:02Z")
Hey, unfortunately, I managed to break my OSQuery integrations again. A simple query like `SELECT * FROM os_version;` yields the error message `matching app is not found for action input: osquery` for most of my hosts. _Edit:_ The error message shows up in the "error" column of the query results in Kibana. I did some trial and error, and it seems that the error shows up as soon as the endpoint integration is added to the host: I have two policies that are identical except for the endpoint integration. When I assign the one with endpoint integration to the host, I get the error message. As soon as I remove the endpoint integration, osquery results work again for this host. This is the case across 7.15 and 7.16. The cluster is on 7.16.1 (incl. fleet server). Integration versions involved: - Endpoint 1.2.2 - OSquery manager 0.8.0 The logs in `C:\Program Files\Elastic\Agent\data\elastic-agent-4bcd95\logs\default\osquerybeat-json.log` don't show anything related to queries, just start/stop of the service and connecting to Elasticsearch. Any tips on where to search further? Thanks! ---
**Author:** ![aleksmaus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aleksmaus/32/56530_2.png) [@aleksmaus](https://discuss.elastic.co/u/aleksmaus)\ **Post date:** [December 20, 2021, 6:11pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381/2 "2021-12-20T18:11:00Z")
> [@nemhods](#): > > point integration to the host, I get the error message. As soon as I remove the endpoint integration, osquery results work again for this host. > > This is the case across 7.15 and 7.16. > The cluster is on 7.16.1 (incl. fleet server). Integration versions involved: > > - Endpoint 1.2.2 The " `matching app is not found for action input: osquery`" errors are reported if there is no osquerybeat active/running on the agent for any reason. So the agent doesn't have a handler app for the specified type of action: osquerybeat not running -\> nothing can handler osquery input type -\> logs error It's strange that the adding and removing the endpoint integration breaks the osquery. Seems like it could be some issue with saving the policy correctly on kibana side. I would check the raw policy before and after you add endpoint integration, possibly reload UI before that in order to avoid any possible caching on the client. You should be able to see osquery type in the policy if everything is saved correctly. If it's missing after you added the endpoint (due to the error that you mentioned when adding it), then't is possibly a bug on kibana side when adding the endpoint integration code. ![Screen Shot 2021-12-20 at 1.07.51 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f4d1bca34fef69398a1d1b1f1eaedde3a7981193.jpeg) ---
**Author:** ![nemhods](https://avatars.discourse-cdn.com/v4/letter/n/48db29/32.png) [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Post date:** [December 20, 2021, 8:25pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381/3 "2021-12-20T20:25:53Z")
Hey, thanks alot for the hint. Indeed, the actual policy was out of sync with the GUI and was missing the OSQuery Integration. I managed to fix this by stopping to mess with endpoint protection and instead removing and re-adding the osquery manager integration. I have a hunch that this situation came to be because of the new "upgrade all integrations" feature, which I used to upgrade all osquery manager integrations in all policies to 0.8.0. This operation failed, because all policies had the same name ("osquery\_manager-1"). Maybe during this, the integration was removed from the policy, but kibana thought it was still there. ---
**Author:** ![Kevin\_Logan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_logan/32/74427_2.png) [@Kevin\_Logan](https://discuss.elastic.co/u/Kevin_Logan)\ **Post date:** [December 20, 2021, 9:01pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381/4 "2021-12-20T21:01:37Z")
@nemhods Thanks for following back up and letting us know the result. For clarification on our end, when you removed and re-added the OSQuery integration, did it start to work again with Endpoint Security on the same Policy? Or are you still encountering the problem where you cannot have both OSQuery and Endpoint Security on the same Policy? ---
**Author:** ![nemhods](https://avatars.discourse-cdn.com/v4/letter/n/48db29/32.png) [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Post date:** [December 20, 2021, 9:21pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381/5 "2021-12-20T21:21:01Z")
Hey, no, endpoint security seems to be fine. When I was troubleshooting, I had two policies which i _assumed_ to be the same except for the endpoint integration, thus I though this was the cause. The true difference between the two policies was that one still had the osquery manager integration intact. Come to think of it: I think the policy that still worked was the only policy that also had a successful mass-upgrade of the osquery manager integration. I can't prove it, but I suspect that the upgrades failing halfway through might have been the culprit for all the other policies. ---
**Author:** ![patrykkopycinski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrykkopycinski/32/45595_2.png) [@patrykkopycinski](https://discuss.elastic.co/u/patrykkopycinski)\ **Post date:** [December 20, 2021, 10:13pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381/6 "2021-12-20T22:13:00Z")
Hey @nemhods, it seems that currently, we are having issues with upgrading `osquery_manager` integration. From my small investigation, I have found out that after the migration, the agent policy doesn't contain an `osquery` input anymore which is necessary to be able to operate `osquery` properly. As a workaround, I can offer for now to remove and add `osquery_manager` integration to the affected policies (if you had any packs applied to those policies they need to be re-applied as well) Please let me know if that helped ---
**Author:** ![nemhods](https://avatars.discourse-cdn.com/v4/letter/n/48db29/32.png) [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Post date:** [December 20, 2021, 11:14pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381/7 "2021-12-20T23:14:45Z")
Hey, that makes sense. Thanks for the heads up! I have already re-added all osquery\_manager integrations. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 17, 2022, 11:15pm UTC](https://discuss.elastic.co/t/osquery-results-dont-come-in-matching-app-is-not-found-for-action-input-osquery/292381/8 "2022-01-17T23:15:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.