Export table?

[BanditBBS]

Am I blind or is there now way to export a table to csv or some other format?

[jolson]

You are correct - there is currently no way to export information to a table/csv format. The best you can do at the moment is to use the elasticsearch API to query and get raw data back.

This is a highly requested feature, and it will be added in a future release when our developers come up with a solution. The next release is likely to contain user granularity, which means this issue is second in-line in terms of priority.

[BanditBBS]

"Your unique API key used for external API access. You can read more about what you can do with the API in the API documents in the help section."

I see no API section in the help section.

[jolson]

You can query the API directly via the command line if you'd like - that way you don't need to involve the API key.

Example query:

Code: Select all

    curl -XPOST "http://localhost:9200/_search?pretty" -d'
    {
        "fields": ["user", "message", "type"],
        "query": {
            "filtered": {
               "filter": {
                  "range": {
                      "@timestamp": {
                       "from": "now-5m",
                                    "to": "now"
                           }
                            }
                        },
                    "query": {
                       "query_string": {
                        "query": "syslog"
                    }
                }
            }
        }
    }'

You can change the 'from' field and the 'query' field as necessary - for instance:

Code: Select all

    curl -XPOST "http://localhost:9200/_search?pretty" -d'
    {
        "fields": ["user", "message", "type"],
        "query": {
            "filtered": {
               "filter": {
                  "range": {
                      "@timestamp": {
                       "from": "now-24h",
                                    "to": "now"
                           }
                            }
                        },
                    "query": {
                       "query_string": {
                        "query": "type:syslog"
                    }
                }
            }
        }
    }'

You can also add and remove fields you'd like to see from the 'fields' section, like so:

Code: Select all

"fields": ["user", "@timestamp"],

Hopefully this is enough to get you started - the API key can be used to query externally (from a different server, for instance).

You can read more about what you can do with the API in the API documents in the help section

It seems that this is misleading - I'll bring it up to our developers. Thank you!

Jesse