Page 1 of 1
Export table?
Posted: Wed Feb 24, 2016 2:09 pm
by BanditBBS
Am I blind or is there now way to export a table to csv or some other format?
Re: Export table?
Posted: Wed Feb 24, 2016 3:00 pm
by jolson
You are correct - there is currently no way to export information to a table/csv format. The best you can do at the moment is to use the elasticsearch API to query and get raw data back.
This is a highly requested feature, and it will be added in a future release when our developers come up with a solution. The next release is likely to contain user granularity, which means this issue is second in-line in terms of priority.
Re: Export table?
Posted: Wed Feb 24, 2016 3:13 pm
by BanditBBS
"Your unique API key used for external API access. You can read more about what you can do with the API in the API documents in the help section."
I see no API section in the help section.
Re: Export table?
Posted: Wed Feb 24, 2016 3:23 pm
by jolson
You can query the API directly via the command line if you'd like - that way you don't need to involve the API key.
Example query:
Code: Select all
curl -XPOST "http://localhost:9200/_search?pretty" -d'
{
"fields": ["user", "message", "type"],
"query": {
"filtered": {
"filter": {
"range": {
"@timestamp": {
"from": "now-5m",
"to": "now"
}
}
},
"query": {
"query_string": {
"query": "syslog"
}
}
}
}
}'
You can change the 'from' field and the 'query' field as necessary - for instance:
Code: Select all
curl -XPOST "http://localhost:9200/_search?pretty" -d'
{
"fields": ["user", "message", "type"],
"query": {
"filtered": {
"filter": {
"range": {
"@timestamp": {
"from": "now-24h",
"to": "now"
}
}
},
"query": {
"query_string": {
"query": "type:syslog"
}
}
}
}
}'
You can also add and remove fields you'd like to see from the 'fields' section, like so:
Hopefully this is enough to get you started - the API key can be used to query externally (from a different server, for instance).
You can read more about what you can do with the API in the API documents in the help section
It seems that this is misleading - I'll bring it up to our developers. Thank you!
Jesse