Export results as CSV¶
It is also possible to export the results of your search as a CSV document. To do so, click on the three dots on the right side of the search bar and select the Export as CSV option.
This will open a modal where you can choose the fields the CSV document should contain. You can also optionally specify a stream to filter the messages. Clicking on Downlaod will create the file based on the specified options and start the download.
Hint: Some Graylog inputs keep the original message in the
full_message field. If you need to export the original message, you
can do so by clicking on the List all fields link at the bottom of the sidebar, and then selecting the
Exporting results to a CSV will not preserve sorting because Graylog is using the virtual
_doc field to “sort” documents for performance reasons. If you need to have the exported data ordered you will need to either make a scroll query to ElasticSearch and process it after, or to download the file and post process it via other means.