CSV Export in Kibana not showing all the records

[MaheshKumar]

Facing an issue while downloading csv file in Kibana. Followed below steps :

1. Clicked on Discover
2. Set date range of 15 days from from. It returned some ~57K records.
3. Clicked on save. Saved the report and clicked on share. generate CSV.

This CSV file has only 10K records and size is always ~10MB even if the number of records returned by search are 100K or 50K.
Is there a way to download this report of all the records returned by a query?

[flash1293 (Joe Reuter)]

It's possible you are running into the maximum file size for the CSV export: https://www.elastic.co/guide/en/kibana/current/reporting-settings-kb.html#reporting-csv-settings

You can configure it via a kibana.yml setting.

[MaheshKumar]

Thank you Joe. I made the change and works for files ~30MB but it failed to generate report for records ~108K. Threw an error "too large file"

[flash1293 (Joe Reuter)]

You are probably hitting the next limit - the CSV is stored in your Elasticsearch cluster, but there is a limit on Elasticsearch side how much you can upload at once - http.max_content_length (https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-http.html)

[MaheshKumar]

Thank you, will try that out. But that brings one more point, as you said the CSV is stored in ES cluster, it will have impact on storage. How can we delete this csv from cluster?
is it
POST /.reporting-<yyyy.mm.dd>/_delete_by_query
{ "query": { "match_all": {} } }

[flash1293 (Joe Reuter)]

Exactly, it will be part of the reporting index. You can also do it via the UI by going to Management > Reporting > Selecting the report and clicking the delete button.

[MaheshKumar]

Is this delete button introduced in version after v 7.2.0 or only for enterprise edition? I can't see it in my basic kibana 7.2.

[flash1293 (Joe Reuter)]

They got added recently (7.7): https://github.com/elastic/kibana/pull/60077