Easiest way to export query results for importing to an independent elasticsearch instance

Hi,

Our customer is running our application on premise in his own datacenter. If there are any issues / bugs, we ask him for grepping information from logfiles and to deliver these snippets to us for analysis and bugfixing.
We want to introduce elastic stack to enable him to quickly search application's logs for errors, stacktraces, etc. for the effected user and to share these results to us.

It will not be possible that we can access our customer's kibana on our own for analysis.

I played a bit with csv export, but I encountered following issues:

  • Excel or open office is not suitable to view the long field values. Some fields are storing an xml request which has > 500 lines. Excel is limiting on 500 lines in viewport of a cell.
  • Excel seems to rotate to a new row in the middle of an xml statement. I haven't checked yet, if there are some special chars in one of our exported fields which collide with excel's interpretation of csv and newlines.

So I think using kibana or a json export would be the best for our developers to use.

Questions:

  • Is there any json export available, which is equivalent to the csv export of kibana searches?
  • Are there any other "very easy to use ideas to export results of a search which can easily be imported to an elastic instance on developer's side? Additionally it must be mentioned that I need some text output, no binary data. The customer needs to be able to see exactly what he is sending to us and must have the possibility to remove / annonymize personal data, e.g. with a text editor.

Or is a script which queries elasticsearch the only way to achieve this?

Thanks, Andreas

If the customer's CSV file is smaller than 100mb it might be feasible to import it into a different Elasticsearch instance using the experimental Data Visualizer tool under Machine Learning.

The results from Elasticsearch come back as JSON. You can use the Inspect button in Discover or Visualizations to see these results. But I think you'd still need to transform this JSON data to get it back into Elasticsearch.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.