Export from Discovery to CSV

Elastic Stack Elasticsearch
1

I have an ESQL search that outputs a list of unique IP addresses.
When I Share to CSV, I'm getting "CSV may contain formulas, The report contains characters which spreadsheet applications can interpret as formulas.

When I open the CSV file, instead of a list of IP addresses, each row just has a hyphen instead any actual data.

It appears like this:

count,ip
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"
"-","-"

2

Thanks for reaching out @sourcreamnormanbates, I have a few follow up questions here.

  • Do you have a code sample by chance you can share?
  • What does it look like inside of the console?
3

Here is the query I'm running:

from SMTPReceiveLogs*
| where data like "MAIL FROM*"
| rename remote-endpoint as remote
| dissect remote "%{ip}:%{port}"
| stats count = count(ip) by ip
| sort ip

Here's what the output looks like.
IP-Output

4

Thanks for following up with more infomation. Have you tried running the query from the console but specifying the format as CSV? If so, does it also return with blank values?

In the console the query you sent over would look something like this:

POST _query?format=csv 
{
  "query": """
from SMTPReceiveLogs*
| where data like "MAIL FROM*"
| rename remote-endpoint as remote
| dissect remote "%{ip}:%{port}"
| stats count = count(ip) by ip
| sort ip
  """
}

Best,
Jessica

5

I had not tried that, but that worked!
Thanks.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.