Exporting Saved Search Data

Elastic Stack Kibana
1

Hi everyone,

I am currently working on an excel export tool. I am fairly new to elasticsearch, and right now I am trying to figure out how to programmatically export the data tied to my saved searches in kibana. Does anyone have any experience with this, and could possibly give some advice?

Thanks in advance,
Joey

1 Like
2

I'm afraid I don't really understand what you are asking for. When you say "data tied to my saved searches", what do you mean? The records you see in Discover, for instance, and just the documents in Elasticsearch, converted from a JSON format to an HTML table. If that's all you need, you can just query Elasticsearch directly. Is that what you're asking for?

3

Hi Joe,

Apologies, I am still quite new to Elasticsearch and the Elastic Stack in general.

I am an intern trying to build an application that will let our users export the data that populates the discover tab when they open a saved search (request is made externally from Kibana itself).

example: The user logs into our products admin console, selects a time frame, project, and a saved search that already exists in the selected project. The user is then able to export the data to a .csv file (whatever data appears in the discover tab using the selected project, saved search, and time-frame).

Is there a way to return the saved searches that exist within a project, and if so, can I extract the request made from a specific saved search?

Thank you for your reply, I hope this makes a little more sense now. If I'm just shouting non-sense, feel free to tell me :slight_smile:

Kind Regards,
Joey

4

Is there a way to return the saved searches that exist within a project
can I extract the request made from a specific saved search?

Yes and yes.

You can query Elasticsearch directly, they are simply records in the Kibana index (.kibana by default) with a type of saved_search. The JSON in those documents defined the saved search, which includes any filters and queries that are being used.

If you want to use the UI, you can navigate to Management > Saved Objects and select the Saved Searches tab. You can even export them as JSON from there if you'd like to.

Once you know the query, you can execute it yourself against Elasticsearch to get the matching documents in JSON format.

As an alternative, you could scrape the screen you see in discover and "export" your data that way. There's an old Kibana plugin called es-csv-exporter that did exactly this. You could do the same in Kibana 5, using a custom plugin and writing it as a "hack". You could add a button to the top nav that would kick off a function that would scrape data out of Discover and could even serve it up as a CSV file for you.

If that's something you're interested in trying to do, we have a plugin template you can use to help you get started.

Also, we have CSV export coming in a future release of Kibana, as part of our X-Pack offering.

Sorry for all the tangents. Hopefully this was helpful.

1 Like
5

Joe,

Beautiful! Thank you for all of the information, this answered my question perfectly!

No need to apologize for the tangents, I enjoy soaking in as much information as I can from smart people like yourself :smile: I'll have to start delving into all of the available options, and I certainly look forward to your CSV export feature!

Have a wonderful week, thanks again!
Joey

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.