# Index from Elasticsearch to excel

**URL:** <https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142>\
**Category:** Logstash\
**Created:** [March 27, 2017, 1:53pm UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142 "2017-03-27T13:53:48Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![wolfghost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfghost/32/15500_2.png) [@wolfghost](https://discuss.elastic.co/u/wolfghost)\
**Post date:** [March 27, 2017, 1:53pm UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/1 "2017-03-27T13:53:48Z")

</div>

How can i export data from ES to excel file?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 27, 2017, 2:52pm UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/2 "2017-03-27T14:52:55Z")

</div>

Perhaps you should edit your post and move it to the Elasticsearch category? I don't see how this is Logstash-related.

---

<div class="post-metadata">

**Author:** ![wolfghost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfghost/32/15500_2.png) [@wolfghost](https://discuss.elastic.co/u/wolfghost)\
**Post date:** [March 28, 2017, 6:03am UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/3 "2017-03-28T06:03:00Z")

</div>

Because I am using

input {  
elasticsearch {  
hosts =\> ["localhost:9200"] index =\> "logs"  
query =\> '{  
"query": {  
"bool": {  
"must": {  
"match":{  
"\_type": "logs"  
}  
}  
}  
}  
}'  
}  
}

output {  
csv {  
fields =\> ["\_id","timestamp","\_index","severity","\_score","\_type","host","path","duration","context","component"]  
path =\> "D:/mongolog4.csv"  
}  
stdout {}  
}

And my Index looks like

March 7th 2017, 14:39:14.962 severity:I duration:6 path:C:/data/log/mongo256.log component:COMMAND host:DESKTOP-PKMSR1Q context:conn48229 content:command hgcommon.Notification command: aggregate { aggregate: "Notification", pipeline: [{ $match: { RecipientId: "194f85dd-792d-11e6-8b8f-9130e4dd6a56", Deleted: false, Important: true } }, { $sort: { \_id: -1 } }, { $limit: 10 }] } keyUpdates:0 writeConflicts:0 numYields:5219 reslen:2956 locks:{ Global: { acquireCount: { r: 10444 } }, Database: { acquireCount: { r: 5222 } }, Collection: { acquireCount: { r: 5222 } } } protocol:op\_query 100 timestamp:March 7th 2017, 14:39:14.962 \_id:AVsOXsI1sMBbPmbQNsDj \_type:logs \_index:logs \_score: -  
Link to /logs/logs/AVsOXsI1sMBbPmbQNsDj  
Table  
JSON  
t \_id AVsOXsI1sMBbPmbQNsDj  
t \_index logs

# \_score -

t \_type logs  
t component COMMAND  
t content command hgcommon.Notification command: aggregate { aggregate: "Notification", pipeline: [{ $match: { RecipientId: "194f85dd-792d-11e6-8b8f-9130e4dd6a56", Deleted: false, Important: true } }, { $sort: { \_id: -1 } }, { $limit: 10 }] } keyUpdates:0 writeConflicts:0 numYields:5219 reslen:2956 locks:{ Global: { acquireCount: { r: 10444 } }, Database: { acquireCount: { r: 5222 } }, Collection: { acquireCount: { r: 5222 } } } protocol:op\_query 100  
t context conn48229

# duration 6

t host DESKTOP-PKMSR1Q  
t path C:/data/log/mongo256.log  
t severity I  
timestamp March 7th 2017, 14:39:14.962

And its output is  
C:\ELK\logstash-5.2.2\>bin\logstash -f bin\mongo-csv.conf  
Could not find log4j2 configuration at path /ELK/logstash-5.2.2/config/log4j2.properties. Using default config which logs to console  
11:21:37.755 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>500}  
11:21:38.850 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started  
11:21:39.131 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=\>9600}  
11:21:39.522 [[main]\>worker1] INFO logstash.outputs.csv - Opening file {:path=\>"D:/mongolog4.csv"}  
2017-03-28T05:51:39.475Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.475Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.475Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.475Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}  
2017-03-28T05:51:39.491Z DESKTOP-PKMSR1Q %{message}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 28, 2017, 6:06am UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/4 "2017-03-28T06:06:09Z")

</div>

Why didn't you include all that useful information in your first post? The csv output is broken in the csv output plugin that ships with Logstash 5.2. Upgrade to at least 3.0.3. See below.

> <https://github.com/logstash-plugins/logstash-output-csv/issues/14>

---

<div class="post-metadata">

**Author:** ![wolfghost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfghost/32/15500_2.png) [@wolfghost](https://discuss.elastic.co/u/wolfghost)\
**Post date:** [March 28, 2017, 7:33am UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/5 "2017-03-28T07:33:07Z")

</div>

I installed the csv 3.0.3 but it does not change anything. I am still getting the same output.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 28, 2017, 7:33am UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/6 "2017-03-28T07:33:56Z")

</div>

That's surprising. I suggest you report your findings in the issue.

---

<div class="post-metadata">

**Author:** ![wolfghost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfghost/32/15500_2.png) [@wolfghost](https://discuss.elastic.co/u/wolfghost)\
**Post date:** [March 28, 2017, 7:37am UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/7 "2017-03-28T07:37:25Z")

</div>

Does ES have any plugin i can tryout?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 28, 2017, 7:40am UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/8 "2017-03-28T07:40:42Z")

</div>

> Does ES have any plugin i can tryout?

I don't know.

---

<div class="post-metadata">

**Author:** ![wolfghost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfghost/32/15500_2.png) [@wolfghost](https://discuss.elastic.co/u/wolfghost)\
**Post date:** [March 28, 2017, 7:48am UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/9 "2017-03-28T07:48:40Z")

</div>

Thanks for the help. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2017, 7:48am UTC](https://discuss.elastic.co/t/index-from-elasticsearch-to-excel/80142/10 "2017-04-25T07:48:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.