Reporting the most common log errors

[twall]

I'm trying to understand what's involved in obtaining the "Quick Counts" in kibana for a given "selected field". For example, my "message" field nominally represents logged errors, and the "Quick Counts" is more or less a representation of the most common errors.

I'd like to export a snapshot of this for inclusion in a different automated report.

[tbragin (Tanya Bragin)]

"Quick Count" is just based on the first 500 records returned in the Discover tab. It's meant to give you a preview of the types of values in each field based on a small portion of the total data set.

@twall

I'd like to export a snapshot of this for inclusion in a different automated report.

If you'd like to see and export the most common errors, I'd recommend using Data Table in Visualize and running a Terms aggregation on the whole data set (or the portion you're interested in). There, you can also modify how many top N to return (default is 5). After that, you can export that table to CSV right from Visualize.