# Search Exports under Kibana (10 million documents)

**URL:** https://discuss.elastic.co/t/search-exports-under-kibana-10-million-documents/378894
**Category:** Kibana
**Created:** [June 5, 2025, 6:14am UTC](https://discuss.elastic.co/t/search-exports-under-kibana-10-million-documents/378894 "2025-06-05T06:14:57Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![smm](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@smm](https://discuss.elastic.co/u/smm)
#### Post date: [June 5, 2025, 6:14am UTC](https://discuss.elastic.co/t/search-exports-under-kibana-10-million-documents/378894/1 "2025-06-05T06:14:57Z")

</div>

Hi there,  
in an elk stack with basic licence for now (version 8.17.x), I would like to export about 10 million syslog documents out of Kibana. Is there a better way then 'export as a csv file'? Or how can I config the environment to make this task easier?  
Thanks for any input!!

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [June 5, 2025, 7:24am UTC](https://discuss.elastic.co/t/search-exports-under-kibana-10-million-documents/378894/2 "2025-06-05T07:24:01Z")

</div>

You can use Logstash I think for this.  
Otherwise, there are some community tools like

> **[GitHub - elasticsearch-dump/elasticsearch-dump: Import and export tools for elasticsearch &...](https://github.com/elasticsearch-dump/elasticsearch-dump)**
>
> Import and export tools for elasticsearch & opensearch

HTH

---

<div class="post-metadata">

### Author: ![smm](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@smm](https://discuss.elastic.co/u/smm)
#### Post date: [June 5, 2025, 8:43am UTC](https://discuss.elastic.co/t/search-exports-under-kibana-10-million-documents/378894/3 "2025-06-05T08:43:18Z")

</div>

Thanks! I also found this approach: Just using good old logstash.

input {  
elasticsearch {  
hosts =\> ["[http://elasticsearch:9200](http://elasticsearch:9200)"]  
index =\> "syslog" # Replace with your index name  
query =\> '{"query": {"match\_all": {}}}'  
size =\> 10000  
scroll =\> "5m"  
}  
}

output {  
csv {  
path =\> "/usr/share/logstash/output/syslog\_export.csv"  
fields =\> ["@timestamp", "host", "message", "severity"] # Adjust to your syslog fields  
}  
}