Viewing the Raw "Message" Line from Filebeat for a few thousand entries

[ELKNub (Dan Williams)]

Hey Folks,

So I have Filebeat pumping from a few IIS Servers into Kibana (YAY!)

My question is this:

Once I have a filter that makes say, 100,000 log-lines filtered down into 1,000, is there a way I can output the "Message" variable (Which is basically just the raw log line) to just a bigass list either in the Kibana interface or with a CSV?

Sometimes there are items that I really just want to see the raw data on because I can't figure things out without putting my eyes on the log lines. Do I have a way to do this?

[markov00 (Marco Vettorello)]

Hi @ELKNub
You can visualize and filter your logs in Kibana from the Discover app. You can also save the search and add it directly into a dashboard
https://www.elastic.co/guide/en/kibana/current/discover.html
https://www.elastic.co/guide/en/kibana/current/field-filter.html
https://www.elastic.co/guide/en/kibana/current/save-open-search.html

[ELKNub (Dan Williams)]

So this is perfect. However, what I still am looking for is to output that result into an easily digestable form (either CSV, flatfile, or just in the UI) so I can look at it much like I would look at weblogs.

So a table of timestamp, message would be perfect.

barring that, a table of [timestamp, client.user_agent, url.path, url.query] across the filtered logs would be preferable.

Is there a place I can get this table?

[markov00 (Marco Vettorello)]

Sure, so the Discover will give you a nice table with selectable column to show. If you need to download that table as CSV you can use the Share button on the top bar and generate the CSV out of the saved search