# Viewing the Raw "Message" Line from Filebeat for a few thousand entries **URL:** \ **Category:** Kibana\ **Created:** [October 28, 2019, 3:55pm UTC](https://discuss.elastic.co/t/viewing-the-raw-message-line-from-filebeat-for-a-few-thousand-entries/205508 "2019-10-28T15:55:14Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ELKNub](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@ELKNub](https://discuss.elastic.co/u/ELKNub)\ **Post date:** [October 28, 2019, 3:55pm UTC](https://discuss.elastic.co/t/viewing-the-raw-message-line-from-filebeat-for-a-few-thousand-entries/205508/1 "2019-10-28T15:55:14Z")
Hey Folks, So I have Filebeat pumping from a few IIS Servers into Kibana (YAY!) My question is this: Once I have a filter that makes say, 100,000 log-lines filtered down into 1,000, is there a way I can output the "Message" variable (Which is basically just the raw log line) to just a bigass list either in the Kibana interface or with a CSV? Sometimes there are items that I really just want to see the raw data on because I can't figure things out without putting my eyes on the log lines. Do I have a way to do this? ---
**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\ **Post date:** [October 29, 2019, 9:53am UTC](https://discuss.elastic.co/t/viewing-the-raw-message-line-from-filebeat-for-a-few-thousand-entries/205508/2 "2019-10-29T09:53:18Z")
Hi @ELKNub You can visualize and filter your logs in Kibana from the Discover app. You can also save the search and add it directly into a dashboard [https://www.elastic.co/guide/en/kibana/current/discover.html](https://www.elastic.co/guide/en/kibana/current/discover.html) [https://www.elastic.co/guide/en/kibana/current/field-filter.html](https://www.elastic.co/guide/en/kibana/current/field-filter.html) [https://www.elastic.co/guide/en/kibana/current/save-open-search.html](https://www.elastic.co/guide/en/kibana/current/save-open-search.html) ---
**Author:** ![ELKNub](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@ELKNub](https://discuss.elastic.co/u/ELKNub)\ **Post date:** [October 30, 2019, 1:12am UTC](https://discuss.elastic.co/t/viewing-the-raw-message-line-from-filebeat-for-a-few-thousand-entries/205508/3 "2019-10-30T01:12:28Z")
So this is perfect. However, what I still am looking for is to output that result into an easily digestable form (either CSV, flatfile, or just in the UI) so I can look at it much like I would look at weblogs. So a table of timestamp, message would be perfect. barring that, a table of [timestamp, client.user\_agent, url.path, url.query] across the filtered logs would be preferable. Is there a place I can get this table? ---
**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\ **Post date:** [October 30, 2019, 7:58pm UTC](https://discuss.elastic.co/t/viewing-the-raw-message-line-from-filebeat-for-a-few-thousand-entries/205508/4 "2019-10-30T19:58:53Z")
Sure, so the Discover will give you a nice table with selectable column to show. If you need to download that table as CSV you can use the `Share` button on the top bar and generate the CSV out of the saved search ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 27, 2019, 7:58pm UTC](https://discuss.elastic.co/t/viewing-the-raw-message-line-from-filebeat-for-a-few-thousand-entries/205508/5 "2019-11-27T19:58:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.