[Visualizations][CSV] Is there a way to automate visualizations CSVs download?

I know that when you create a report, using a saved search, it's easy to automate the generation of CSVs cause the platform (Kibana) provide us a beautiful curl with the proper query and endpoint.
The problem I had with that, is that generated CSVs only supports a miximun size of 10MB, which is not sufficient for my needs, cause my need is to save selected data before I delete indices (much more data that the one I can save in 10MB). So I discarded csv generation through reports.

I've been thinking that a good approach would be saving the data I have in some visualizations, so I don't have to save all index data.
I know that when you inspect a visualization, you can get the json request and the json reponse of that visualization. I've been also reading through a lot of existing posts in differents forums, and realized that if you use a plugin or tool (such as elasticsearch-data-plugin or es2csv) with the query the visualization provides, they can download that data in a csv file. The problem is that the output is not the same one as the one we can see in the kibana UI: the output they bring is a csv with the results of a query but without the aggregation made by the visualization.

So the question is: Is there a way to get via api the following csv that the viusalization provides?
Querying the request that the visualization shows (kibana UI) does not output the same 'table' as this:

I clearly need a way to download this csv without pressing that button (Download CSV), cause I need an automated way to do it.

Hi @zaratustra689,

It's been awhile since your last post, welcome back!

I can not find any API that we have currently to do this, as you found it seems the Kibana UI request returns JSON, so an option would be to write a script to parse that into csv format.

Pinging @joelgriffith if he has any other ideas that may help you achieve this.


1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.