How-To: Data Exported is not Sorted

Last Updated: 2022-02-08

Data that's been exported to file from LogScale's UI doesn't seem to be ordered in any way, for example, by timestamp.

Solution

Exports are not ordered in the way that UI search results are. Results within the UI are sorted by default, whereas file exports are not ordered.

There are four formats for exporting files:

  • text/plain

  • CSV

  • application/json

  • application/x-ndjson

Exporting the data in CSV provides the easiest method for sorting the output once exported.

A helpful format for exporting is application/json, which will return the @timestamp field as an integer (Unix time in milliseconds), whereas exporting as text/plain (default) will give you the raw string, which won't include information about the time of ingest.

Read more about returning responses using the Search API for an alternative to exporting the data from the UI.

Note

Note that some options may not apply to older versions of LogScale. See release notes for more information about the version of LogScale you are using.