How-To: Data Exported is not Sorted
Last Updated: 2022-02-08
Data that's been exported to file from LogScale's UI doesn't seem to be ordered in any way, for example, by timestamp.
Solution
Exports are not ordered in the way that UI search results are. Results within the UI are sorted by default, whereas file exports are not ordered.
There are four formats for exporting files:
text/plain
CSV
application/json
application/x-ndjson
Exporting the data in CSV provides the easiest method for sorting the output once exported.
A helpful format for exporting is application/json
,
which will return the @timestamp field as an
integer (Unix time in milliseconds), whereas exporting as
text/plain
(default) will give you the raw string,
which won't include information about the time of ingest.
Read more about returning responses using the Search API for an alternative to exporting the data from the UI.
Note
Note that some options may not apply to older versions of LogScale. See release notes for more information about the version of LogScale you are using.