How-To: Sorting Exported Data

Issue:Data that's been exported to a file from LogScale's UI doesn't seem to be ordered in any way, for example, by the @timestamp field.

Solution

Exported data is not ordered like UI search results are - whereas UI results are sorted by default, file exports are not ordered at all.

The four formats for exporting files are:

  • text/plain

  • .CSV

  • application/json

  • application/x-ndjson

Exporting the data in .CSV provides the easiest method for sorting the output once exported.

A helpful format for exporting is application/json, which will return the @timestamp field as an integer (Unix time in milliseconds), whereas exporting as text/plain (default) will give you the raw string, which won't include information about the time of ingest.

Read more about returning responses using the Search API for an alternative to exporting the data from the UI.

Note

Note that some options may not apply to older versions of LogScale. See release notes for more information about the version of LogScale you are using.