How-To: Sorting Exported Data
Issue:Data that's been exported to a file from LogScale's UI doesn't seem to be ordered in any way, for example, by the @timestamp field.
Solution
Exported data is not ordered like UI search results are - whereas UI results are sorted by default, file exports are not ordered at all.
The four formats for exporting files are:
text/plain
CSV
application/json
application/x-ndjson
Exporting the data in .CSV provides the easiest method for sorting the output once exported.
A helpful format for exporting is
application/json
, which will
return the @timestamp field as an integer (Unix
time in milliseconds), whereas exporting as
text/plain
(default) will give you
the raw string, which won't include information about the time of
ingest.
Read more about returning responses using the Search API for an alternative to exporting the data from the UI.
Note
Note that some options may not apply to older versions of LogScale. See release notes for more information about the version of LogScale you are using.