Export API

This section describes the export feature of the Query Jobs API. The Export API is an addition to the Query Jobs API which enables clients to export query results in one of the supported MIME types. If the API is not used, the endpoint behaves as usual.

The Export API enables you to export the query result, by specifying the wanted MIME type in a request. The request then returns the events of the query result in the specified format. Behaviour is controlled using URI query parameters.

Contrary to typical usage of the Query Jobs API, no metadata is returned with the events when using the export feature. Notably, requesting an export of the query results causes all other parameters, such as those of the Pagination API to be ignored, with the exception of the onlyHeartbeat parameter of the Pagination API, which takes precedence over an export request.

The API has the following parameters:

Parameter	Type	Valid Values	Description
`mimeType`	String	`application/json`, `application/x-ndjson`, `text/csv`, `text/plain`	Determines the format in which the results are returned.
`fieldsToExport`	String	CSV-like list of field names, for example: `class`,`method`,`_count`	Determines the fields to export when exporting events in the CSV format. Must be specified when `mimeType=text/csv` is the requested format.

Requests are made using GET requests to the following endpoint:

HTTP

GET /api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID

You specify the repository name, and the ID for the query job you are polling for results as part of the URL. You also specify query parameters as described in the previous table.

Using the Export API

In the simplest case for using the Export API, you would only specify an argument to the mimeType query parameter.

Note

All argument values must be percent-encoded.

Requesting the results in JSON format is shown in the following example:

Show:

shell

curl -v -X GET https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?mimeType=application%2Fjson \
    -H "Accept: application/json" \
    -H "Authorization: Bearer $TOKEN"

shell

curl -v -X GET https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?mimeType=application%2Fjson \
    -H "Accept: application/json" \
    -H "Authorization: Bearer $TOKEN"

shell

curl -v -X GET https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?mimeType=application%2Fjson ^
    -H "Accept: application/json" ^
    -H "Authorization: Bearer $TOKEN"

powershell

curl.exe -X GET 
    -H "Accept: application/json"
    -H "Authorization: Bearer $TOKEN"
    "https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?mimeType=application%2Fjson"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = 'https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?mimeType=application%2Fjson';

my $req = HTTP::Request->new("GET", $uri );

$req->header("Accept" => "application/json");
$req->header("Authorization" => "Bearer $TOKEN");


my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = 'https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?mimeType=application%2Fjson'

resp = requests.get(url,
                     headers = {
   "Accept" : "application/json",
   "Authorization" : "Bearer $TOKEN"
}
)

print(resp.text)

javascript

const https = require('https');

let request = https.get('https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?mimeType=application%2Fjson', (res) => {
  if (res.statusCode !== 200) {
    console.error(`Error from server. Code: ${res.statusCode}`);
    res.resume();
    return;
  }

  let data = '';

  res.on('data', (chunk) => {
    data += chunk;
  });

  res.on('close', () => {
    console.log('Response:');
    console.log(JSON.parse(data));
  });
});

    return(undef,undef);
}

For exporting as CSV, you need to specify the header — that is, the fields that you want to export using the fieldsToExport parameter. For example, to export the class, method, and _count fields from each event as CSV, you would use the following request:

Show:

shell

curl -v -X GET https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?fieldsToExport=class,method,_count&mimeType=text%2Fcsv \
    -H "Accept: text/csv" \
    -H "Authorization: Bearer $TOKEN"

shell

curl -v -X GET https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?fieldsToExport=class,method,_count&mimeType=text%2Fcsv \
    -H "Accept: text/csv" \
    -H "Authorization: Bearer $TOKEN"

shell

curl -v -X GET https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?fieldsToExport=class,method,_count&mimeType=text%2Fcsv ^
    -H "Accept: text/csv" ^
    -H "Authorization: Bearer $TOKEN"

powershell

curl.exe -X GET 
    -H "Accept: text/csv"
    -H "Authorization: Bearer $TOKEN"
    "https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?fieldsToExport=class,method,_count&mimeType=text%2Fcsv"

perl

#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $INGEST_TOKEN = "TOKEN";

my $uri = 'https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?fieldsToExport=class,method,_count&mimeType=text%2Fcsv';

my $req = HTTP::Request->new("GET", $uri );

$req->header("Accept" => "text/csv");
$req->header("Authorization" => "Bearer $TOKEN");


my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";

python

#! /usr/local/bin/python3

import requests

url = 'https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?fieldsToExport=class,method,_count&mimeType=text%2Fcsv'

resp = requests.get(url,
                     headers = {
   "Accept" : "text/csv",
   "Authorization" : "Bearer $TOKEN"
}
)

print(resp.text)

javascript

const https = require('https');

let request = https.get('https://$YOUR_LOGSCALE_URL/api/v1/repositories/$REPOSITORY_NAME/queryjobs/$QUERY_JOB_ID?fieldsToExport=class,method,_count&mimeType=text%2Fcsv', (res) => {
  if (res.statusCode !== 200) {
    console.error(`Error from server. Code: ${res.statusCode}`);
    res.resume();
    return;
  }

  let data = '';

  res.on('data', (chunk) => {
    data += chunk;
  });

  res.on('close', () => {
    console.log('Response:');
    console.log(JSON.parse(data));
  });
});

    return(undef,undef);
}

APIs

API Authentication

Cluster Management API

Health Check API

Ingest API

Lookup API

Redact Events API

Search API

Packages API

Software Libraries

Export API

Using the Export API

Note

Enter search term