Easily Export Kibana Search Results to CSV/Excel file

Last Updated:

How can i easily export Kibana search results to CSV/Excel file? Well, that is an easy thing to do! Follow through this guide to learn how to export Kibana search results to CSV/Excel file. Kibana provides an awesome way to visualize and explore your Elasticsearch data. Additionally, it can enable you to export saved searches result, metrics and raw documents of your analysis into a CSV file. This comes in handy if you want to share the report of your analysis to someone else who might not have access to Kibana dashboard.

Exporting Kibana Search Results to CSV/Excel file

Grant User Access to Reporting Feature in Kibana

Before you can proceed, ensure that at least you have read access to the specific index you want to export the search results from.

Similarly, ensure that you have access to reporting on Kibana as extensively described here.

Perform a Search on Kibana

Next, navigate to Kibana Discover and select an index from which you want to search your specific events from and adjust your search time range accordingly.

adjust search time range

Run your search query to filter specific events. For example, let’s perform a failed SSH authentication event search;

event.category: "authentication" AND event.action: "ssh_login" AND event.outcome: "failure"

As you can see, for the time range of last 30 days, I got 116 hits;

search results for last 30 days

Next, you can choose to export the events the way they are, if you are sharing them to a technical person, otherwise, it is good to select specifics of the events, (if any) so you can export a more clean report.

For my SSH authentication events, we have quite a number of fields that might be of interest such as the source address, destination, username, time, event activity, method of authentication and event result. You can choose to display those specific fields;

curated events

You can hit the Save button at the top left menu to save your search query.

Export Kibana Search Results to CSV/Excel file

Once you have searched and filtered your events on Kibana, you can now go ahead and export the results to CSV/excel.

Note the the default size of CSV supported for export by default is 10mb. If you are exporting huge search results that could possibly go beyond 10mb, then you might need to adjust the value of xpack.reporting.csv.maxSizeBytes on Kibana as well the http.max_content_length setting in Elasticsearch. While doing this, take into consideration the amount of system resources, especially RAM, assigned to your server. This is so as to ensure that the performance of Kibana and your Elasticsearch cluster is not negatively affected.

Assuming all is good, click the Share button on the Discover top menu options (with your search filter and results still on), and click CSV Reports.

share search results

Next, click Generate CSV. Note that depending on the size of your search it can take sometime to generate.

When report generation is complete, you will be notified on Kibana dashboard to check and download it.

Similarly, you can track the report generation progress in Stack Management > Alerts and Insights > Reporting section.

Export Kibana Search Results to CSV/Excel file

Download Kibana Search Results in CSV Format

As you can see above, the report is now ready and available for download.

Under Actions, there are two options; Download and View additional information about the report.

Click the down facing arrow to download your report to your system, in CSV format.

Open Kibana Search Results CSV on Excel

You should now be able to read the CSV export of your results using any Excel software.

See my LibreOffice Calc;

kibana search results csv

Awesome, isn’t it? You can share the report with the “management” now!

Other Tutorials

How to Copy Kibana Dashboard to Another Kibana Space

Install Wazuh Manager with ELK on Debian 12

Quick Way to Enable Kibana HTTPS Connection


We're passionate about sharing our knowledge and experiences with you through our blog. If you appreciate our efforts, consider buying us a virtual coffee. Your support keeps us motivated and enables us to continually improve, ensuring that we can provide you with the best content possible. Thank you for being a coffee-fueled champion of our work!

Photo of author
Linux Certified Engineer, with a passion for open-source technology and a strong understanding of Linux systems. With experience in system administration, troubleshooting, and automation, I am skilled in maintaining and optimizing Linux infrastructure.

Leave a Comment