Export results

The ↓ EXPORT button in the search toolbar produces a downloaded file of the currently visible result page. Two formats are supported.

How to use it

1. Run a search that returns results.
2. Click ↓ EXPORT in the toolbar.
3. Pick either CSV or JSON from the dropdown.
4. Your browser downloads a file called <project-slug>-logs-<timestamp>.<ext>.

The button is disabled when there is nothing to export (no query has run yet), when the result is a group by chart (different shape), or during live tail (the buffer is a moving target).

What is in the CSV

A flat table with one row per event. The header row lists:

• The canonical fields: event_id, ts, ingested_at, dataset, severity, event, actor, source, message, bytes_raw
• One column per discovered payload.* key (alphabetical)

Values are RFC4180-escaped: any field containing a comma, double quote, or newline is wrapped in double quotes with internal quotes doubled up. CRLF line terminators for maximum spreadsheet compatibility.

The CSV opens cleanly in Excel, Google Sheets, Numbers, and LibreOffice Calc.

CSV-injection defence

Log values come from your game server and may contain anything a player typed in chat. A malicious chat message starting with =, +, -, @, tab, or carriage return is a known attack vector for spreadsheet apps that treat such cells as formulas.

To defuse this, every CSV cell whose first character matches that set gets a leading single-quote prefix (') before being written. When the cell is opened in a spreadsheet, the apostrophe is stripped on display and the cell shows the literal text rather than executing it as a formula.

This is invisible to legitimate users and matches OWASP guidance for CSV injection.

What is in the JSON

A JSON array of LogsEvent objects, pretty-printed with 2-space indentation. Each object matches the wire format the API returns, including the payload as a {string: string} map.

[
  {
    "event_id": "019e3f2f-...",
    "ts": "2026-05-19T07:42:08.901Z",
    "severity": "warn",
    ...
  },
  ...
]

Validates against jq and any standard JSON parser.

Scope: visible page only

Export downloads the events currently visible in the result list. Default page size is 100. If your search has 2,341 hits and you have only loaded the first 100, the export contains 100.

To export a larger page, click Load more first to grow the visible list, then EXPORT.

For full-retention bulk exports, the dashboard's exports page (under Logs ▸ Exports) does that as a separate async job. That is the right tool for "give me everything from the last 30 days for a compliance request".

Abuse protections

The button has three protections to prevent accidental or scripted spam:

• Cooldown. After a successful click the button is disabled for 1 second.
• Rate limit. At most 10 downloads per rolling 60-second window. The 11th attempt shows a red "Too many exports - wait Ns" pill next to the button until the window clears.
• Blob URL cleanup. Each new export revokes the previous one so memory does not leak even on long sessions.

These are all client-side. The export does not hit any server endpoint (everything is computed from the events already in your browser), so it does not burn API quota or trigger server-side rate limits.