Exports

An export is a one-shot download of every log event matching a query, in CSV or NDJSON format. Exports run in the background: queue one, get an email when it's ready, download via a presigned link.

The fast EXPORT button next to the search bar still works for grabbing the current visible page as CSV or JSON. Bulk exports are different: they run server-side, hit the full retention window (not just what's on screen), and can return millions of rows.

When to use which

Queueing an export

From the exports page (Logs ▸ Exports) or directly via Search ▸ EXPORT ▸ "BULK EXPORT (FULL RANGE)":

1. QUERY: same syntax as Search. Empty matches everything in the window.
2. TIME WINDOW: how far back to scan. 1H, 24H, 7D, or 30D.
3. FORMAT: CSV or NDJSON.
4. NAME (optional): we generate one if blank.

The form runs a cheap pre-flight count against your query as you type and shows the row count, estimated file size, and rough duration before you queue. If the count exceeds your plan's row cap, the QUEUE button is disabled and a banner tells you to narrow the predicate.

Heads-up about payloads. Exports include the full payload of every matching event verbatim. If your server logs secrets (API keys, tokens, raw passwords), they end up in the downloaded file. Treat exports like you would a database dump.

Formats

• CSV (RFC 4180): one header row, then one data row per event. Payload fields are JSON-encoded into a single payload column.
• NDJSON: one JSON object per line. Easier to feed into jq, DuckDB, or your own pipeline.

PARQUET is on the roadmap for a future version. Schedules (e.g., "rerun every Monday") are also planned.

Plan caps

Exports are subject to three caps that protect both our query backend and your wallet:

If you hit the row cap, narrow the predicate or shrink the time window. If you hit the concurrent or daily cap, wait for in-flight exports to roll off (or upgrade).

Status lifecycle

• QUEUED: waiting for the worker to pick it up. Workers tick every 30 seconds.
• RUNNING: your slice is being assembled and uploaded to storage.
• READY: file is ready; download link valid for 7 days.
• FAILED: something broke. The row shows a truncated error and a RETRY link that takes you back to the form with your query prefilled.
• EXPIRED: 7-day TTL elapsed; the file is gone. Re-queue if you still need it.

The exports page polls every 5 seconds while anything is queued or running, then stops once everything has settled.

Revoking a download

Click the ✕ next to a READY or FAILED row to delete the export immediately. The download link stops working straight away and the file is removed from storage. Use this if you exported the wrong data, shared the link in the wrong place, or want to clean up before the 7-day TTL.

Running and queued exports can't be deleted; wait for them to finish (or fail) first.

Download links

Download URLs are signed for 7 days. We regenerate the link every time you reload the export's detail page, so an older copy of the link still works on its original expiry, and a fresh page-load gives you a fresh full-7-day window.

Treat the link as sensitive: anyone with the URL can download the file until it expires. Don't paste it into shared Discord channels or public pastes.

Email notification

When an export reaches READY (or FAILED), we email the user who queued it. The email links back to the exports index, where the download button uses the fresh per-request presigned URL.

API

POST /v1/logs/exports/estimate
POST /v1/logs/exports
GET  /v1/logs/exports
GET  /v1/logs/exports/{id}

See the OpenAPI reference for the full schema. The same three caps apply when you hit the API directly.