Exporting visualizations

CSV/JSON Export

If you would like to export the documents matched by a query on an Elasticsearch index, press the 'Export' link at the bottom of the enhanced search results visualization.

image

This will display a dialog box with several options.

image

The basic options allow you to choose between CSV (Comma-separated values) and JSON export formats.

Clicking Export in the dialog will begin exporting all the documents matching a query on an Elasticsearch index in the format you have chosen.

For more control over what gets exported, click Additional settings to list some more advanced options.

By default, all fields of an index will be exported. To limit the export to a specific set of fields, click the arrow next to 'Fields'. This will display a list of all the fields in the index we’re exporting from. Simply select the checkbox next to the name of the fields you want to export.

image

The next option is to limit the number of documents to export. By default all documents matching a query on an Elasticsearch index will be exported, but this can be limited to a specific number by entering it in the 'Limit' input box.

image

When the 'Export' link at the bottom of the enhanced search results visualization is pressed, the time filter is frozen to the range of time as it is when the link is pressed. This can be refreshed by pressing the refresh icon.

Finally, when exporting as CSV, you have the option of applying field formatters to fields where they are defined. Simply press 'Yes' next to the 'Formatted' option.

image

Exporting Dashboard Visualizations

Dashboard visualizations can be exported as images or as a PDF document.

To take a snapshot of the dashboard as a PDF or to get a single visualization as an image, first click on the 'Export' button to display the export panel.

image

PDF snapshot or printing

Saving a PDF snapshot or printing is available from the export panel. Additional options are available, such as 'Include dashboard query in output' or 'Include non-graphic panels in output (e.g. tables, controls)' to include useful information when you want to create a PDF document and download it (Download as PDF) or open in a new window for printing (Print).

Note: Panels without results or panels opened in spy mode will not be included in the document.

PNG capture of visualization

image

To export a single visualization as an image, click on the camera button seen on dashboard visualizations (the button is available while the export panel is open).

The exported visualization will be saved as a PNG image.

Panels without results or panels opened in spy mode will not be available for capturing.

Avoiding issues with nginx

Some settings for nginx can interfere with the functionality of the export feature, namely the proxy_buffering directive.

To avoid any potential issues, we recommend disabling the proxy_buffering directive in your nginx configuration.

Example nginx configuration, where Siren Investigate is running behind the proxy on basePath = BASE_PATH:

location /BASE_PATH/export {
    proxy_buffering off; <---- Here is the important bit
    auth_basic                  "Restricted";
    auth_basic_user_file        /etc/nginx/passwords_enterprise;
    rewrite /kibi/(.*) /$1 break;
    proxy_pass http://127.0.0.1:15013/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
    client_max_body_size 100M;
}

location /BASE_PATH {
    auth_basic                  "Restricted";
    auth_basic_user_file        /etc/nginx/passwords_enterprise;
    rewrite /kibi/(.*) /$1 break;
    proxy_pass http://127.0.0.1:15013/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
    client_max_body_size 100M;
}