export

Retrieves events from a Tenzir node. The dual to import.

Synopsis

export [--live] [--retro] [--internal] [--parallel <level>]

Description

The export operator retrieves events from a Tenzir node.

--live

Work on all events that are imported with import operators in real-time instead of on events persisted at a Tenzir node.

Note that live exports may drop events if the following pipeline fails to keep up. To connect pipelines with back pressure, use the publish and subscribe operators.

--retro

Export persistent events at a Tenzir node. Unless --live is given, this is implied.

Combine --retro and --live to export past events and live events afterwards.

Experimental

There is a gap for live events that happen while past events are being exported.

--internal

Export internal events, such as metrics or diagnostics, instead. By default, export only returns events that were previously imported with import. In contrast, export --internal exports internal events such as operator metrics.

--parallel <level>

The parallel level controls how many worker threads the operator uses at most for querying historical events.

Defaults to 3.

Examples

Expose all persisted events as JSON data.

export | to stdout

Apply a filter to all persisted events, then only expose the first ten results.

export | where 1.2.3.4 | head 10 | to stdout