export
Synopsis
Documentation
The export
command retrieves a subset of data according to a given query
expression. The export format must be explicitly specified:
This is easiest explained on an example:
The above command outputs line-delimited JSON like this, showing one event per line:
The above command signals the running server to export 100 events to the
export
command, and to do so continuously (i.e., not matching data that was
previously imported). Only events that have a field of type timestamp
will be
exported, and only if the timestamp in that field is older than 1 hour ago from
the current time at the node.
The default mode of operation for the export
command is historical queries,
which exports data that was already archived and indexed by the node. The
--unified
flag can be used to export both historical and continuous data.
For more information on the query expression, see the query language documentation.
Some export formats have format-specific options. For example, the pcap
export
format has a --flush-interval
option that determines after how many packets
the output is flushed to disk. A list of format-specific options can be
retrieved using the vast export <format> help
, and individual documentation is
available using vast export <format> documentation
.
export pcap
Synopsis
Documentation
The PCAP export format uses libpcap to write PCAP events as a trace.
This command only supports events of type pcap.packet
. As a result, VAST
transforms a provided query expression E
into #type == "pcap.packet" && E
.
export arrow
Synopsis
Documentation
The Arrow export format renders events in Apache Arrow, a development platform for in-memory data with bindings for many different programming languages.
Primitive VAST types are mapped to Arrow types as follows:
VAST | Arrow |
---|---|
none | NullType |
bool | BooleanType |
integer | Int64Type |
count | UInt64Type |
real | DoubleType |
time | TimestampType |
duration | Int64Type |
string | StringType |
pattern | StringType |
enumeration | Uint64Type |
address | FixedSizeBinary(16) |
subnet | FixedSizeBinary(17) |
The name of the event_type present in a record batch is encoded into the metadata field of the schema at the key "name".
For example, the below Python program reads Arrow-formatted data from stdin and prints the schema of each batch to stdout.
export null
Synopsis
Documentation
The null export format does not render its results, and is used for debugging and benchmarking only.
export json
Synopsis
Documentation
The JSON export format renders events in newline-delimited JSON (aka. JSONL).
export ascii
Synopsis
Documentation
The ASCII export format renders events according to VAST's data grammar. It merely dumps the data, without type information, and is therefore useful when digging for specific values.
export csv
Synopsis
Documentation
The export csv
command renders comma-seperatated
values in tabular form.
The first line in a CSV file contains a header that describes the field names.
The remaining lines contain concrete values. Except for the header, one line
corresponds to one event.
export zeek
Synopsis
Documentation
The Zeek export format writes events in Zeek's tab-separated value (TSV) style.