export command retrieves a subset of data according to a given query
expression. The export format must be explicitly specified:
This is easiest explained on an example:
The above command outputs line-delimited JSON like this, showing one event per line:
The above command signals the running server to export 100 events to the
export command, and to do so continuously (i.e., not matching data that was
previously imported). Only events that have a field of type
timestamp will be
exported, and only if the timestamp in that field is older than 1 hour ago from
the current time at the node.
The default mode of operation for the
export command is historical queries,
which exports data that was already archived and indexed by the node. The
--unified flag can be used to export both historical and continuous data.
For more information on the query expression, see the query language documentation.
Some export formats have format-specific options. For example, the
format has a
--flush-interval option that determines after how many packets
the output is flushed to disk. A list of format-specific options can be
retrieved using the
vast export <format> help, and individual documentation is
vast export <format> documentation.
The PCAP export format uses libpcap to write PCAP events as a trace.
This command only supports events of type
pcap.packet. As a result, VAST
transforms a provided query expression
#type == "pcap.packet" && E.
The Arrow export format renders events in Apache Arrow, a development platform for in-memory data with bindings for many different programming languages.
Primitive VAST types are mapped to Arrow types as follows:
The name of the event_type present in a record batch is encoded into the metadata field of the schema at the key "name".
For example, the below Python program reads Arrow-formatted data from stdin and prints the schema of each batch to stdout.
The null export format does not render its results, and is used for debugging and benchmarking only.
The JSON export format renders events in newline-delimited JSON (aka. JSONL).
The ASCII export format renders events according to VAST's data grammar. It merely dumps the data, without type information, and is therefore useful when digging for specific values.
export csv command renders comma-seperatated
values in tabular form.
The first line in a CSV file contains a header that describes the field names.
The remaining lines contain concrete values. Except for the header, one line
corresponds to one event.
The Zeek export format writes events in Zeek's tab-separated value (TSV) style.