--- title: Export data description: Download Explore query results (logs, spans, traces, templates, or Overview aggregations) as a CSV, TSV, or JSON file for spreadsheet analysis, downstream tooling, archival, or sharing with teammates outside Coralogix. url: https://coralogix.com/docs/user-guides/data_exploration/export/ product: data-exploration feature: Explorer v2 feature_id: explorer-v2 feature_identifier: data-exploration/explorer-v2 last_updated: '2026-10-29' --- # Export data Export data downloads the results of an Explore query as a CSV, TSV, or JSON file. The same export drawer is available from every grid in Explore (the **Logs** and **Spans** tabs, the **Traces** and **Templates** tabs, and the **Overview** tab that renders aggregated rows when your query includes a Group By) so you can share investigation results outside Coralogix, run analysis in spreadsheets or notebooks, feed downstream tooling that consumes JSON, archive a snapshot for compliance, or hand off samples to teammates without a Coralogix login. [![Exporting Explore results: the Export data dialog with Field selection, Format, and Export record limit, then selecting Export](/docs/assets/images/export-data-f5cb26a18c93bbd87e4a433f8efe7a91.webp)](https://coralogix.com/docs/assets/images/export-data-f5cb26a18c93bbd87e4a433f8efe7a91.webp) ## Choose which fields to export The **Field selection** control sets which fields each record includes: * **All fields** (the default): each record includes all raw data fields. Good for analysis, archival, or downstream tooling; the file is denser and not optimized for spreadsheets, and JSON is the most natural format for it. * **Selected grid fields**: only the fields currently selected in the grid, for a clean file shaped by what's on screen. An **Export preview** line under the controls sums up what the file will contain: how many rows, whether it holds all fields or only your selected columns, and the format. ## Where to export from | Surface | What gets exported | How it runs | Formats | | ----------------- | --------------------------------------------------------------------- | ------------------------------------------------------- | -------------- | | **Logs** tab | Logs matching your current query and time range, up to 50,000 rows | Server-side export through the Coralogix export service | CSV, TSV, JSON | | **Spans** tab | Spans matching your current query and time range, up to 50,000 rows | Server-side export through the Coralogix export service | CSV, TSV, JSON | | **Traces** tab | The traces currently loaded in the grid | Client-side export of the rows on screen | CSV, TSV | | **Templates** tab | The templates currently loaded in the grid | Client-side export of the rows on screen | CSV, TSV | | **Overview** tab | The aggregated grid rows as displayed (not the raw underlying events) | Client-side export of the rows on screen | CSV, TSV | The **Logs** and **Spans** exports run against the backend, so they include every matching record up to the export cap regardless of grid paging. The **Traces**, **Templates**, and **Overview** exports run client-side and include only the rows already loaded into the grid. Scroll or load more before exporting if you need additional rows. Client-side exports support **CSV** and **TSV** only; JSON is exclusive to the server-side Logs and Spans exports. ### Export from the Overview tab The **Overview** tab opens whenever your query produces grouped or aggregated results, that is, when the query includes: * An aggregation (for example, `count`, `sum`, `avg`). * A grouping (a **Grouped by** clause in Builder mode, or a `groupby` operator in DataPrime mode). * Both an aggregation and a grouping. The Overview tab renders the resulting rows in a grid, and the Export button at the top of that grid downloads those rows as **CSV** or **TSV**. The export reflects the grid exactly as displayed (column names and values match what you see on screen) not the raw underlying events that produced the aggregation. ### Export from the DataPrime Results table DataPrime queries land in a single **Results** tab (the Builder-mode tabs aren't shown), but the export drawer routes through the same paths: * A **non-aggregation** DataPrime query (no `groupby … aggregate …`) exports server-side, the same as the **Logs** or **Spans** tab, CSV, TSV, or JSON, up to 50,000 rows. * An **aggregation** DataPrime query also exports server-side. CSV, TSV, or JSON, up to 50,000 rows. The server re-runs the aggregation for the export, so (unlike the **Overview** tab) the file isn't limited to the rows currently loaded in the grid. Open **Export** from the top-right of the Results table to open the same dialog used by the Builder-mode surfaces. ## How to export 1. Run a query so the grid contains the logs or spans you want. 2. Open **Export** from the right corner. 3. Set the **Field selection**: **All fields** for every raw field, or **Selected grid fields** for just the columns in the grid. 4. Choose a format: **CSV**, **TSV**, or **JSON**. 5. Adjust the **Export record limit** if needed. It opens on the number of records your query returned; raising it re-runs the query, so results may change and the export takes longer, up to the 50,000-record cap. 6. Select **Export**. The file downloads to your browser. Default columns differ by tab: * The **Logs** tab defaults to exporting `Timestamp`, `Source`, `Application`, and `Subsystem`. * The **Spans** tab defaults to exporting `Timestamp`, `Service`, `Operation`, `Duration`, and `Span ID`. Add or remove columns under **Columns to export** before you export. The dialog suggests a default file name in the format `Export_DD-MM-YYYY` (for example, `Export_22-06-2026`). To customize it, enter letters, numbers, and `.`, `_`, or `-` only, up to 255 characters. Other characters show the error `Only letters, numbers, and the characters . _ - are allowed` and the **Export** button stays inactive until you fix the name. ### Set the timestamp format When you export **Selected grid fields**, a **Date format** control sets how the `Timestamp` column is written to the file: * **ISO 8601 datetime** (the default): a readable timestamp in the form `YYYY-MM-DDTHH:mm:ss.sss`. * **Epoch timestamp (nanoseconds)**: the raw epoch value in nanoseconds, exactly as the query engine stores it. Select **ISO 8601 datetime** for readable dates in a spreadsheet, or **Epoch timestamp (nanoseconds)** for the exact epoch value in downstream processing. It affects the `Timestamp` column only. ## How exported data maps to the grid Most columns in the grid map directly to a single backend field, and they appear in the export with the same name and value. A few columns are different. ### Virtual columns A small number of columns are built in the UI from several raw fields, with fallbacks and normalization across SDKs and sources. They are not stored as a single field on the backend, so they are not included in the export. | Surface | Virtual column | Source fields | | ------- | -------------- | --------------------------------------------------------------------------------- | | Logs | `content` | `message`, `log`, `body`, `event`, and similar fields | | Spans | `resource` | Resource attributes (varies by SDK and instrumentation) | | Spans | `status_code` | `http.status_code`, `rpc.grpc.status_code`, and semantic-convention equivalents | | Spans | `span_kind` | `SERVER`, `CLIENT`, `PRODUCER`, `CONSUMER`, `INTERNAL` (derived from `span.kind`) | If you add a virtual column under **Columns to export**, the file will not contain a column with that name. The Spans tab export drawer also shows an inline note: *"Kind, Resource and Status are not supported yet, as they are virtual fields."* To capture the same information: * Pick **All fields** to export every raw field, then derive the equivalent column yourself in your spreadsheet or notebook. * Or select the underlying source fields directly in **Columns to export** before exporting. ## Limitations | Area | Limit | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Maximum rows per export | 50,000 | | Supported formats | CSV, TSV, and JSON on the Logs and Spans tabs (server-side exports). CSV and TSV only on the Traces, Templates, and Overview tabs (client-side exports). JSONL and Parquet are not supported on any tab. | | Delivery | Direct browser download only. No email, S3, or background delivery. | | Execution | Synchronous only. Closing the dialog or navigating away cancels the export. | | API and Terraform | Not available. Export is UI-only. | | Scheduling | Not available. Each export must be triggered manually. | | Truncation | If the query returns more than 50,000 rows, only the first 50,000 are included. There is no warning beyond the row-count cap shown in the dialog. | | Datasets | Logs and spans. Metrics are not supported. | | Virtual columns | Span kind, Resource, and Status are not supported in spans exports. They are derived in the UI rather than stored as backend fields. | ## Troubleshoot | Problem | Cause | Resolution | | ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | File contains fewer rows than expected | The query returned more than 50,000 rows and the export was capped. | Refine the query or shorten the time range to fit within 50,000 rows, or run multiple exports across smaller windows. | | Column shown in the grid is missing from the file | The column is a virtual column built by the UI (for example, `content` for logs or `resource`, `status_code`, and `span_kind` for spans). It does not exist as a single backend field. | Pick **All fields** to export every raw field, or select the underlying source fields explicitly in **Columns to export**. | | Spreadsheet shows JSON in cells | **All fields** was selected with a **CSV** or **TSV** format, so nested objects are serialized into cells. | Re-export with **Selected grid fields**, or switch the format to **JSON** if you want the nested structure preserved. | | Timestamp column shows a long number instead of a date | The **Date format** control was set to **Epoch timestamp (nanoseconds)**, which writes the raw epoch value. | Re-export with **Date format** set to **ISO 8601 datetime**. | | Special characters break the spreadsheet layout | The data contains commas that conflict with the CSV separator. | Re-export with **TSV**. | | Export is empty | The query returned no results. | Adjust the query, filters, or time range so the grid shows results before exporting. | | Export fails with a message that archive storage isn't configured | Export reads from archive storage, and no archive target is set up for the dataset you are exporting from. | Configure an archive target for the dataset, then export again. See [Connect S3 archive](https://coralogix.com/docs/user-guides/data-flow/s3-archive/connect-s3-archive.md). | | Browser download is interrupted | The page was navigated away during the server-side export job. The dialog closes as soon as you select **Export**. The file is delivered when a success toast appears, so leaving Explore before the toast cancels the download. | Stay on the Explore page until the success toast appears. | ## Related resources * [Logs in Explore](https://coralogix.com/docs/user-guides/data_exploration/logs/quickstart.md) * [Logs grid](https://coralogix.com/docs/user-guides/data_exploration/logs/grid.md) * [Explore actions](https://coralogix.com/docs/user-guides/data_exploration/explore_actions.md) ## Next steps Save, reuse, and share your investigations with [Explore views, tabs, and queries](https://coralogix.com/docs/user-guides/data_exploration/views_queries.md).