Guide

Export

Export logs, traces, metrics or any SQL or KQL result as a file you download. An export streams straight to your browser as it is read: there is no row limit like the 10,000 rows of the results table, and nothing is stored on Logthread's side.

Export from the app#

Use Export on:

Page	What you get	Source
Explore	The logs of the current search, with the columns Explore shows	`explore`
Traces	Every span of the traces that match the current search filters	`traces`
Metrics	The raw points of the metric you are viewing, with its filters	`metrics`
SQL (and an Explore tab in SQL or KQL)	The full result of your statement, not only the first 10,000 rows	`sql`

Choose NDJSON or Parquet, then confirm. The file is named logthread-<workspace>-<UTC time>.ndjson (or .parquet), and a toast shows the name while the download runs.

Formats#

Format	Use it for
NDJSON	One JSON object per line. Works with `jq`, most log tools and any language. The default.
Parquet	Columnar files for analytics tools. Not available for KQL results.

KQL results export as NDJSON only. If you pick Parquet for a KQL query, the export is refused with "KQL results export as NDJSON. Choose NDJSON, or write the query in SQL for Parquet."

What each source contains#

Logs: Timestamp, SeverityText, SeverityNumber, ServiceName, Body, TraceId, SpanId, LogAttributes and ResourceAttributes.
Traces: Timestamp, TraceId, SpanId, ParentSpanId, SpanName, SpanKind, ServiceName, Duration (nanoseconds), StatusCode, StatusMessage, the scope, SpanAttributes, ResourceAttributes, and the span events and links.
Metrics: the service, metric name and unit, attributes, resource attributes, start and sample times, and the values of its type (a gauge's Value; a counter's Value, temporality and monotonic flag; a histogram's Count, Sum, buckets, bounds, Min and Max). Exponential histograms cannot be exported yet: read them with SQL.
SQL and KQL: exactly the columns of your statement. Internal columns and internal attribute keys are always removed.

Limits#

Limit	Value
Who	the member role or higher
Time range	up to your workspace's retention
At once	one export per workspace. A second one answers "An export is already running for this workspace" (HTTP 429 with a `Retry-After` of 10 seconds)
Duration and size	an export is stopped after 10 minutes or 10 GB. Narrow the range or the filters and export again
Failure	if the stream breaks midway, the download is marked failed in your browser instead of ending as a shorter, complete-looking file

Scanned data counts in your query usage, like any other query. See Cost control.

Audit#

Every export is recorded in the audit log as export.created with the source, format and time range. Owners and admins can see it under Audit log.

Other downloads#

Export CSV on the Usage page, the Audit log and Analyze download a table as CSV and are separate from this feature. A saved or shared dashboard exports as JSON; see Dashboards.

Next: turn a search you export often into an alert.