# Howto: Export CSV from saved searches with API

**URL:** <https://community.graylog.org/t/howto-export-csv-from-saved-searches-with-api/17293>\
**Category:** Graylog Central (peer support)\
**Created:** [September 25, 2020, 1:05pm UTC](https://community.graylog.org/t/howto-export-csv-from-saved-searches-with-api/17293 "2020-09-25T13:05:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![xtruthx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/xtruthx/32/2144_2.png) [@xtruthx](https://community.graylog.org/u/xtruthx)\
**Post date:** [September 25, 2020, 1:05pm UTC](https://community.graylog.org/t/howto-export-csv-from-saved-searches-with-api/17293/1 "2020-09-25T13:05:10Z")

</div>

If you want to generate CSV-Lists from saved searches you can do this via the API.

It is a call within Search/Message Section.  
The API-Call for this is:  
`http(s)://yourgraylogserver:9000/api/views/search/messages/{searchId}`

The method is POST and the response content type is text/csv. You can also use a application content type application/json for body parameters like:  
{  
execution\_state (object, optional),  
limit (integer, optional),  
fields\_in\_order (array[string], optional)  
}

As its requiriere a searchID you need to create a saved search with filteres and time range e.g first.  
Important to know is that the ID which is used in the Webfrontend is not your ID you need. Saved searches have to unique IDs. The ID you need is called “search\_id” .  
Actually the only for me to find those ID is to use the API-Call of:

`http(s)://yourgraylogserver:9000/api/search/saved?page=1&per_page=50&sort=title&order=asc`

In the API-Browser:  
`http(s)://yourgraylogserver:9000/api/api-browser/global/index.html#!/Search/Saved/views_get_0`

The result will be all saved searches. There you can find the search\_id for example:  
“views”: [  
{  
“id”: “5eb27a3888d5576c03468b5d”,  
“type”: “SEARCH”,  
“title”: “Your saved search”,  
“summary”: “”,  
“description”: “”,  
“ **search\_id": "5ef457cf95b9ceb86fd77fb7** ”,  
“properties”: ,  
“requires”: {},  
“state”: {  
“034cb8c1-144a-4feb-b880-56fc4b03560b”: {  
“selected\_fields”: null,  
“static\_message\_list\_id”: null,  
…

**Be aware of the fact that if you altered the saved search in any kind of way the search\_id is changing too**

**Example**  
if you want to use it with curl you can use it like this:

```
curl -i -X POST -u user:$(cat .userpw) -H 'Content-Type: application/json' -H 'Accept: text/csv' -H 'X-Requested-By: cli' 'http(s)://yourgraylogserver:9000/api/views/search/messages/5ef457cf95b9ceb86fd77fb7' -d 
'{ 
  "fields_in_order": ["messagefield1", "messagefield2"]
 }'
```

---

<div class="post-metadata">

**Author:** ![xtruthx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/xtruthx/32/2144_2.png) [@xtruthx](https://community.graylog.org/u/xtruthx)\
**Post date:** [September 25, 2020, 1:15pm UTC](https://community.graylog.org/t/howto-export-csv-from-saved-searches-with-api/17293/2 "2020-09-25T13:15:36Z")

</div>

And the first post is the solution. Here you have ONE way to generate CSV-Export from search results.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 9, 2020, 1:15pm UTC](https://community.graylog.org/t/howto-export-csv-from-saved-searches-with-api/17293/3 "2020-10-09T13:15:52Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.