Export Elasticsearch results to CSV, Excel and JSON

The download menu on a result writes the rows to a file as they stream from the cluster. Nothing is buffered in memory, so a 5,000,000-row export needs no more RAM than a 500-row one.

Start a download#

Run the statement, then open the download menu (the arrow icon in the result toolbar) and pick a format. If the grid already holds every row and there are fewer than 5,000 of them, the file is written on the spot from what is loaded.

When the statement may match more than what is loaded, FlatQL asks How many rows? first:

• Loaded rows only: the rows in the grid.
• Presets from 1,000 up to 1,000,000 rows.
• Custom: any number up to the cap for that format.

Any larger download re-runs the statement with the new row limit and streams the result into the file. The statement's own LIMIT, if it has one, still applies; a query that ends in LIMIT 100 produces 100 rows whatever you pick.

SELECT order_id, customer_id, amount, currency, status, placed_at
FROM orders
WHERE status = 'shipped'
ORDER BY placed_at DESC;

A statement like this, with a filter the cluster can run and no aggregation, is the ideal export: the filter is pushed down, rows are read in pages, and each page is appended to the file before the next one is fetched.

Formats#

Cells that hold objects or arrays are written as JSON text in the delimited formats. Excel cells longer than 32,000 characters are cut with an ellipsis, since Excel cannot hold them.

NDJSON is available for document exports: on the Browse page, Export query as JSONL / CSV writes the documents matching the current query, one JSON object per line, paging with search_after so the size does not matter. The Console's response menu offers Download hits as JSONL for a raw search response.

How streaming works#

The export endpoint on the FlatQL backend runs the statement through the same engine as the worksheet, but instead of collecting the rows it yields them page by page. Each page is encoded into one chunk of the file and sent to the browser straight away. No complete result ever exists in memory on the server.

In the browser, Chrome and Edge ask where to save the file before the first row arrives, then append each chunk to it on disk. A progress dialog shows rows written, bytes, rows per second and elapsed time, with a Cancel button that stops the statement. Other browsers do not expose a streaming file API, so they hold the chunks in memory and save the file at the end; the dialog says so when that happens.

The limit of 5,000,000 rows per export is set on the server and applies to the streamed formats. Excel files are assembled in the browser, which is why they stop at 100,000 rows; choose CSV for anything larger.

Plan requirement#

Exports are part of the Pro licence. On the Free plan the download menu opens an upgrade prompt instead of a file. Downloads of any size are included with Pro; there is no per-row charge. Every export is written to the team's audit log with the statement text and the format. See pricing and licensing.

Tips for large exports#

Let the cluster filter. A WHERE clause on a keyword, numeric or date field is sent to Elasticsearch, so only matching rows travel. A predicate the engine has to evaluate itself means a full scan up to the fetch cap first; the pushdown rules list what translates.

Export plain rows, not joins. A JOIN, window function or CTE runs in the embedded engine, which works on at most about 50,000 rows per index per statement. For millions of rows, export each index on its own and join elsewhere, or push the heavy filter into a subquery the cluster can run.

Prefer CSV or TSV. They stream and have the highest cap. Use the Excel variant of CSV when the file is going straight into a spreadsheet; it avoids the mangled accents a plain CSV can produce there.

Use Chrome or Edge for very large files. Disk streaming keeps the browser's memory flat. In Safari or Firefox a multi-gigabyte download sits in memory until it finishes.

Keep the tab open. Closing the tab cancels the stream. The file written so far stays on disk but is incomplete.

Check the row count afterwards. If the file has fewer rows than you asked for, the statement's own LIMIT or the index's actual size was the ceiling; a toast says so when that happens.

For the long version with timings, read exporting 5 million rows from Elasticsearch, or see the export to CSV use case for how this compares with scroll scripts and Kibana reports.