How to collect specific GrayLog messages for later processing?

Question

I am a naive GrayLog user who uses the web-based search UI to find interesting events. Some of our log messages contain performance information. For example, we might have messages like:

SomeProcessor completed transaction synchronization after 2982 ms.

Using GrayLog's Search, I can enter search terms of "completed transaction synchronization after" AND "SomeProcessor", to get a collection of log messages that tell me how long it took SomeProcessor to synchronize. I'd like to further process this information, for example, I might want to determine the average synchronization time over a particular time period, or I might want have a graph showing how the synchronization time changes over time.

How can I do that? It looks like Extractors might work, but what if I don't have permissions to create them? Is there a way I could dump the filtered messages into a CSV file or something for later processing with different tools?

Answer 1

There is an "Export as CSV" option under the "More Actions" button that enables you to save the messages to a CSV file. It doesn't appear to maintain the time ordering, so you may need to sort from within your spreadsheet.