Export logs from OpenSearch using elasticdump

To download more than 10 000 log entries from OpenSearch, you can use elasticdump to export data directly through the OpenSearch API. Designed to export large datasets, elasticdump paginates through the results and bypasses the default result window limitation of the OpenSearch Search API, so the export size is limited only by the available storage.

Note

To export up to 10 000 log entries through the OpenSearch Dashboards web UI, see Export logs from OpenSearch Dashboards to CSV.

Install elasticdump

You can run elasticdump either on your local machine or inside the Kubernetes cluster:

  • Local installation is recommended when exporting a relatively small amount of data that will be processed or analyzed on the local machine.

    Requirements:

    • npm installed on the local machine

    • Network access to the OpenSearch endpoint, for example, through kubectl port-forward

  • Running in the Kubernetes cluster is recommended when exporting large volumes of data, minimizing network traffic between the cluster and the local machine, or achieving the best export performance. Running elasticdump inside the cluster is typically much faster because it avoids transferring large amounts of data over the external network.

Install elasticdump globally:

npm install -g elasticdump

Start a temporary pod:

kubectl run elasticdump \
  --image=elasticdump/elasticsearch-dump \
  --restart=Never \
  --command -- sleep infinity

Verify the connection

Before exporting data, verify that elasticdump can connect to the OpenSearch cluster:

  1. Start port forwarding to the OpenSearch service:

    kubectl -n stacklight port-forward svc/opensearch-master 49200:9200

  2. Verify the connection by retrieving the index mapping:

    elasticdump \
  --input="http://localhost:49200/system*" \
  --output=$ \
  --type=mapping

  1. Connect to the elasticdump pod:

    kubectl exec -it elasticdump -- bash

  2. Verify the connection by retrieving the index mapping:

    elasticdump \
  --input="http://opensearch-master.stacklight.svc.cluster.local:9200/system*" \
  --output=$ \
  --type=mapping

Collect the required parameters

Before running elasticdump, collect the following parameters. This section covers the most commonly used ones. For a complete list, refer to the official elasticdump documentation.

  • OPENSEARCH_URL

    The OpenSearch endpoint to read data from. For example:

    Through kubectl port-forward: http://localhost:49200

    http://opensearch-master.stacklight.svc.cluster.local:9200

  • INDEX_PATTERN

    The index or index pattern to export. You can find the index pattern name in OpenSearch Dashboards. For available index patterns, see StackLight logging indices. For example, system*, audit*, or kubernetes-events-*.

  • LIMIT

    The number of documents retrieved per request. Smaller values reduce the load on OpenSearch but increase the overall export time. Larger values improve throughput but consume more cluster resources. Defaults to 100. The maximum is 10000.

    Start with 1000 or higher, then tune the value based on your cluster CPU, memory, and overall performance characteristics to find the best balance between throughput and resource usage.

  • OUTPUT

    The path to the output JSON file. For example, export.json.

  • SEARCH_BODY

    Optional. An OpenSearch Query domain-specific language (DSL) JSON object used to filter the exported documents. Write it manually, or copy it from OpenSearch Dashboards using Inspector > Request, and save it to a JSON file. If omitted, all documents matching the selected index pattern are exported.

Run elasticdump

After collecting the required parameters, run elasticdump, substituting the collected parameter values:

elasticdump \
  --input="${OPENSEARCH_URL}/${INDEX_PATTERN}" \
  --output="${OUTPUT}" \
  --limit="${LIMIT}" \
  --searchBody="${SEARCH_BODY}"

For example:

Example with a search body from a JSON file. Copy the query from OpenSearch Dashboards using Inspector > Request, and save it as searchbody.json.

OPENSEARCH_URL="http://localhost:49200"
INDEX_PATTERN="system*"
OUTPUT="elasticdump.json"
LIMIT=1000
SEARCH_BODY="@searchbody.json"

elasticdump \
  --input="${OPENSEARCH_URL}/${INDEX_PATTERN}" \
  --output="${OUTPUT}" \
  --limit="${LIMIT}" \
  --searchBody="${SEARCH_BODY}"

Example with an inline search body. For short queries, you can provide the search body directly in the command.

OPENSEARCH_URL="http://opensearch-master.stacklight.svc.cluster.local:9200"
INDEX_PATTERN="system*"
OUTPUT="elasticdump.json"
LIMIT=1000
SEARCH_BODY='{
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_phrase": {
            "orchestrator.pod": "patroni-13-0"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2026-07-13T06:45:00.000Z",
              "lte": "2026-07-13T07:00:00.000Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ]
    }
  }
}'

elasticdump \
  --input="${OPENSEARCH_URL}/${INDEX_PATTERN}" \
  --output="${OUTPUT}" \
  --limit="${LIMIT}" \
  --searchBody="${SEARCH_BODY}"