Export logs using the CLI

The information on this page only applies if you installed NXLog Platform on Linux using the CLI installer, including air-gapped installations.

You can export both NXLog Platform customer logs or audit logs directly from the database to a CSV file, which can then be used in compliance workflows or for external reporting.

The procedure described below involves performing a direct query to the ClickHouse database used by NXLog Platform, and should be used carefully to avoid performance impact on production systems.

To export NXLog Platform logs to a CSV file:

Run the following command to query the database and export the results to a CSV file.

Replace <table-name> with either logs to export the customer logs, or audit_logs to export the audit logs. We recommend that you always use a WHERE clause to limit the exported data to a specific range of the column EventTime (DateTime64).

Adjust the timestamps and query as needed for your own requirements:

sudo podman exec "$(sudo podman ps -a --format "{{.Names}}" | grep clickhouse)" \
  clickhouse-client \
    --user=log_search \
    --password="$(sudo cat /srv/nxp/data/passwords/ch_logsearch_pass.txt)" \
    --database=nxlog \
    --query="SELECT * FROM <table-name> \
             WHERE EventTime >= '2025-11-27 00:00:00' \
             AND EventTime < '2025-11-28 00:00:00'" \
    --format=CSVWithNames > output.csv

The command writes the results returned by the query to the local file output.csv.

Export logs using the CLI

See also