Exports

How exports work

An export is a zip of your stored log lines that you can download and keep - for an auditor, for a support ticket, or to work on the lines with your own tools. You choose which lines and which days, and SaneLog builds the zip in the background.

To start an export, open Exports in the sidebar and choose New export, or choose Export these logs (the download icon) in the Log Explorer to start from what the Log Explorer is showing. Choose Start export, and the export's page shows its progress. When the zip is ready, the person who started the export receives an email, and Download appears on the export's page.

Everyone in the account can see and download every export, whoever started it. Users with Read Only access can download exports but cannot start or delete them.

Exports are available on every plan, and there is no limit on their size.

Choosing the lines

The Lines card sets which lines are exported. Every field is optional:

• Sources - specific sources, picked by name.
• Environments - every source tagged with one of the chosen environments. A source matching either Sources or Environments is included. With both empty, every source is included.
• Filter - a saved filter. Only lines the filter passes are exported, from the sources it covers. When Sources or Environments are also set, only the sources in both are included.
• Levels - only lines at the chosen levels.
• Conditions - any further conditions, written as a query expression, such as program is nginx and message contains "timeout".

A source marked Pending approval is left out unless you pick it by name under Sources, as in the Log Explorer.

Under the Files card, the form shows how many lines your choice covers and roughly how large they are before compression. The estimate updates each time you change the form. The line count is exact. The size is worked out from the average size of the lines those sources sent over those days.

Starting from the Log Explorer

Export these logs in the Log Explorer opens a new export with the Log Explorer's choice filled in: the source, filter or environment picked, and the search, program, levels and field conditions as Conditions. Check the days before starting the export - they are not taken from the Log Explorer.

Choosing the days

First day and Last day are calendar days, both included, in the timezone chosen under Timezone (GMT unless you pick another). A day starts and ends at midnight in that timezone, and the time written on each line is in the same timezone. You can choose any days the account still holds logs for, back to the start of the account's retention.

Each line is placed by the time the sender gave it, which is also the time the Log Explorer shows.

What is in the zip

Every zip holds export.txt, which records what was exported: the account, who started the export and when, the choices made on the form, and the number of lines in each file. The lines themselves are in one or more .log files, laid out by the two switches on the Files card, which both start switched on:

• With both switches off, every line is in logs.log.
• Split by source writes each source's lines to a file named after the source, such as web-01.log.
• Split by day writes each day's lines to a file named after the day, such as 2026-09-30.log.
• With both switches on, each source has a folder holding one file per day, such as web-01/2026-09-30.log.

A day or source with no lines has no file. Within each file, lines are in time order, oldest first.

The line format

Each line reads:

2026-09-30T14:03:11.250+10:00 web-01 nginx error upstream timed out {"route":"/checkout"}

That is the time with its offset from UTC, the source, the program, the level and the message, followed by the line's attributes as JSON when it has any. A missing program or level is written as -. A message that spans several lines is written on one line, with each line break written as \n.

The lines are rebuilt from the stored events, so the spacing and the order of the parts can differ from what the sender originally wrote. Anything redaction removed as the line arrived is not in the export.

Downloading and deleting

An export is named after its days, such as sanelog-export-2026-09-01-to-2026-09-30.zip, and Download on its page saves the zip under that name. Each download is recorded in the account's audit log, and so are starting and deleting an export. The Downloads card on the export's page lists every download, with who downloaded the zip, when and from which address.

While an export builds, its page shows a progress bar: the lines written so far out of the lines counted when the build started.

An export and its zip are deleted automatically 7 days after the export was built. The date is shown on the export's page and in the Exports list as Retained until. Delete on the export's page deletes it straight away. Deleting an export never changes the stored logs.

The email sent when an export is ready, or has failed, lists the choices the export was made with, so you can tell exports over the same days apart.

If an export cannot be finished, its page says why and the person who started it receives an email. Start a new export with the same choices to try again, or write to support@sanelog.com if it keeps failing.