# Exports

> Downloading stored log lines as a zip: choosing the lines and days, how the files are laid out, the line format and how long an export is kept.

## How exports work

An export is a zip of your stored log lines that you can download and keep - for an auditor, for a support ticket, or to work on the lines with your own tools. You choose which lines and which days, and SaneLog builds the zip in the background.

To start an export, open **Exports** in the sidebar and choose **New export**, or choose **Export these logs** (the download icon) in the Log Explorer to start from what the Log Explorer is showing. Choose **Start export**, and the export's page shows its progress. When the zip is ready, the person who started the export receives an email, and **Download** appears on the export's page.

Everyone in the account can see and download every export, whoever started it. Users with Read Only access can download exports but cannot start or delete them.

Exports are available on every plan, and there is no limit on their size.

## Choosing the lines

The **Lines** card sets which lines are exported. Every field is optional:

- **Sources** - specific sources, picked by name.
- **Environments** - every source tagged with one of the chosen [environments](https://app.sanelog.com/docs/sources.md#environments). A source matching either **Sources** or **Environments** is included. With both empty, every source is included.
- **Filter** - a saved [filter](https://app.sanelog.com/docs/filters.md#how-filters-work). Only lines the filter passes are exported, from the sources it covers. When **Sources** or **Environments** are also set, only the sources in both are included.
- **Levels** - only lines at the chosen levels.
- **Conditions** - any further conditions, written as a [query expression](https://app.sanelog.com/docs/query-expressions.md), such as `program is nginx and message contains "timeout"`.

A source marked **Pending approval** is left out unless you pick it by name under **Sources**, as in the Log Explorer.

Under the **Files** card, the form shows how many lines your choice covers and roughly how large they are before compression. The estimate updates each time you change the form. The line count is exact. The size is worked out from the average size of the lines those sources sent over those days.

### Starting from the Log Explorer

**Export these logs** in the Log Explorer opens a new export with the Log Explorer's choice filled in: the source, filter or environment picked, and the search, program, levels and field conditions as **Conditions**. Check the days before starting the export - they are not taken from the Log Explorer.

## Choosing the days

**First day** and **Last day** are calendar days, both included, in the timezone chosen under **Timezone** (GMT unless you pick another). A day starts and ends at midnight in that timezone, and the time written on each line is in the same timezone. You can choose any days the account still holds logs for, back to the start of the account's [retention](https://app.sanelog.com/docs/billing.md#retention).

Each line is placed by the time the sender gave it, which is also the time the Log Explorer shows.

## What is in the zip

Every zip holds **export.txt**, which records what was exported: the account, who started the export and when, the choices made on the form, and the number of lines in each file. The lines themselves are in one or more `.log` files, laid out by the two switches on the **Files** card, which both start switched on:

- With both switches off, every line is in `logs.log`.
- **Split by source** writes each source's lines to a file named after the source, such as `web-01.log`.
- **Split by day** writes each day's lines to a file named after the day, such as `2026-09-30.log`.
- With both switches on, each source has a folder holding one file per day, such as `web-01/2026-09-30.log`.

A day or source with no lines has no file. Within each file, lines are in time order, oldest first.

### The line format

Each line reads:

```
2026-09-30T14:03:11.250+10:00 web-01 nginx error upstream timed out {"route":"/checkout"}
```

That is the time with its offset from UTC, the source, the program, the level and the message, followed by the line's attributes as JSON when it has any. A missing program or level is written as `-`. A message that spans several lines is written on one line, with each line break written as `\n`.

The lines are rebuilt from the stored events, so the spacing and the order of the parts can differ from what the sender originally wrote. Anything [redaction](https://app.sanelog.com/docs/redaction.md#what-redaction-does) removed as the line arrived is not in the export.

## Downloading and deleting

An export is named after its days, such as `sanelog-export-2026-09-01-to-2026-09-30.zip`, and **Download** on its page saves the zip under that name. Each download is recorded in the account's [audit log](https://app.sanelog.com/docs/account.md#audit-log), and so are starting and deleting an export. The **Downloads** card on the export's page lists every download, with who downloaded the zip, when and from which address.

While an export builds, its page shows a progress bar: the lines written so far out of the lines counted when the build started.

An export and its zip are deleted automatically 7 days after the export was built. The date is shown on the export's page and in the Exports list as **Retained until**. **Delete** on the export's page deletes it straight away. Deleting an export never changes the stored logs.

The email sent when an export is ready, or has failed, lists the choices the export was made with, so you can tell exports over the same days apart.

If an export cannot be finished, its page says why and the person who started it receives an email. Start a new export with the same choices to try again, or write to support@sanelog.com if it keeps failing.