From 5ffd4c68bb97900636109cb273fff3c840ba42aa Mon Sep 17 00:00:00 2001 From: Anton Dosov Date: Mon, 22 Jan 2024 15:20:50 +0100 Subject: [PATCH] add csv limitations docs --- docs/user/reporting/index.asciidoc | 8 +++++++- docs/user/reporting/reporting-csv-limitations.asciidoc | 10 ++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 docs/user/reporting/reporting-csv-limitations.asciidoc diff --git a/docs/user/reporting/index.asciidoc b/docs/user/reporting/index.asciidoc index 676fb430b9c66..d66563bec0ae2 100644 --- a/docs/user/reporting/index.asciidoc +++ b/docs/user/reporting/index.asciidoc @@ -15,7 +15,7 @@ You access the options from the *Share* menu in the toolbar. The sharing options * *PNG Reports* — Generate and download PNG files of dashboards and visualizations. PNG reports are a link:https://www.elastic.co/subscriptions[subscription feature]. -* *CSV Reports* — Generate and download CSV files of saved searches. +* *CSV Reports* — Generate and download CSV files of saved searches. <>. * *CSV Download* — Generate and download CSV files of *Lens* visualizations. @@ -72,6 +72,12 @@ NOTE: Reports are stored in {es} and managed by the `kibana-reporting` {ilm} more about {ilm-init} policies, refer to the {es} {ref}/index-lifecycle-management.html[{ilm-init} documentation]. +[float] +[[csv-limitations]] +=== CSV reports limitations + +include::reporting-csv-limitations.asciidoc[] + [float] [[share-a-direct-link]] == Share direct links diff --git a/docs/user/reporting/reporting-csv-limitations.asciidoc b/docs/user/reporting/reporting-csv-limitations.asciidoc new file mode 100644 index 0000000000000..0c1671bb7bf74 --- /dev/null +++ b/docs/user/reporting/reporting-csv-limitations.asciidoc @@ -0,0 +1,10 @@ +We recommend using CSV reports to export moderate amounts of data only. The feature enables analysis of data in external tools, but it is not intended for bulk export or to backup Elasticsearch data. Report timeout and incomplete data issues are likely if you are exporting data where: + +- More than 250 MB of data is being exported +- Data is stored on slow storage tiers +- Any shard needed for the search is unavailable +- Network latency between nodes is high +- Cross-cluster search is used +- ES|QL is used and result row count exceeds the limits of ES|QL queries + +Use filters to create multiple smaller reports, or extract the data you need directly with the Elasticsearch APIs. See Point in time API, or SQL with CSV response data format. Reporting parameters can be adjusted to overcome some of these limiting scenarios. Results are dependent on data size, availability, and latency factors and are not guaranteed.