Export Events

Export event data from the Sysdig Monitor Events feed as a CSV file for offline analysis, reporting, or integration with external tools. Exports reflect the currently applied filters and time range.

Overview

Sysdig Monitor allows you to export the events currently displayed in the Events feed as a CSV file. The export respects all active filters, scope, severity selections, and the selected time range, so what you see in the feed is what gets exported.

To access the export options, select Export in the top-right corner of the Events page. Two options are available:

Export CSV: Generate and download a CSV file of the current event feed.
Export History: View a list of previously generated exports.

Export CSV

Event Limit

Export CSV is limited to 25,000 events. If the current event count exceeds this limit, the Export CSV option is disabled and a warning tooltip is shown.

To enable the export, reduce the number of matching events by applying additional filters or narrowing the time range. See Filter and Search Events for guidance.

Configure the Export

When the event count is within the limit, select Export CSV to open the export configuration dialog.

Name

The export file name is auto-generated using a timestamp (for example, Sysdig_Events_2026-04-03T14:11:28.019Z). You can edit this field to give the file a meaningful name before downloading.

Export Fields

The Export Fields section controls which event attributes are included as columns in the CSV. Each row in the table maps an event attribute (Value) to a column header name (Field Name) in the output file.

Column	Description
Value	The event attribute to export. Select from the dropdown, which groups available fields into three categories (see below).
Field Name	The column header label used in the CSV file. Defaults to the attribute name, but can be customized.

To add a column, use the Select Value… row at the bottom of the table and choose an attribute. To remove a column, select the trash icon on the corresponding row.

Available Field Values

The Value dropdown groups available attributes into three categories:

Common Event Fields (8)

These core event attributes are available for all event types:

Id
Version
Name
Description
Severity
Timestamp
Type
Source

Alert Event Fields

These fields are specific to Alert Events and are only populated when the event originates from an alert rule:

Alert Id
Alert State
Alert Acknowledgment
Notification Title
Resolution Timestamp

Event Specific Labels

Labels that apply specifically to events and are used for event-level categorization:

alertname
sysdig_severity

Suggested Labels

Scope labels commonly used to identify the infrastructure context of an event, including:

cloud_provider_region
container_name
host_hostname
kube_cluster_name
kube_cronjob_name
kube_daemonset_name
kube_deployment_name
kube_hpa_name
kube_job_name
kube_statefulset_name
kube_storageclass_name
kube_workload_name
kube_workload_type

All Labels

The full set of available labels, including environment-specific and custom labels such as Hostname, UUID, _sysdig_custom_metric, and _sysdig_datasource.

Download the File

Once you have configured the name and fields, select Export to generate and download the CSV file.

Export History

Select Export History to open a dialog listing previously generated CSV exports. Each entry can be downloaded again without re-generating the export.

If no exports have been generated yet, the dialog displays: No reports are currently available.