Export Eventshttps://docs.sysdig.com/en/sysdig-monitor/export-events/Recent content on Export EventsenMon, 06 Apr 2026 12:54:42 -0400 https://docs.sysdig.com/icons/sysdig-horizontal.pngExport Eventshttps://docs.sysdig.com/en/sysdig-monitor/export-events/Sysdig logoExport Events - Overviewhttps://docs.sysdig.com/en/sysdig-monitor/export-events/#overviewSysdig Monitor allows you to export the events currently displayed in the Events feed as a CSV file. The export respects all active filters, scope, severity selections, and the selected time range, so what you see in the feed is what gets exported.Sysdig Monitor allows you to export the events currently displayed in the Events feed as a CSV file. The export respects all active filters, scope, severity selections, and the selected time range, so what you see in the feed is what gets exported.

To access the export options, select Export in the top-right corner of the Events page. Two options are available:

  • Export CSV: Generate and download a CSV file of the current event feed.
  • Export History: View a list of previously generated exports.
]]>OverviewExport Events - Export CSVhttps://docs.sysdig.com/en/sysdig-monitor/export-events/#export-csvExport CSV is limited to 25,000 events. If the current event count exceeds this limit, the Export CSV option is disabled and a warning tooltip is shown.Event Limit

Export CSV is limited to 25,000 events. If the current event count exceeds this limit, the Export CSV option is disabled and a warning tooltip is shown.

To enable the export, reduce the number of matching events by applying additional filters or narrowing the time range. See Filter and Search Events for guidance.

Configure the Export

When the event count is within the limit, select Export CSV to open the export configuration dialog.

Name

The export file name is auto-generated using a timestamp (for example, Sysdig_Events_2026-04-03T14:11:28.019Z). You can edit this field to give the file a meaningful name before downloading.

Export Fields

The Export Fields section controls which event attributes are included as columns in the CSV. Each row in the table maps an event attribute (Value) to a column header name (Field Name) in the output file.

Column Description
Value The event attribute to export. Select from the dropdown, which groups available fields into three categories (see below).
Field Name The column header label used in the CSV file. Defaults to the attribute name, but can be customized.

To add a column, use the Select Value… row at the bottom of the table and choose an attribute. To remove a column, select the trash icon on the corresponding row.

Available Field Values

The Value dropdown groups available attributes into three categories:

Common Event Fields (8)

These core event attributes are available for all event types:

  • Id
  • Version
  • Name
  • Description
  • Severity
  • Timestamp
  • Type
  • Source

Alert Event Fields

These fields are specific to Alert Events and are only populated when the event originates from an alert rule:

  • Alert Id
  • Alert State
  • Alert Acknowledgment
  • Notification Title
  • Resolution Timestamp

Event Specific Labels

Labels that apply specifically to events and are used for event-level categorization:

  • alertname
  • sysdig_severity

Suggested Labels

Scope labels commonly used to identify the infrastructure context of an event, including:

  • cloud_provider_region
  • container_name
  • host_hostname
  • kube_cluster_name
  • kube_cronjob_name
  • kube_daemonset_name
  • kube_deployment_name
  • kube_hpa_name
  • kube_job_name
  • kube_statefulset_name
  • kube_storageclass_name
  • kube_workload_name
  • kube_workload_type

All Labels

The full set of available labels, including environment-specific and custom labels such as Hostname, UUID, _sysdig_custom_metric, and _sysdig_datasource.

Download the File

Once you have configured the name and fields, select Export to generate and download the CSV file.

]]>Export CSVExport Events - Export Historyhttps://docs.sysdig.com/en/sysdig-monitor/export-events/#export-historySelect Export History to open a dialog listing previously generated CSV exports. Each entry can be downloaded again without re-generating the export.Select Export History to open a dialog listing previously generated CSV exports. Each entry can be downloaded again without re-generating the export.

If no exports have been generated yet, the dialog displays: No reports are currently available.

]]>Export History