Can I export Event Logs as Excel, CSV or PDF?

Short answer

Yes. When the export icon on the Event Logs or Global WAF Event Log toolbar is clicked, the Export Table window opens; in the window, Filename, Format (Excel (.xlsx), CSV or PDF), Data Source (default All Data (filtered & sorted); if desired, in the original order or only the visible page) and Columns are selected, depending on the format CSV Separator, Excel Sheet Name or Page Orientation and Page Size are set, and the file is downloaded with Accept. The Action column is written with a short verdict text instead of an icon (Blocking, Monitor, Monitored rule or the name of the Teacher source, e.g. Teacher IP). The Columns list comes filled with the visible columns in the table; hidden columns (Severity, Host, Category, Scopes, ASN Org, X-Forwarded-For) are added from the same list. The file contains the records fetched from the server and filtered with the filter strip; for this reason, the number of records is limited by Line Limit (at most 20,000). Since the headers and the body of the request are not table columns, they are not written to the file.

Problem: The Records Are to Be Shared With Another Team

An incident review, an audit record or a false positive analysis needs to be shared with people who have no access to the Event Logs screen, or to be processed in a spreadsheet.

Solution

Export Table

• How it works The Export Table window writes the current state of the table (the fetched records, the filter strip filtering and the sorting) to a file in the selected format and downloads it to the browser; no copy is kept on the device.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → Event Logs → the export icon on the toolbar · WAF → Global WAF Event Log → the same icon
• Requirement WAF permission
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Event Logs screen

In the Left Monitor Panel, the vService is clicked in the WAF-Protected vServices category and the Event Logs tab is selected (accessing Event Logs). For the records of all vServices, WAF → Global WAF Event Log is opened; the window and the fields are the same.

2

Adım 2 Prepare the records

If needed, Date Range, Line Limit or Log Filter is set in the server filter and Save & Get Logs is clicked; then a selection is made on the filter strip and the table is sorted with the column header (How do I filter logs by fields such as IP, country, ASN, path, signature, category, OWASP and CWE?).

3

Adım 3 Open the export window

The export icon on the toolbar (it shows Export table on hover) is clicked; the Export Table window opens.

4

Adım 4 Define the file

The fields are filled in:

Field	Options and default
Filename	Comes filled with a name that starts with TR7 - Table - and carries the current date; the extension is added according to the format
Format	Excel (.xlsx) (default), CSV, PDF
Data Source	All Data (filtered & sorted) (default), All Data (filtered, original order), Current Page Only
Columns	Comes filled with the visible columns in the table; hidden columns are also checked from the list; at least one column is selected
CSV Separator	Only in CSV: Comma (,) - English (default), Semicolon (😉 - European Excel, Tab, Pipe (|)
Excel Sheet Name	Only in Excel; comes filled with Data
Page Orientation · Page Size	Only in PDF: Landscape (default) / Portrait · A4 (default), A3, Letter, Legal

5

Adım 5 Download

Accept is clicked; the file is saved to the download folder of the browser.

Verification

1FileClient side

The row count in the downloaded file is compared with the record count in the Page Information line at the bottom of the screen, and the Action column with the icons on the screen.

ExpectedThe same record count; Blocking / Monitor / Monitored rule / Teacher IP in the Action column

Common Mistakes

• Thinking that the file contains the whole period. The file contains only the fetched records; if Line Limit (default 1,000 on the vService screen, 5,000 on the global screen, at most 20,000) was filled, older records are not in the file. For the whole period, the export is done piece by piece by narrowing Date Range, or the scope is narrowed with Log Filter.
• Forgetting the selection on the filter strip. The default Data Source exports the filtered records; if a selection was left on the strip, the file contains only those records.
• Thinking that hidden columns come automatically. The Columns list comes filled with the visible columns; hidden columns such as Severity, Host and Category are checked separately from the list.
• Looking for the headers and the body in the file. The headers and the body of the request appear only in the preview; to keep the records with their details outside, sending to the SIEM with a log profile is used (How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?).
• Exporting records for a period summary. For totals and breakdowns, a WAF Report is produced as PDF or XLSX (How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?).

How it is done in the documentation

• Event Logs · Export Table
• Event Logs · Columns
• Global WAF Event Log · What Is It For?

Related questions

• Which Event Logs columns are hidden by default; how do I show them?
• What do the Action values in Event Logs mean?
• How is a WAF report created; which formats are available in the UI and by e-mail (HTML, PDF, XLSX)?