> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/edgesight/instant-logs/export-reference.md).
# Export & Reference
Learn how to export Instant Logs data and review query, export, retention, and log behavior limits.
Instant Logs allows you to export the complete result set matching your current filters and time range, up to the applicable export limit. This page also provides an example log entry, interface limits, and usage notes for interpreting Instant Logs data.
## Exporting Logs
Select **Export** in the page header to open the export panel.
The export includes all records matching the current filters and time range, not only the rows currently displayed in the log table. Before the export begins, the panel displays the total number of matching rows.
The export panel: matching row count, format choice and the downloadable parts.
Two export formats are available:
* **CSV** -- Comma-separated data with one header row and one row per request.
* **JSON (NDJSON)** -- Newline-delimited JSON with one JSON object per line.
Exports are delivered in parts rather than as a single file:
* **10,000 rows** per part.
* Up to **20 parts** per export.
* Up to **200,000 rows** per export.
You can download individual parts or download all available parts in sequence.
When more than one source is available, the export panel provides a source selector. Select a single source or **All sources**. When **All sources** is selected, Instant Logs exports each source separately and generates one set of files per source.
{% hint style="warning" %}
If the result set exceeds **200,000 rows**, the export is truncated after the first 200,000 rows. Reduce the selected time range or apply additional filters when you need a smaller result set.
For continuous or bulk delivery of logs to your own storage or SIEM system, use [**Logpush**](/products/edgesight/logpush.md) instead of Instant Logs export.
{% endhint %}
## Example Log Entry
The following example shows the structure of an Instant Logs record:
```json
{
"timestamp": "2026-08-06T11:43:02.000Z",
"request_id": "4cf6103583ff66578fa4466a074095d6",
"request_method": "GET",
"request_uri": "/wp-content/uploads/assets/demo/image.svg",
"status": "200",
"proxy_cache_status": "HIT",
"bytes_sent": "1674",
"body_bytes_sent": "1412",
"country_code": "TR",
"asn": "47331",
"isp": "Turk Telekom",
"request_time": 0.012,
"upstream_response_time": 0
}
```
## Limits
| Limit | Value |
| ----------------------------------- | ------------------------------------- |
| Maximum time range per query | 7 days |
| Rows returned per request | 1,000 |
| Rows per page in the table | 25 / 50 / 100 / 200 |
| Filterable fields | 35, plus `content_type` on Cloudflare |
| Fields with distribution statistics | 32, plus `content_type` on Cloudflare |
| Sources per query | 10 |
| Rows per export part | 10,000 |
| Parts per export | 20 |
| Rows per export, total | 200,000 |
Two additional limits depend on your Instant Logs plan:
* Log retention period.
* Number of CDN sources you can connect.
A query cannot access data older than the applicable retention period, even when the selected time range extends beyond that period.
## Usage Notes
* **Time zones** -- Timestamps in the log table and exported data use **UTC**. The Log Volume chart displays its time axis using the local time zone configured in your browser. As a result, chart times and log timestamps can differ by your local UTC offset.
* **Cached responses report near-zero timings** -- A response served directly from the edge cache commonly reports a `request_time` value close to `0.000` because the request does not require origin processing. Non-zero values usually indicate that the request reached the origin.
* **Cache invalidation appears in logs** -- `PURGE` requests are handled by the edge and recorded in Instant Logs like other requests. On resources with frequent cache invalidation, `PURGE` requests can represent a significant share of the recorded request methods. Apply `request_method is not PURGE` to focus on visitor traffic.
* **A cached 404 is expected behavior** -- Negative responses can be cached. A `404` response with a `proxy_cache_status` value of `HIT` indicates that the edge served a cached not-found response instead of requesting the object from the origin again.
* **Empty fields are expected** -- A field with no value for a request, or a field that the source CDN does not provide, is returned empty rather than omitted. This keeps records from different sources aligned in the shared schema.
* **Storage capacity affects available history** -- When the included storage capacity is reached, Instant Logs removes the oldest logs to make space for new records. No storage overage charge is applied, but removed logs are no longer available for queries. To retain all log records independently of the Instant Logs storage limit, use [**Logpush**](/products/edgesight/logpush.md) to deliver logs to your own storage.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://clients.medianova.com/products/edgesight/instant-logs/export-reference.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
