Export a table

An export copies the rows of one table out of Vigilfield. It can be any table you are allowed to export: an ingested table, or the result table of a query. You need the tables:export permission on that table.

Two ways to receive it:

• Download. Vigilfield writes the file and gives you a download link. The link works for one hour.
• Export to S3. Vigilfield writes the file straight into an S3 bucket you own. Vigilfield assumes a role you create in the bucket's AWS account, using a short-lived identity token. No long-lived Vigilfield credentials are stored there.

Export from the app

1. Open Tables and select the table.
2. In the Export card, choose a Result Format: JSON, CSV or Parquet.
3. Choose a Delivery Method:
   • Download is available only when the table is 1 GB or smaller. Larger tables must go to S3.
   • Export to S3 needs the destination fields described below.
4. Optionally, add a Filter Expression (see below).
5. Click Download Results or Export to S3.

The card shows the export's progress. When it finishes, a download export shows a Download link. If it fails, the card shows the error.

Filter expression

The filter is a VRL expression that runs on each row and must return a boolean. Only rows where it returns true are exported, for example .severity == "high". The expression is checked when you submit, and a syntax error fails the submit.

Set up an S3 destination

Vigilfield reaches your bucket through AWS web-identity federation, the same pattern CI systems use.

1. Register Vigilfield as an identity provider

In IAM in the AWS account that owns the bucket, add an OpenID Connect identity provider:

• Provider URL: https://<your-org>.vigilfield.com/api/v1/federation
• Audience: sts.amazonaws.com

<your-org> is your organization's slug, the first part of your Vigilfield address.

2. Create the export role

Create a role whose trust policy admits only your organization's export identity. The token's subject is export:<org-id>, where <org-id> is your organization's id from List organizations.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<account-id>:oidc-provider/<your-org>.vigilfield.com/api/v1/federation"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "<your-org>.vigilfield.com/api/v1/federation:aud": "sts.amazonaws.com",
          "<your-org>.vigilfield.com/api/v1/federation:sub": "export:<org-id>"
        }
      }
    }
  ]
}

Give the role permission to write objects under the prefix you will use:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::<bucket>/<prefix>/*"
    }
  ]
}

If you name a KMS key for the export, the role also needs permission to encrypt with that key.

3. Fill in the destination

Vigilfield checks only that the fields are filled in when you submit. It does not try the role until the export runs, so a wrong trust policy or missing permission shows up as a failed export with an error message.

Each export is written as one object at <prefix>/<export-id>/<format>, so every export has its own folder under the prefix.

Through the API

• Create an export takes table_id, format (json, csv or parquet), delivery_method (download or s3), an optional filter_expression, and a destination when delivery_method is s3. A destination on a download export is refused.
• Get an export returns its status: pending, running, completed, failed or cancelled. While running, progress goes from 0 to 100. A completed download export carries download_url.
• Cancel an export stops a queued or running export. Cancelling a finished export is harmless and returns it unchanged.

Limits

Exported data counts toward your plan's monthly exported volume. When that limit is reached, new exports are refused until the next month or until you buy a top-up. See Plans and billing.