Save searches and export data

Save a search when the same investigation filter will be reused inside Anectico. Export data only when a bounded external copy is necessary for analysis, evidence, or an approved downstream workflow.

Save a search

From a supported signal view, save the current filters with a question-oriented name. Keep searches private when they contain an individual’s investigation context; share only filters that are useful to the organization.

The CLI exposes the complete saved-search contract:

anectico saved-searches list --signal logs
anectico saved-searches create --json '{"name":"Checkout errors","signal":"logs","query":{"service_name":"checkout","level":"error"},"is_shared":true}'

Saved searches preserve filters, not a frozen result set. Running one later uses current data and the current retention window. Dashboard query fields are single-line: when the dashboard opens a saved search created through another client, runs of tabs, line breaks, or Unicode line separators in its query are shown and submitted as one ASCII space. Other query characters and structured filters are preserved. The REST API and CLI continue to store the JSON supplied by their caller.

Every saved-search operation resolves to one project. The CLI sends the active profile’s project. Project-scoped REST and MCP credentials may omit project_id or repeat only their exact signed project; an explicit sibling or unknown project is rejected with the same generic not-found result before Saved Search is called. Organization-level callers must select one consistent project.

Export a bounded log set

On Explore → Logs, finish a bounded search, choose CSV or JSON beside Export, and download that exact settled investigation. Anectico freezes the active project, submitted query, environment, person IDs, service, severity, absolute time window, and structured field filters in the durable job. Changing the format creates a distinct export intent; retrying an unchanged intent reuses its idempotency key.

Open Explore → Exports to create broad signal exports and manage all durable CSV, JSON, and Parquet jobs. Choose the signal, columns, and format. The list shows queued, running, retrying, completed, failed, canceled, and expired jobs; active jobs can be canceled and failed jobs can be retried. Closing the page does not cancel a job. Creation requires export:write plus the source signal’s read scope (for example logs:read); listing and polling require export:read. Minting a signed result URL separately requires the owner/admin-only export:download scope.

Every create requires a stable idempotency key. Repeating the same request with the same key returns the original job; reusing the key for different input fails instead of creating a second export. The dashboard generates this key automatically. CLI and MCP callers must supply one explicitly. Use 1–128 ASCII letters, digits, ., _, :, or -; Anectico rejects surrounding whitespace, control bytes, and Unicode lookalikes rather than normalizing them into an ambiguous durable key.

Export uses the absolute time window that produced the currently displayed results. Refresh the search to advance a relative range such as Last hour; while a changed or refreshed search is loading or has failed, export stays unavailable to avoid mixing retained rows with a newer scope. Pause live tail and wait for the bounded search results before exporting.

The project scope is captured when the job is created and cannot be widened while it runs. Project-scoped credentials remain pinned to their own project; a conflicting project_id is rejected. Organization-level users must select one project in their organization. Anectico verifies that selection before creating, listing, reading, canceling, retrying, or downloading a job; customer export operations never fall back to an organization-wide result.

The authenticated plan entitlement is also captured when the job is created. A queued export therefore cannot bypass the retention window by asking the background worker for older timestamps, or by changing fields inside query. Anectico applies the organization’s current published retention state when the worker executes the job; when that state is unavailable, it falls back to the captured plan entitlement. Exporting does not make expired source telemetry readable again.

Logs-page CSV and JSON files use the fixed fields timestamp, severity, message, service_name, trace_id, span_id, distinct_id, and attributes. Structured maps and arrays such as attributes remain structured in JSON and are encoded as deterministic JSON inside the CSV cell. String CSV cells that could be interpreted as spreadsheet formulas are emitted as text, while normal CSV quoting, newlines, and UTF-8 are preserved. Logs-page downloads use anectico-logs-<project-slug>-<UTC timestamp>.<format> with the selected .csv or .json extension.

To create CSV, JSON, or Parquet jobs from a terminal, use the CLI:

anectico export logs --idempotency-key incident-124-logs-v1 --json '{
  "format":"csv",
  "query":"payment timeout",
  "project_id":"11111111-1111-1111-1111-111111111111",
  "service_name":"checkout",
  "level":"error",
  "environment":"production",
  "distinct_ids":["customer-42"],
  "start_time":"2026-07-20T10:00:00Z",
  "end_time":"2026-07-20T11:00:00Z",
  "filters":{"attributes.region":"eu-west-1"},
  "columns":["timestamp","severity","message","service_name","trace_id","span_id","distinct_id","attributes"]
}'

The CLI sends the active profile’s project on every export lifecycle request. Select it first with anectico projects use <project-id-or-slug> (or configure ANECTICO_PROJECT) when the credential itself is not project-scoped.

Choose CSV for spreadsheet analysis, JSON for structured processing, and Parquet for larger analytic workflows. Always set the narrowest useful project, time range, filters, and columns. Invalid formats, malformed project IDs, invalid or reversed timestamps, and missing internal signal routing are rejected before a job is enqueued.

Exports page through the complete result set instead of silently stopping after 1,000 rows per signal. The search export combines traces and logs; metrics use the explicit metrics signal so metric-specific filters cannot be silently broadened. CSV distinguishes an explicitly present null value (written as null) from a missing field (an empty cell). JSON preserves explicit null values. Large jobs are streamed through bounded temporary files, and jobs that exceed the service’s row or file safety ceilings fail without publishing a partial download.

Monitor and download jobs

anectico export jobs list --limit 50
anectico export jobs list --limit 50 --cursor <next-cursor>
anectico export jobs get <job-id>
anectico export jobs download <job-id> --file ./export.json
anectico export jobs download-url <job-id>
anectico export jobs cancel <job-id> --yes
anectico export jobs retry <job-id>

Each command remains confined to the active project. A job ID from a sibling project produces the same not-found response as an unknown job and cannot be inspected, mutated, or downloaded. Use the exact lowercase hyphenated UUID returned when the job was created; alternate UUID spellings such as uppercase, compact, braced, or URN forms are not accepted.

Failed jobs expose a stable error_code and a safe, actionable error message. Clients can use query_failed, format_failed, or upload_failed for consistent handling without parsing message text; export_failed is the safe fallback for an unclassified failure. Provider responses, storage object keys, request IDs, and other internal diagnostics are not included in the job response; operators can find those details in structured service logs.

Completed results remain downloadable for 24 hours and then move to expired; Anectico deletes the object and refuses new download URLs. Dashboard downloads are served as attachments for CSV, JSON, and Parquet with the deterministic filename anectico-export-<job-id>.<format>, so downloading preserves the current dashboard page and focus. anectico export jobs download accepts only the Anectico API’s own origin, an exact HTTPS origin in ANECTICO_EXPORT_DOWNLOAD_ORIGINS, or loopback HTTP in development. It streams to a private temporary file and atomically publishes a new destination; it never overwrites an existing file or symlink. Treat an exported file as customer telemetry: store it in an approved location, restrict access, preserve only as long as needed, and delete local copies after use. Export does not extend the retention of the source data inside Anectico.

• Search logs, traces, and metrics
• Plans, limits, and retention