Kibana Discover CSV export: the message column is JSON
Share → CSV in Discover gives you a spreadsheet of log lines. The interesting column is the one the spreadsheet cannot open.
What the export looks like
The header carries Elastic Common Schema names — @timestamp, log.level, service.name, host.name, trace.id, message. Every row is one document. When the service logged structured JSON, the message cell holds that JSON as a string, and because the cell is quoted, every quote inside it is doubled: "{""event"":""stripe.charge.completed""}". A spreadsheet shows the doubled quotes and stops there.
Reading it as rows
Pasted or dropped, the export is detected as CSV and asks its reading question — separator, header row — with a preview beside the lines. Read as rows opens 6 rows; the @timestamp and log.level columns are recognised as the time and the level, so the level chips count INFO, WARN and ERROR the way they would over a raw log.
The message column is where the export earns the trip: 3 of its 6 cells parse as JSON, and each shows Unpack. Opened, the cell reads as nested rows in the panel — event, amount, currency, order_id — while the table keeps the string the file wrote. Filter still works on the whole row (field=value, /regex/, the level chips), and Convert writes the rows out as JSON, NDJSON or a Markdown table.
The other Kibana paste
Not every Kibana copy is an export. Selecting rows in the Discover table and copying gives text: the time in Kibana’s own display format — Apr 21, 2026 @ 14:32:08.412 — then the columns separated by runs of spaces. That is a raw log to the engine, and it has a pattern written for exactly this paste (“Kibana Discover · copied rows”), so it reads as records without a regex from you.