Offline Report

Introduction

This article will provide information on converting archive data that you have stored as live data, and on the query syntax that the offline report process accepts.

Archive Data

We define our data that has undergone parsing and can be compressed and stored for a long time in the /opt/var/log/archive directory as archive data. With Elasticsearch service, we can store our live data for a certain period depending on hardware specifications and disk capacity, and if data needs to be stored beyond this period, it is kept as archive. By default, your archive data is kept for 365 days.

Archive data is organized by day under /opt/var/log/archive/YYYY/MM/DD/. Each day contains one or more compressed .json.gz files together with a .summary file that records how many events each file contains.

Offline Report

The offline report process involves writing our compressed data stored in the archive back to the Elasticsearch service as an index, and we call this operation reindexing. Every archived event in the selected time range is read and checked against your query, and the matching events are written to a new index. When this process is completed, you can perform fast and easy searches and prepare reports.

The offline report process is faster in a logsign that works in a cluster structure. In cluster structures, the offline report process splits the data into pieces on multiple servers using spark technology and transfers the data back to the index. This is the reason why fast offline report process is achieved in cluster structures.

In logsign operating as single (allinone), the offline worker service works, and with this service, your archive data is transferred back to the Elasticsearch service and turned into live data.

To start the Offline Report process, access the Reports -> Offline Reports panel and click New Offline Report.

The New Offline Report form contains the following fields:

• Description: The name of the report. It is shown on the report card and in the search screen.
• Custom Path (Optional): Leave it empty to use the standard archive directory (/opt/var/log/archive). Fill it only if your archive files are located in another directory, for example an archive that was restored from a backup to another disk. The directory must keep the same YYYY/MM/DD structure with the .json.gz and .summary files, and it must be readable from the server(s) that run the offline report.
• Query: The query that selects the events to be reindexed. See the Query Syntax section below.
• Time Range: The period to be read from the archive. It is applied to the Time.Generated field of the events. The time picker works with minute precision; to cover a whole day, select 00:00 of the next day as the end of the range.
• Notify when job is done: Sends an e-mail and an in-app notification to the selected users when the report is completed. This option is shown only when the mail settings are configured; otherwise the form displays the warning "If you want to get email notifications, Mail Settings must be configured."

Before starting the offline report process, a query should be created for the logs that need to be taken.

In the offline report process, you cannot use mini queries or full-text search; every condition must be written as Field.Name:value. Wildcards, OR lists, NOT and ranges are supported as described in the Query Syntax section.

In the following example, a query is created to find the successful login activities of the Administrator and admin users.

Source.UserName:("Administrator" OR "admin") EventMap.ID:"10101"

By selecting the time range and clicking the Check Archive button, the archive data is checked.

With this information, we can understand that we have two files with a total data size of 587.09 MB in the specified date range, and the query will search within 3,075,346 data.

If the query is not accepted, the reason is shown under the form instead of the file list (for example when a word without a field name is entered). Correct the query and click Check Archive again.

To start the process, we complete the process with the Create Offline Report button under the file list.

When the offline report is started, you can follow the process in the Status Running section. The card also shows the number of matched events.

If you need multiple offline reports, you can also create the offline report process at the same time. Logsign will queue your offline report process and start the next offline report when the process is completed.

You can monitor the offline report process instantly before it is 100% complete. Click the ⋮ menu on the card and then the Search button for this process. The Info button shows the archive files of the report, and the Delete button cancels a running report or removes a completed report together with its index.

The Search button opens the Search screen on the report's own index with the report's time range selected, so the results contain only the events of this offline report.

Query Syntax

Offline report queries are applied to the archived events one by one by Logsign, not by Elasticsearch. The following rules apply.

• Every condition must be written as Field.Name:value. A word without a field name (for example Administrator) is not accepted.
• Values are compared exactly and are case sensitive. Source.UserName:administrator does not match the user Administrator.
• Write the value in double quotes when it contains a space or a special character such as @ / \ : or parentheses, for example Source.UserName:"LOCAL SERVICE" or Source.UserName:"user@domain.com". Quotes are optional for plain values such as user names, IP addresses and numbers.
• Numeric values can be written with or without quotes: Event.VendorID:4624 and Event.VendorID:"4624" give the same result.
• Use the field names as they appear in the event, for example EventSource.Description. The .raw fields of the Search screen are not available in offline reports.
• The selected time range is applied automatically; you do not need to add a Time.Generated condition for it.

Supported operators

Not supported

• Full-text search (a word or phrase without a field name) and mini queries.
• Regular expressions, fuzzy (~) and proximity search, the ? wildcard, and comparison operators such as > and <. Use a range instead of a comparison.
• CIDR notation for IP addresses (10.0.0.0/8). Use a wildcard instead, for example Source.IP:10.0.*.
• Case-insensitive matching.

Performance: All archived events in the time range are read regardless of the query, but only the matching events are written to Elasticsearch, and writing is the slow part of the process. A match-all (*) query or a very broad wildcard query reindexes a large number of events: the report takes much longer, the resulting index is large (in our test approximately 3 KB per event), and the additional disk usage may exceed the disk threshold that pauses offline reports. Such queries are not recommended. Add at least a log source, category or user condition and keep the time range as short as possible; use * only when you really need every event of a short period.

Note: The same field cannot be equal to two different values at the same time. A query such as Source.UserName:"admin" AND Source.UserName:"Administrator" never matches; Logsign shows a warning on the report card for such queries. Write Source.UserName:("admin" OR "Administrator") instead.

Query Sample

Successful login activities of two users:

Source.UserName:("Administrator" OR "admin") EventMap.ID:"10101"

Allowed firewall traffic from a source IP address:

EventSource.Category:"Firewall" Source.IP:"10.100.100.103" EventMap.SubType:Allow

Windows logon events (4624) excluding the SYSTEM account:

Event.VendorID:"4624" NOT Source.UserName:"SYSTEM"

Login and logout activities of a user:

EventMap.SubType:(Login OR Logout) AND Source.UserName:"smbuser"

All events of a log source:

EventSource.IP:"10.100.100.11"

All events of several log sources:

EventSource.IP:(1.1.1.1 OR 2.2.2.2 OR 10.100.100.150)

Events whose EventMap.ID is within a range:

EventMap.ID:[10100 TO 10199]

Events of a specific hour within the selected time range:

Time.Generated:["2026-08-24 08:00:00" TO "2026-08-24 09:00:00"]

Troubleshooting

• Check Archive shows no files: There is no archive data for the selected time range in the archive directory (or in the Custom Path). Check the /opt/var/log/archive/YYYY/MM/DD/ directories on the server.
• Match Count is 0 after completion: The query is valid but no event matched. Check the spelling and the letter case of the values, remove any .raw suffix from the field names, and confirm the values on the Search screen for a period that is still live.
• Status Failed with "disk_usage_critical": Offline report processing is paused automatically while the disk usage is above the warning threshold, because reindexing writes new data to Elasticsearch. Free up disk space and start the report again.
• The report takes very long: The time range is long or the query matches most of the archive (*, broad wildcards). Split the period into shorter reports and narrow the query. The events that are already reindexed can be searched while the report is still running.
• To stop a running report, choose Delete from the card menu. The report record and its index are removed.