elasticsearchgoogle-chrome-extensionelasticsearch-pluginsense

Elasticsearch Sense chrome plugin disabled, need to get dsl queries written in console


I am running Google Chrome Version 61.0.3163.100. I previously was running the Sense (Beta) extension version 0.9.4 until Google Chrome flagged it as malware in the extensions tab. The author of Sense has removed it from the Chrome store and it has been rolled into Kibana and renamed Console.

Problem is all the queries I wrote in the Sense console are not retrievable due to the extension being disabled. Previously, every time I opened the Sense (Beta) extension, all my previous queries would be saved and re-displayed each session. I would like to find the file location where Sense stored my queries for redisplay.

I am running Windows 10. I have tried locating my saved data by going to:

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions

There is nothing identifiable I can find that resembles my old data. Does anyone know where I can retrieve it?


Solution

  • It seems like in the case of the Sense extension, its only persistent data was kept in localStorage (relevant source).

    Whether data recovery will be easy depends heavily on when you last used the extension.

    1. If you last used the extension before Chrome 61 (~ September 2017), then you are in luck: the localStorage database is stored in SQLite 3 format.

      You need to find the corresponding chrome-extension_[some_id]_0.localstorage file under Local Storage in your profile; it's an SQLite database. The ID doesn't seem to be the same as the extension ID.

      You can load it in various tools, including sqliteonline.com for an online browser.

    2. If you need data since update to Chrome 61, you're in a much tougher situation. Chrome 61 switched to LevelDB for localStorage backend, and I couldn't easily extract the data from it.

      See this question for subtleties involved. The database itself is located at Local Storage/leveldb in your profile.

      It seems like Chrome does not delete older SQLite-formatted data, so you can recover at least data from early September.

    FWIW, the ID of the extension appears to have been lhjgkmllcaadmopgmanpapmpjgmfcfig