Exporting passwords used in the infra

[JanoutV]

Hello there, I would like to create a wordlist from password which were used on my T-Pot infra. Does anybody have an idea on how I could export all of them in the easiest way possible? I like how the Kibana dashboard shows the most used passwords, as on the picture

but I'd like to get all of the passwords used into a single wordlist file.

[t3chn0m4g3]

You find example queries in the discussions and in /opt/tpot/bin/.

[lcia-projects]

i've got a python script that does this. it builds a text file and a csv with the results.
it was kinda custom to what i was doing, but i can post the code if you'd like.

i basically used python + elasticsearch_dsl library. made one query for all the usernames in the last hour, and another for the passwords in the last hour. it pulled the data, consolidated it.. then wrote a csv and a text file of each.

[JanoutV]

If you could post it so I could use it as a headstart that would be great!
If I make any modifications I could share those back.