Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!
I recently upgraded my references to Seq.Api to the latest v5.0.0 build. I found that the following code threw an exception after the upgrade: var signal = connection.Signals.ListAsync().Result.FirstOrDefault(s => s.Title == "UnitTest"); if (signal == null) return; var result = connection.Events.DeleteInSignalAsync( signal ).ConfigureAwait(false).GetAwaiter().GetResult(); The exception said "400 - Only shared or personal signals can be requested." After digging into the git repo for a bit, I saw that an optional shared parameter had been added to ListAsync (defaults to false). When I changed this value to "shared: true" in the call site, the exception went away. I looked at my Seq installation, and it lists the Signal in question as Shared, with no way to enable/disable that. Is there a reason that shared is defaulted to false, if such a value will prevent it from working with normal signals that are added via the WebApi? Please let me know if you need anymore information. Thanks! Aaron
Posted by Aaron Schnarr 2 years ago
We're happy enterprise users of Seq (great tool), but recently have had a few issues where API keys and shared filters have been deleted by admin users between different teams. Currently, there is no audit log available to ascertain who has deleted the entries (accidentally I'm sure), which would at least help us educate users to be more careful. Better still would be adding some fine-grained authorisation mechanism, so that users can be linked to groups, and admin permissions on API keys and shared filters can be set at group level to better protect these resources.
Posted by Will 2 years ago
Hi all, I'm trying to setup an Azure Kubernetes deplyoment with a SEQ service, using yaml config file, for example: [...] spec: containers: - name: seq image: datalust/seq:latest ports: - containerPort: 80 env: - name: ACCEPT_EULA value: "Y" It works with no issue, but SEQ is running with basic configuration, especially authentication. What I'm struggling with now, is how to configure SEQ container instance, in the config file, in order to setup AAD authentication. I could create a custom docker file in a private registry, based on datalust/seq and change the way the service is executed there, but I would like to keep it simple if possible. Anyway, even if I would do that, I don't know how to setup AAD using seq.exe command line as it seems it is only configurable once you have your instance up and running, which is in contrast with what I want to do: a complete automated deployment. Would you please advise? Cheers, Claudio
Posted by Claudio Duranti 2 years ago
Hello, I'm trying to run the Seq docker container and run it under a virtual path at the address http://localhost/seq The documentation states: > To use a specific hostname, or listen at a virtual path on the server, the listen URIs need to be reconfigured. If I edit the Seq.json file and set the listenerUris to this: ``` "api": { "listenUris": [ "http://localhost:80/seq", "http://localhost:5341/seq" ], ``` When I run Seq from within the docker container with the command: ``` /bin/seq-server/Seq run --storage=/data ``` I'm getting the following error: ``` ──────────────────────────────────────── Seq ♦ Machine data, for humans. ─────────── © 2018 Datalust Pty Ltd ──── Running as server; press Ctrl+C to exit. [04:17:21 INF] Seq "5.0.2394" running on OS "Linux 4.9.125-linuxkit #1 SMP Fri Sep 7 08:20:28 UTC 2018" [04:17:22 FTL] Unable to start Kestrel. System.InvalidOperationException: A path base can only be configured using IApplicationBuilder.UsePathBase(). at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.ParseAddress(String address, Boolean& https) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IServerAddressesFeature addresses, KestrelServerOptions serverOptions, ILogger logger, Func`2 createBinding) at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken) [04:17:22 FTL] Error running the server application System.InvalidOperationException: A path base can only be configured using IApplicationBuilder.UsePathBase(). at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.ParseAddress(String address, Boolean& https) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IServerAddressesFeature addresses, KestrelServerOptions serverOptions, ILogger logger, Func`2 createBinding) at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken) at Microsoft.AspNetCore.Hosting.Internal.WebHost.StartAsync(CancellationToken cancellationToken) at Microsoft.AspNetCore.Hosting.Internal.WebHost.Start() at Seq.Server.ServiceProcess.ServerService.Start() ``` Is running seq with virtual path base supported? Am I doing it wrong? Secondarily, the docker container seems to always run a script that sets the listener URIs to http://localhost:80,http://localhost:5341. I'm having to bypass the docker entry point to just run the shell interactively and attempt to launch Seq manually. This allows me to modify the Seq.json config and not have the container overwrite the changes when it starts. If the scenario I'm hoping for is supported, is there a correct way I should run the seq docker container and specify the listener url with a virtual path? Thanks for any help!
Posted by Joe Camp 2 years ago
Hi, I've setup AAD auth on SEQ which is hosted in a Docker container. I'm getting a "The reply url specified in the request does not match the reply urls" but I'm positive that the reply URL in the AAD application is correct (https://seqserver/aad). Does the SEQ instance need to have the reply URL host as a listen URL (ex: https://seqserver)? If so, how do I set this up with a Docker container? Thanks!
Posted by Yohan Belval 2 years ago
Hi, I recently ran across a situation where Seq was not running (user error), and obviously NLog was not able to successfully log to the Seq target. However, there was no indication provided to the program, aside from NLog writing to it's internal log. Is there any way that you've run across to detect when NLog is unable to write to a the Seq target? I've started looking at the Fallbackgroup option, to have a secondary log target write failed messages to file, to ensure that no data is lost. If this were to occur, what are the options for Seq Api, that we could use to add the dropped/missing entries to the Seq logs AT the original timestamp? Thanks,
Posted by Aaron Schnarr 2 years ago
Hi, I would like to filter events based on relative time, similar to this kind of query: `@Timestamp > ago(1d)` (inspired from [azure log analytics](https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/datetime-operations#date-time-basics) syntax). This way, for a query used often and I am sure there are only a few events (or none), I want to be sure that seq does not try to read data from disk. Perhaps there is another way to search only in recent events ? Regards,
Posted by Thomas Bolon 2 years ago
I just upgraded from 4.1.x (for some x) to 4.2.1113. Something changed that has broken my workflow. When I want to filter by just barely including or excluding an event, I would copy the displayed time stamp of the event to either the "from" or "to" text box. This worked fine in the whatever version of 4.1 that I had, but this does not work in version 4.2.1113. In this newer version, the displayed time stamp looks like 23 Jan 2019 01:23:45.678 but the "to" and "from" text boxes don't like that format. Instead, it seems they require time stamps like 2019-01-25 01:23:45.678 Is this the expected behavior? What is the fastest way in version 4.2.1113 to copy the time stamp of an event into the "from" or "to" text box in an accepted format?
Posted by Tyson Williams 2 years ago
According to the docs, up until v4.2 importing IIS log files was supported by using a third party tool: "The SeqFlatFileImport tool from Octopus Deploy is an alternative that's capable of reading unstructured (plain text) and IIS log files." (https://docs.getseq.net/v4.2/docs/importing-log-files). This information is missing on the docs for v5 (https://docs.getseq.net/docs/importing-log-files). Are IIS log files not supported anymore starting from v5?
Posted by Laurens 2 years ago
I am trying to create a pie chart as seen in this example https://docs.getseq.net/docs/dashboards#section-pie However, under "Type", my only options are "Bar", "Line", "Point", and "Value". Am I doing something wrong? Is there some other choice that I need to make somewhere else in order to see "Pie" show up in that list?
Posted by Tyson Williams 2 years ago
Steps with actual behavior: 1) open your events page 2) enter in the "to" field a time like 2019-01-14 00:34:56.789 3) observe that the URL of the page has changed to end with something like events?to=2019-01-14T06:34:56.789Z The hour and day may adjust according to your time zone (like it did for me) but the value after the decimal place is still exactly "789". 4) refresh the page 5) observe that the URL is unchanged 6) observe that "to" field has changed to something like 2019-01-14 00:34:56 7) open the calendar by clicking on the "to" field 8) close the calendar by clicking somewhere else 9) observe that the URL of the page has changed to end with something like events?to=2019-01-14T06:34:56.000Z Expected behavior: In contrast to the actual behavior in step 6, I expected the "to" field to be unchanged after refreshing the page.
Posted by Tyson Williams 2 years ago
How can we throttle incoming exceptions/batches/events on the Seq side so that Seq doesn't possibly fail when all instances/applications logging to it start screaming? I know that in Settings -> System there's "Raw ingestion payload limit" but that's more related to one client but what if all clients start having problems? Altogether mass of data might be significantly larger. Also I'm aware of batchPostingLimit / queueSizeLimit in Seq sink i.e. on client side which altogether should be good protection but still thinking about something on the Seq side. Any thoughts?
Posted by Rastislav Marko 2 years ago
The documentation at https://docs.getseq.net/v5.0/docs/using-powershell instructs you to have a file called Seq.psm1 alongside your script. The quote is shown below. "With the Seq.psm1 module in the same folder as the script, the example below shows how events are written:" However I can not find Seq.psm1 anywhere. It isn't in the Powershell gallery, a search in the datalust github repo didn't reveal anything, and the only mention of Seq.psm1 in the documentation is that one quote. Can someone point me to where this file is made available?
Posted by Matthew Casperson 2 years ago
Hi, I have the below complex object stored in SEQ. What would be the filter syntax if I want to filter for c.MyList3.Prop1 = "Prop1 Value"? Thanks { "Timestamp": "2019-01-11T15:22:08.8124026-05:00", "Level": "Information", "MessageTemplate": "{@c} order.", "Properties": { "c": { "_typeTag": "C", "MyList3": [ { "_typeTag": "B", "Prop1": "Prop1 Value", "Prop2": 9078, "Dt": "0001-01-01T00:00:00" } ], "Customer": "cust1", "Order": "1234", "ChildClass": { "_typeTag": "B", "Prop1": "Popr 1 Value", "Prop2": 9078, "Dt": "0001-01-01T00:00:00" }, "Dt": "2019-01-11T15:22:08.6414048-05:00" }, "ThreadId": 1, "ApiVersion": "1.2.5000" } }
Posted by Stephane Murphy 2 years ago