Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!
Hi DataLust Team and contributors! We have a Seq server that prior to upgrading to 4.2, we used to provide analytical client usage data for our organization. Reports were updated and cached so that the entire time span was never requeried. In 4.2, we are seeing 30 day time span queried, which for 8GB of RAM on our Seq server, is not ever completing before the timeout expires. This has effectively disallowed us from using Seq for reporting and we have been using manual database queries instead. Is there any intuition into this situation you can provide for our organization?
Posted by Beshoy Hanna 9 months ago
I'm looking into the Sql query syntax for generating time series reports via Sql Queries over the Web Interface. If data is store as a string (i.e. a collation of named values via a Dictionary), is there a way to plot those values in Timeseries? I tried a few variations using the query (select @Timestamp, Telemetry.ValueName from stream where Telemetry.ValueName is not null): "ValueName": "0" => This did not plot "ValueName": 0 => This plotted as expected. Is there a way to tell Seq to convert a string value to numeric for reporting purposes?
Posted by Aaron Schnarr 9 months ago
 {"@t":"2018-07-18T19:05:34.5554422Z","@mt":"Error serving {RequestUrl} (token: {ErrorToken})","@l":"Error","@x":"System.OverflowException: Value was either too large or too small for an Int32.\r\n at System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info)\r\n at Seq.Server.Web.Api.DataModule.<Query>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Seq.Server.Web.Api.DataModule.<<-ctor>b__3_0>d.MoveNext()","RequestUrl":"http://evg-credoseq01:8080/api/data?q=select%20count%28%2A%29%20as%20count%0D%0Afrom%20stream%20%0D%0Awhere%20%28%40Timestamp%20%3E%3D%20DateTime%28%272018-07-18T19%3A00%3A30.000Z%27%29%29%0D%0A%20%20and%20%28%40Timestamp%20%3C%20DateTime%28%272018-07-18T19%3A05%3A34.342Z%27%29%29%0D%0Agroup%20by%20%40Level%0D%0Alimit%2010000%0D%0Afor%20window%285s%29%0D%0A&signal=&timeoutMS=40000000000000","ErrorToken":"e9cf1ba7899a4ab38b39540d19c7288a","RequestId":"6eaee67b-fc25-4d58-9517-8d9bb597535d"}
Posted by Beshoy Hanna 9 months ago
Is there a way to set an alert that allows for spikes? For example, say I'm processing messages in a queue from an external process I control. Messages are process extremely quickly from the queue and I have an alert set for count > 100 to ensure the process feeding the queue hasn't stopped (which it occasionally does). Periodically, an external process dumps 2000 messages to the queue, triggering the alarm, but these messages are processed quickly enough to clear the queue within twenty minutes. Is there a way to take the Max value across the timeslice window and compare that to the current value when setting the alarm?
Posted by Kevin Rich 9 months ago
Hey there, We use Seq in production, and our project config all point at `localhost:5341` for logging in Dev mode, so I've been running Seq locally for a while now and find it very useful for debugging. I've recently had to wipe and reinstall my laptop, and now I can't get Seq to run locally anymore: - install works fine - setup with HTTP (not HTTPS) endpoint `http://localhost:5341/` (default) - no thumbprint - service reconfigures successfully When I *Browse Seq* or hit the URL directly, I get redirected to `https` then get an SSL_PROTOCOL_ERROR from chrome because no cert is bound. When I configure this to use SSL (using the thumprint of the LOCAL_MACHINE localhost cert) it "works" fine, but license blocks me from querying the logs. Not sure if it's related, but when I go to reconfigure it, the defaults are always there - even when I set up SSL + thumprint. Not sure where the http->https redirect is coming from?
Posted by Andrew Katsivas 9 months ago
We're looking at using Seq to log telemetry from multiple devices, with multiple properties per telemetry object. What is the recommended way to archive specific Seq log events? For example, if we wanted to go through historical log events and store the telemetry data in a MongoDb, what would be the best approach? Also, is there a way to configure the type of data store that Seq uses?
Posted by Aaron Schnarr 9 months ago
My Seq installation is running on a machine in UK time, currently UTC +01:00. All of the servers logging to it are in the same time zone. I have an email notification app set up (Digest Email, up-to-date), using the default template from the github repo. This specifically includes the time as "LocalTimeStamp", but it is always displayed as +00:00. I've looked at the events in Seq using the "Raw JSON" view, and the timestamps there are all in UTC too. Seq UI displays times in local as expected, but the event data itself seems to have all times converted to UTC and therefore the time zone is unavailable to the LocalTimeStamp property. I cannot see a setting to control this behaviour. Is there any way I can get LocalTimeStamp to actually be local rather than UTC? I'm not massively bothered whether this is achieved by storing the timestamps in whatever they were recorded in, or by conversion to local before they are passed to the Apps.
Posted by Richard Lawley 9 months ago
This is not a question so much as a feature suggestion: Because we have ended up with a _lot_ of signals, it would be great if we could organize signals in the UI into some sort of tree or folder structure to make it easier to find stuff fast. It's a really, really great product.
Posted by Jim McFadden 9 months ago
My team are trying out Seq, one of the issues that we are facing is when sharing links for filtered results the query string contains single quotes which when pasted into something like Slack the trailing quote is ignored. Presumably it is expecting the single quote to be escaped as %27. /#/events?signal=(signal-17~signal-15)&filter=CorrelationId%20%3D%20%2798df009c-681c-4e6f-93c8-29eaa0ef8a10' Is there a way to resolve without waiting for a code fix?
Posted by Matt Davis 9 months ago
Hi, Super cool product, love using it and it significantly reduced time to fix issues. If I find issues on the readme.io docs, how do I tell you guys about it? 1) On this page: https://docs.getseq.net/docs/formatting-html-email The email example has a broken link to an old GitHub page. 2) The example of the list of properties is great, but I reckon the most obvious use case it to grab the "Environment" property associated with the API Keys and use that in the email title for alerts. That way, when I get an alert email, I'll know whether its UAT, Staging or Production. I'm pretty sure its something like: Error happened in {{$Properties["EnvironmentCode"]}} But it would be great to have an example like that.
Posted by Stephan Dekker 9 months ago
Hi, I'm importing a lot of old events from different sources to provide an ad-hoc reference, but during the import I get this message: An error occurred writing to event storage. I looked at the "extents" directory, and that contains exactly 1000 directories. If I add an event that is written in an existing directory it succeeds, but if it needs to add another directory it fails. Is Seq, by any chance, limited to 1000 directories? Is there a way to extend this limit? Much appreciated
Posted by Marijn 10 months ago
Hi, I've set up some dashboard alerts which send emails. I'd ideally like to be able to use the same app for all the alerts. Can I pull out information relating to the alert in a template? Particularly the subject line. Ideally the subject would include the dashboard widget that the alert came from. In the default alert body this comes through as Dashboard Name\Chart name (as in "alert condition {condition} detect on {dashboard name}\{chart name}"). Thanks, Dan.
Posted by Dan Woolstencroft 10 months ago