Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!
Hi, my text file is the output of Oracle Sqlloader : ... Tabella DDWH02_SM.TWRK_ANZ_RETL: caricamento riuscito di 1289 Righe. 0 Righe non caricate causa errori nei dati. 0 Righe non caricate perché nessuna clausola WHEN è riuscita. 0 Righe non caricate perché tutti i campi erano nulli. Dimensione dell'array di associazione non usata nel percorso diretto. Righe dell'array di colonne : 5000 Byte buffer di flusso: 256000 Byte buffer di lettura: 1048576 Totale dei record logici saltati: 1 Totale dei record logici letti: 1289 Totale dei record logici rifiutati: 0 Totale dei record logici scartati: 0 Totale dei buffer di flusso caricati dal thread principale SQL*Loader: 2 Totale dei buffer di flusso caricati dal thread di caricamento SQL*Loader: 7 Esecuzione iniziata il Mar Lug 14 11:30:23 2020 Esecuzione terminata il Mar Lug 14 11:30:23 2020 ... For me, the important lines are only : Totale dei record logici saltati: 1 Totale dei record logici letti: 1289 Totale dei record logici rifiutati: 0 Totale dei record logici scartati: 0 To filter only these lines, using command seqcli ingest -i mylogfile.log --invalid-data=ignore -x="Totale dei record" but the log message resulting on SEQ is empty. Please can you explain how to extract only interesting lines from a plain text log file ? Thanks
Posted by Claudio Barca about a year ago
Hi, What I'm trying is to using hashicorp nomad to run the Seq server. The streams throws the error: Command run: seq run --name="name" --storage="D:\seq_data" [13:21:12 INF] Seq detected 12809.474048 MB of RAM [13:21:13 INF] Seq listening on ["http://localhost:5341/"] [13:21:13 FTL] Failed to start server System.IO.IOException: The handle is invalid. at System.ConsolePal.set_TreatControlCAsInput(Boolean value) at System.Console.set_TreatControlCAsInput(Boolean value) at Seq.Server.Cli.RunCommand.RunInteractive(Func`1 bootstrap, TextWriter cout) Just want to ask that does this Server command line allow for non-interactive mode?
Posted by Nicholas Tan about a year ago
Recently I changed the listening port of seq, which lost all my previous log. I followed the steps in Seq Admin. I want to bring back the logs. Is this possible to bring back the log files to the same server, or bring back to another server. Here I want to mention that I did not install any archive app. I am totally dependent on Seq log files.
Posted by Kamran Asim about a year ago
Dear Support, if we would dockerize Seq with a windows container, could we distribute the docker image among our developers so they can create their individual containers, under your free license? One Seq container (and thereby one running instance of Seq) would still just be used by one developer. Is this usage scenario possible without a violation of your free license? Best regards
Posted by Stephen Ahmad about a year ago
Hi NIck, I use SEQ with SeqLog into Python environment, and running fine with settings from config file, as is: seqlog.configure_from_file('./logging-config.yml') I would enrich all messages with custom properties defined into config file, (as ApplicationName or EnvironmentNAme), **without add the property for each message**. How to ? Thank's
Posted by Claudio Barca about a year ago
When typing in the query "@M" I am offered two options @Message and @MessageTemplate. How can I select between them using the keyboard? I Noticed that if there is only one option I can use Tab to autocomplete but I am looking for ways to work mouse free (as much as possible). Is there a keyboard shortcut cheatsheet for Seq?
Posted by Dani Avni about a year ago
I run seq docker container using this command: docker run -d --restart unless-stopped --name seq -e ACCEPT_EULA=Y -v //d/Logs/Seq:/data -p 8081:80 datalust/seq:latest Docker container is up and running. But in logs I found this {"@t":"2020-07-03T18:34:31.1510983Z","@mt":"Seq {SeqVersion} running on OS {OSCaption}","SeqVersion":"2020.1.4235","OSCaption":"Linux 4.14.154-boot2docker #1 SMP Thu Nov 14 19:19:08 UTC 2019","SourceContext":"Seq.Server.Features.Diagnostics.EnvironmentInformationWriter"} {"@t":"2020-07-03T18:34:31.2140954Z","@mt":"Seq detected {TotalRAM} MB of RAM","TotalRAM":1037.53728,"SourceContext":"Seq.Server.Features.Diagnostics.EnvironmentInformationWriter"} {"@t":"2020-07-03T18:34:31.7707651Z","@mt":"Seq listening on {ListenUris}","ListenUris":["http://localhost/","http://localhost:5341/"]} {"@t":"2020-07-03T18:34:31.8006169Z","@mt":"Opening event store at {StreamPath}","StreamPath":"/data/Stream/stream.flare","SourceContext":"Flare.Cluster.StorageNodeCoordinator"} {"@t":"2020-07-03T18:34:31.8511073Z","@mt":"Opening metastore {MetastorePath}","MetastorePath":"/data/Documents/documents.lmdb","SourceContext":"Quince.Storage.Lmdb.LmdbDocumentStore"} {"@t":"2020-07-03T18:34:31.8713447Z","@mt":"Closing event store","SourceContext":"Flare.Cluster.StorageNodeCoordinator"} {"@t":"2020-07-03T18:34:31.8745417Z","@mt":"Uncaught exception from worker {WorkDescription} ({WorkId})","@l":"Error","@x":"Autofac.Core.DependencyResolutionException: An exception was thrown while activating Seq.Server.Web.Authentication.SeqOidcAuthenticationScheme -> Seq.Server.Features.Settings.SystemSettings -> λ:Quince.DocumentStore -> λ:Seq.Server.StorageSubsystem.\n ---> LightningDB 0: Failed to open environment at path /data/Documents/documents.lmdb\n --- End of inner exception stack trace ---\n at Autofac.Core.Resolving.InstanceLookup.Activate(IEnumerable`1 parameters, Object& decoratorTarget)\n at Autofac.Core.Resolving.InstanceLookup.<>c__DisplayClass6_0.<Execute>b__0()\n at Autofac.Core.Lifetime.LifetimeScope.GetOrCreateAndShare(Guid id, Func`1 creator)\n at Autofac.Core.Resolving.InstanceLookup.Execute()\n at Autofac.Core.Resolving.ResolveOperation.GetOrCreateInstance(ISharingLifetimeScope currentOperationScope, IComponentRegistration registration, IEnumerable`1 parameters)\n at Autofac.Core.Resolving.ResolveOperation.ResolveComponent(IComponentRegistration registration, IEnumerable`1 parameters)\n at Autofac.Core.Resolving.ResolveOperation.Execute(IComponentRegistration registration, IEnumerable`1 parameters)\n at Autofac.Core.Lifetime.LifetimeScope.ResolveComponent(IComponentRegistration registration, IEnumerable`1 parameters)\n at Autofac.Features.LazyDependencies.LazyRegistrationSource.<>c__DisplayClass5_1`1.<CreateLazyRegistration>b__1()\n at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode)\n at System.Lazy`1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor)\n at System.Lazy`1.CreateValue()\n at System.Lazy`1.get_Value()\n at Seq.Server.ServiceProcess.SystemServices.Start(CancellationToken& cancel)\n at Seq.Server.ServiceProcess.ServerService.<Start>b__8_0(CancellationToken cancel)\n at Flare.Workers.WorkerPool.<>c__DisplayClass6_0.<Run>b__0(CancellationToken ct)\n at Flare.Workers.WorkerPool.<>c__DisplayClass7_0`1.<Run>g__DoWork|0()","WorkDescription":"Start background processes","WorkId":"3507f033-2175-4170-9ee8-2ef0fa0db8c9","SourceContext":"Flare.Workers.WorkerPool"} I am using docker toolbox for running the container. Once the container started, I could see the files generated on my local system, but got stuck with this error.
Posted by annamalai about a year ago
Hello, I have a win server 2012, without IIS installed. The web UI of SEQ is running fine at 5341 port. Using this code and this settings file I cannot write any message to log, the server response is always : requests.exceptions.HTTPError: 403 Client Error: URLBlocked for url: http://localhost:5341/api/events/raw I tried to set 127.0.0.1, or IP, or localhost, always the same issue. I have set permission to IIS_IUSR to Seq folder. Any suggest ? Thanks ----------------------------- import seqlog import logging import yaml seqlog.configure_from_file('./logging-config.yml') logger = logging.getLogger() logger.info('This is the root logger****') # Use another logger another_logger = logging.getLogger('another_logger') # Indexer-style logger.info("Hello, %s!", "World****") # Message template style logger.info("Hello, {name}!", name="World****") # Logging to another logger another_logger.info('This is another logger****') --------------------------------- logging-config.yml: # This is the Python logging schema version (currently, only the value 1 is supported here). version: 1 # Configure logging from scratch. disable_existing_loggers: True # Configure the root logger to use Seq root: class: seqlog.structured_logging.StructuredRootLogger level: INFO handlers: - seq - console loggers: # A non-root logger. another_logger: class: seqlog.structured_logging.StructuredLogger propagate: False level: INFO handlers: - seq - console handlers: # Log to STDOUT console: class: seqlog.structured_logging.ConsoleStructuredLogHandler formatter: seq # Log to Seq seq: class: seqlog.structured_logging.SeqLogHandler formatter: seq auto_flush_timeout: 3000 # milliseconds # Seq-specific settings (add any others you need, they're just kwargs for SeqLogHandler's constructor). server_url: 'http://localhost:5341/' api_key: 'my aAPI key' formatters: seq: style: '{'
Posted by Claudio Barca about a year ago
Hi, On my Seq server - installed on a openshift (kubernetes) plateform - the RAM cache coverage is extremely low (0,083 days). The Process working set is about 7Go and the System memory utilization is less than 30%. The total plateform RAM is 48Go but Seq is configured to use maximum 40% of it (so about 29Go) (using the configuration property cache.systemRamTarget : 0.40). What can explain such a low value ?
Posted by Guilhem about a year ago
Hi, I'm trying to manually delete events from the stream using a query (@EventType = 0x64E241FF AND Contains(message, 'xxxxxx')) but it almost everytime fails with a message 'Event deletion failed' without further explaination. Is there a way to know why deletion failed ? And How to fix this so I can delete theses events ?
Posted by Guilhem about a year ago
I have a server for Seq that had a certificate expire causing the inbound events to fail. On the web server where the events are generated I have Seq installed locally and the missing events are there. I need to find the best way to replicate the missing events from the web server to the seq server without duplicating events if possible. Also what is the recommendation for how to handle when something happens to the Seq server and has stopped allowing connection from the web server sending events. I assume the back and restore might be the best option but I want to avoid duplicate records if possible
Posted by Brian Moore about a year ago
I am trying to create a new dashboard with a query, but no matter what I put in for my group by time slice (time(6h) in this case) Seq always removes it and defaults to a time(5s) slice. Is this a bug or is this the expected functionality? Am I missing some configuration setting?
Posted by Nick Lillie about a year ago
Hello Support, During the last week I've been doing some testing with the API. I started off with using the NuGet package and had some challenges but In the end I had better success just writing my own HTTP Client in .NET Core 3.1 and have been sending my own GET requests directly to the Seq Api. I'm using Postman and my own Swagger UI for testing. I'm just a little stuck however while testing a query through the Api using a date&time based search. In the Seq UI via the browser, I used the 'datetime picker' and ran a simple search for events received just from the beginning of today (the results produced just one row/event which is correct as I'd only sent one log event to the Seq server today) http://localhost:5341/#/events?from=2020-06-28T00:00:00.000Z (URL Query string from the Seq Browser UI) However when I run a similar a query through Postman to the Api, I get a lot more events coming back as far as yesterday. Not sure why this is happening? http://localhost:5341/api/events?from=2020-06-28T00:00:00.000Z (GET request used in Postman) I have reviewed the documentation but I couldn't find any examples that covered queries directly to the API. I'd be grateful if you could provide a couple of URI examples. The most common types of search criteria I'm wanting to figure is as follows: > GET events within last hour or day or X hours or X days. > GET events between a start and end period using DateTime filters. > Use paging via the Api to prevent server melt down when there are lots of rows to retrieve from a large query i.e. being able to page through the results bit by bit. Once I understand how to query using time/date through the Rest Api then I should hopefully be able to move forward. I'm already using the SQL Queries via the API (I had to derive my own logic to build up the URI string correctly but this part is working OK) Thanks in advance.
Posted by OLIVER BENTLEY about a year ago
Dear Support, I created a console using .NET Core 3.1 using your code snippet from https://github.com/datalust/seq-api/blob/dev/example/SeqQuery/Program.cs I'm really struggling here in not understanding how this should work, the console starts then stops straight away with an exception code 1 error. The code examples dont appear to provide any detailed guides in how to use them. Example is the "using DocoptNet;" library as seen in the example code; I had to search for this nuget package not knowing what it does having never used it before, are we supposed to use the console to enter the connection details or should this be hard coded in the example? Do you have a proper sample project to download? i feel i'm not going to get anywhere without a bit more understanding in the example apps and how to even connect successfully to Seq, thanks
Posted by OLIVER BENTLEY about a year ago
Hello, my question is not directly related to Seq. But maybe you have some insights if this might work or not. I want to ingest Docker logs from my local Docker instance into Seq. The Seq and Sqelf instances are running inside Docker. I added the settings to Docker, but i don't see any Docker related logs in Seq. Sqelf is listening on udp:12201 { "log-driver": "gelf", "log-opts": { "gelf-address": "udp://0.0.0.0:12201" } } I have other processes logging through Sqelf without problems. So the general setup works. Maybe this is caused by "inception" as I'm trying to log from the Docker host to a container that is probably not running (early enough). Any idea?
Posted by Josh D. about a year ago
Hi there, I have a Kubernetes Cluster, where Seq is running in a pod. I can add a retention and it is working fine, but if the Seq pod was deleted and restarted by the rules of kubernetes, the retention will be deleted also. Is there a way to automatically add a retention on start, or to preconfigure it. Regards Ben
Posted by Ben about a year ago