DocumentationDiscussions
DocumentationDiscussions

Discussions

Ask a Question

Hosting Seq under a virtual path

Hello, I'm trying to run the Seq docker container and run it under a virtual path at the address http://localhost/seq The documentation states: > To use a specific hostname, or listen at a virtual path on the server, the listen URIs need to be reconfigured. If I edit the Seq.json file and set the listenerUris to this: ``` "api": { "listenUris": [ "http://localhost:80/seq", "http://localhost:5341/seq" ], ``` When I run Seq from within the docker container with the command: ``` /bin/seq-server/Seq run --storage=/data ``` I'm getting the following error: ``` ──────────────────────────────────────── Seq ♦ Machine data, for humans. ─────────── © 2018 Datalust Pty Ltd ──── Running as server; press Ctrl+C to exit. [04:17:21 INF] Seq "5.0.2394" running on OS "Linux 4.9.125-linuxkit #1 SMP Fri Sep 7 08:20:28 UTC 2018" [04:17:22 FTL] Unable to start Kestrel. System.InvalidOperationException: A path base can only be configured using IApplicationBuilder.UsePathBase(). at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.ParseAddress(String address, Boolean& https) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IServerAddressesFeature addresses, KestrelServerOptions serverOptions, ILogger logger, Func`2 createBinding) at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken) [04:17:22 FTL] Error running the server application System.InvalidOperationException: A path base can only be configured using IApplicationBuilder.UsePathBase(). at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.ParseAddress(String address, Boolean& https) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IServerAddressesFeature addresses, KestrelServerOptions serverOptions, ILogger logger, Func`2 createBinding) at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken) at Microsoft.AspNetCore.Hosting.Internal.WebHost.StartAsync(CancellationToken cancellationToken) at Microsoft.AspNetCore.Hosting.Internal.WebHost.Start() at Seq.Server.ServiceProcess.ServerService.Start() ``` Is running seq with virtual path base supported? Am I doing it wrong? Secondarily, the docker container seems to always run a script that sets the listener URIs to http://localhost:80,http://localhost:5341. I'm having to bypass the docker entry point to just run the shell interactively and attempt to launch Seq manually. This allows me to modify the Seq.json config and not have the container overwrite the changes when it starts. If the scenario I'm hoping for is supported, is there a correct way I should run the seq docker container and specify the listener url with a virtual path? Thanks for any help!

Azure AD Authenticaiton using a Docker container

Hi, I've setup AAD auth on SEQ which is hosted in a Docker container. I'm getting a "The reply url specified in the request does not match the reply urls" but I'm positive that the reply URL in the AAD application is correct (https://seqserver/aad). Does the SEQ instance need to have the reply URL host as a listen URL (ex: https://seqserver)? If so, how do I set this up with a Docker container? Thanks!

Can multiple instances of Seq share the same data folder?

For example, I have two containers running concurrently that would share the same data folder for redundancy. Is this supported?

Adding Dropped/Missing Log Entries

Hi, I recently ran across a situation where Seq was not running (user error), and obviously NLog was not able to successfully log to the Seq target. However, there was no indication provided to the program, aside from NLog writing to it's internal log. Is there any way that you've run across to detect when NLog is unable to write to a the Seq target? I've started looking at the Fallbackgroup option, to have a secondary log target write failed messages to file, to ensure that no data is lost. If this were to occur, what are the options for Seq Api, that we could use to add the dropped/missing entries to the Seq logs AT the original timestamp? Thanks,

Case insensitive Regex filter query

How do you perform a case insensitive regex filter query? The documentation does not show how this is done and I really do not want to add [] for every character. Documentation: https://docs.getseq.net/docs/query-syntax

Filter by Timestamp relative to now ?

Hi, I would like to filter events based on relative time, similar to this kind of query: `@Timestamp > ago(1d)` (inspired from [azure log analytics](https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/datetime-operations#date-time-basics) syntax). This way, for a query used often and I am sure there are only a few events (or none), I want to be sure that seq does not try to read data from disk. Perhaps there is another way to search only in recent events ? Regards,

Any chance of a Azure PAS offering for SEQ?

My team really likes Serilog / SEQ but management does not want a VM to manage in Azure just for SEQ. thanks

Difficultly filtering by time

I just upgraded from 4.1.x (for some x) to 4.2.1113. Something changed that has broken my workflow. When I want to filter by just barely including or excluding an event, I would copy the displayed time stamp of the event to either the "from" or "to" text box. This worked fine in the whatever version of 4.1 that I had, but this does not work in version 4.2.1113. In this newer version, the displayed time stamp looks like 23 Jan 2019 01:23:45.678 but the "to" and "from" text boxes don't like that format. Instead, it seems they require time stamps like 2019-01-25 01:23:45.678 Is this the expected behavior? What is the fastest way in version 4.2.1113 to copy the time stamp of an event into the "from" or "to" text box in an accepted format?

How to import IIS Logs

According to the docs, up until v4.2 importing IIS log files was supported by using a third party tool: "The SeqFlatFileImport tool from Octopus Deploy is an alternative that's capable of reading unstructured (plain text) and IIS log files." (https://docs.getseq.net/v4.2/docs/importing-log-files). This information is missing on the docs for v5 (https://docs.getseq.net/docs/importing-log-files). Are IIS log files not supported anymore starting from v5?

sql queries

what is the meaning of sql queries? what are the functions of sql queries?

Creating a pie chart

I am trying to create a pie chart as seen in this example https://docs.getseq.net/docs/dashboards#section-pie However, under "Type", my only options are "Bar", "Line", "Point", and "Value". Am I doing something wrong? Is there some other choice that I need to make somewhere else in order to see "Pie" show up in that list?

Bug Report: Losing tenth's of a second

Steps with actual behavior: 1) open your events page 2) enter in the "to" field a time like 2019-01-14 00:34:56.789 3) observe that the URL of the page has changed to end with something like events?to=2019-01-14T06:34:56.789Z The hour and day may adjust according to your time zone (like it did for me) but the value after the decimal place is still exactly "789". 4) refresh the page 5) observe that the URL is unchanged 6) observe that "to" field has changed to something like 2019-01-14 00:34:56 7) open the calendar by clicking on the "to" field 8) close the calendar by clicking somewhere else 9) observe that the URL of the page has changed to end with something like events?to=2019-01-14T06:34:56.000Z Expected behavior: In contrast to the actual behavior in step 6, I expected the "to" field to be unchanged after refreshing the page.

Is there any limit on number of concurrently processed batches or something similar?

How can we throttle incoming exceptions/batches/events on the Seq side so that Seq doesn't possibly fail when all instances/applications logging to it start screaming? I know that in Settings -> System there's "Raw ingestion payload limit" but that's more related to one client but what if all clients start having problems? Altogether mass of data might be significantly larger. Also I'm aware of batchPostingLimit / queueSizeLimit in Seq sink i.e. on client side which altogether should be good protection but still thinking about something on the Seq side. Any thoughts?

Where is seq.psm1?

The documentation at https://docs.getseq.net/v5.0/docs/using-powershell instructs you to have a file called Seq.psm1 alongside your script. The quote is shown below. "With the Seq.psm1 module in the same folder as the script, the example below shows how events are written:" However I can not find Seq.psm1 anywhere. It isn't in the Powershell gallery, a search in the datalust github repo didn't reveal anything, and the only mention of Seq.psm1 in the documentation is that one quote. Can someone point me to where this file is made available?

Email Notification

HI, The 'open this event in SEQ' is pointing to localhost. How can we modify it to the right path to open? We are using the Email + app to notify us through email. Please kindly guide us, thank you

Filter and Complex objects

Hi, I have the below complex object stored in SEQ. What would be the filter syntax if I want to filter for c.MyList3.Prop1 = "Prop1 Value"? Thanks { "Timestamp": "2019-01-11T15:22:08.8124026-05:00", "Level": "Information", "MessageTemplate": "{@c} order.", "Properties": { "c": { "_typeTag": "C", "MyList3": [ { "_typeTag": "B", "Prop1": "Prop1 Value", "Prop2": 9078, "Dt": "0001-01-01T00:00:00" } ], "Customer": "cust1", "Order": "1234", "ChildClass": { "_typeTag": "B", "Prop1": "Popr 1 Value", "Prop2": 9078, "Dt": "0001-01-01T00:00:00" }, "Dt": "2019-01-11T15:22:08.6414048-05:00" }, "ThreadId": 1, "ApiVersion": "1.2.5000" } }

Clubing multiple signal in one folder

Can we create or arrange multiple signals for tracking errors/warning in a folders.

Excludeing Filters

I am trying to find a way to filter out certain noise logs within Seq. With some properties I can just exclude a given value, but for certain properties like collections, the only option is to exclude everything that has that property. What I want to be able to do is define a filter like: Has(Scope) AND Scope[?] = "HealthReportCollector is collecting health checks results." And then say exclude these results. Is there a way to mark a filter as an exclude besides the options when clicking on the x by properties?

Logging in when AD is down

Hi all We're using AD for our logins to seq's web UI. We have had issues with our AD setup before where SEQ is unable to connect which means we aren't able to login. We use AD for other features in our app, if AD goes down, we aren't able to login to diagnose. Is there a way to configure a single user that isn't tied to AD that will let us login? Regards Ray

Can WriteTo method be brought to throw exception when batch-sending (to SEQ) fails?

We are using Serilog/Seq, like this: > _logger = new LoggerConfiguration().WriteTo.Seq(seqServerUrl, apiKey: decryptedSeqApiKey).MinimumLevel.Debug(). Enrich.WithProperty("Environment.SourceName", WebConfigurationManager.AppSettings["seq.Environment.SourceName"]). Enrich.With(new AuditLogEnricher(mapDataDelegate)). CreateLogger(); However this configuration does **not** throw an exception when the batch-sending fails - and we would very much like to *detect* when SEQ isn't available, so that we can put our application in *suspended' mode - while we (or the network or hosting guys) fix the issue and then resume normal operation subsequently. Ps. We are using SEQ as a sink for our AuditLog and having traceability broken would be a problem (at least for a longer period of time). Changing WriteTo -> AuditTo might not be an option, since that AFAIK sends every log synchroniously, thus becoming very bandwith/network traffic heavy and also slowing down the application while we wait for the logging to complete. **Any good ideas on how to approach this?** Ps. We have thought about creating a 'job' that uses AuditTo as a kind of Heartbeat every 5 minutes - and then putting the entire application in 'suspended' mode if it fails. But that solution kind of feels like a workaround...