Built-in Properties

Search expressions and queries can make use of system-provided data.

All Seq events expose a set of built-in properties that are distinguished by the @ symbol in their name:

PropertyDescriptionExample ValueUsage
@ArrivedAn integer indicating the order in which the event arrived at the Seq server12344@Arrived <= Arrived('event-d8ce...0000')
@DataThe internal representation of the event as a single structured object.{@t: ...}Contains(ToJson(@Data), 'coffee')
@ElapsedA convenience property containing @Timestamp - @Start, giving the duration of the span in Seq's native 100 nanosecond tick resolution637840179774790019@Elapsed > 500m
@EventTypeA hash of the message template that was used to generate the event0x5432a8ff@EventType <> 0x5432a8ff
@ExceptionThe exception associated with the event if any, as a string'System.InvalidOp...'@Exception like '%zero%'
@IdThe event's unique id in Seq'event-d8ce...0000'@Id = 'event-d8ce...0000'
@LevelThe logging level of the event, as a string'Warning'@Level <> 'Warning'
@MessageThe text message associated with the event'Failed to open file...'@RenderedMessage like 'Failed%'
@MessageTemplateThe message template used to generate the event'Logged in {Username}'@MessageTemplate = 'Logged in {Username}'
@ParentId(Optional) The span identifier of the parent span of this span'180ab3544e957c9...'@ParentId = '180ab3544e957c9...'
@PropertiesAn object containing properties associated with the event{Name: 'alice', Count: 10}@Properties['some irregular identifier']
@ResourceAn object containing properties associated with the event origin, if any{'': 'Example'}
@ScopeAn object containing properties related to the scope that generated the event, if any{'name': 'java.awt.event'}
@SpanIdThe span identifier associated with the event, if any, as a string'180ab3544e957c9...'@SpanId = '180ab3544e957c9...'
@StartThe timestamp indicating the start of a span; convert to human-readable text with ToIsoString(@Start)637840179774790019@Start > DateTime('2015-01-13 06:00Z')
@TimestampThe timestamp associated with the event; convert to human-readable text with ToIsoString(@Timestamp)637840179774790019@Timestamp > DateTime('2015-01-13 06:00Z')
@TraceIdThe trace identifier associated with the event, if any, as a string'6cf23c2886cbef...'@TraceId = '6cf23c2886cbef...'


Quick filter shortcuts

Many queries listed here are provided as one-click shortcuts via the row of blue links beneath the message text in an expanded log event - Id, Level, Type and so-on.