Seq Documentation and Support

Seq Documentation and Support

Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!

Get Started    

Built-in Properties and Functions

Seq filters and queries can make use of system-provided functions and data.

Built-in Properties

All Seq events expose a set of built-in properties that are distinguished by the @ symbol in their name:

Property
Description
Example Contents
Usage

@Arrived

An integer indicating the order in which the event arrived at the Seq server

12344

@Arrived <= Arrived('event-d8ce...0000')

@Document

The full JSON document representing the event, as a string

{ "Timestamp": ... }

Contains(@Document, 'coffee')

@EventType

A hash of the message template that was used to generate the event

0x5432a8ff

@EventType <> 0x5432a8ff

@Exception

The exception associated with the event if any, as a string

System.InvalidOp...

@Exception like '%zero%'

@Id

The event's unique id in Seq

event-d8ce...0000

@Id = 'event-d8ce...0000'

@Level

The logging level of the event, as a string

Warning

@Level <> 'Warning'

@Message

The text message associated with the event

Failed to open file...

@RenderedMessage like 'Failed%'

@MessageTemplate

The message template used to generate the event

Logged in {Username}

@MessageTemplate = 'Logged in {Username}'

@Properties

A dictionary with all properties associated with the event (Seq 3.1)

{"Name": "alice.example", "ThreadId": 10}

@Properties['some irregular identifier']

@Timestamp

The UTC timestamp associated with the event

2015-02-28T13:56:20.293Z

@Timestamp > DateTime('2015-01-13 06:00Z')

Quick filter shortcuts

Many queries listed here are provided as one-click shortcuts via the row of blue links beneath the message text in an expanded log event - Id, Level, Type and so-on.

Functions

The built-in functions provide additional ways to work with structured data.

Function
Description
Usage

Arrived(id)

Given an event id, evaluates to that event's arrival order. Used in conjunction with the @Arrived built-in property.

@Arrived <= Arrived('event-78f6229870b208d2096c030000000000')

Contains(text, pattern)

Searches within a text value for a pattern.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.

Contains(CustomerName, 'a')

DateTime(value)

Interprets the supplied text value as a date-time object.

DateTime(Order.Placed) < DateTime('2016-03-31 14:00:00 -7')

EndsWith(text, pattern)

Searches for a pattern at the end of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.

EndsWith(CustomerName, /[ea]/)

Has(property)

Evaluates to true if the supplied expression can be bound, otherwise, false.

Has(OrderId)

IndexOf(text, pattern)

Searches within text, returning the zero-based index of the first occurrence. If the text expression is defined, but the pattern does not appear, the result is -1.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.

IndexOf(CustomerName, 'al') = 0

Length(text)

Returns the length of a piece of text, in characters.

Length(CustomerName) = 5

Round(num, places)

Round the specified number to a set precision. Seq uses "round away from zero" for midpoint values.

Round(Elapsed, 1)

StartsWith(text, pattern)

Searches for a pattern at the start of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.

StartsWith(CustomerName, 'Al')

Substring(text, start, length)

Return a portion of text starting at zero-based offset start. The length argument may specify the number of characters to return, or pass null to capture to the end of the string.

Substring(CustomerName, 0, 2)

TimeOfDay(datetime, offset)

Given a datetime and time zone offset in hours, return the time of day as a timespan value. Use in conjunction with TimeSpan().

TimeOfDay(@Timestamp, -7) >= TimeSpan('15:00')

TimeSpan(value)

Given a string in .NET TimeSpan format, return the number of ticks

TimeSpan(Elapsed)

ToIsoString(value)

Seq's internal date/time representation is numeric (.NET Ticks). To display as a string, ToIsoString() converts this to ISO 8601 format.

ToIsoString(@Timestamp)

ToNumber(text)

Convert a string value into a number.

ToNumber('42')

TotalMilliseconds(timespan)

Given a property in .NET TimeSpan format (e.g. "00:12:33.880"), return the total number of milliseconds represented.

The argument may alternatively be an object returned by TimeOfDay() or TimeSpan().

TotalMilliseconds(Elapsed) > 100

TypeOf(x)

Given a value, or structure tagged with its original type ($type or _typeTag added by Serilog), return the value's type as a string.

TypeOf(Message) = 'PlaceOrderCommand'

Built-in Properties and Functions


Seq filters and queries can make use of system-provided functions and data.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.