Exporting Log Data

eq uses a newline-delimited JSON format for import and export of event data.

Event data can be exported from a Seq server in one of three ways.

Export via the API with seqcli search --json

The seqcli command-line client is usually the nicest way to work.

Events are exported using seqcli search with the --json argument specified:

seqcli search -c 1000000000 --json --filter="Application = 'Ordering'"

The command accepts a variety of arguments to control which data is exported (run seqcli help search to see them all).

Events are written to STDOUT; to save them to a file, use redirection:

seqcli search -c 1000000000 --json --filter="Application = 'Ordering'" > ordering.clef

seqcli is installed and placed on the path by default when installing Seq on Windows. Other downloads and documentation are at: https://github.com/datalust/seqcli.

The tool is built on the HTTP API and the underlying code is in the Seq.Api NuGet package (C#), so if your task is programmatic that can be used directly instead.

Export in real-time using Seq.App.JsonArchive

Another alternative, if it's an ongoing process, is to install the Seq.App.JsonArchive app and set up a continuous JSON export into a shared folder.

See Event Backup with JSON Archive for details.

Bulk export using flaretl.exe

The flaretl tool, installed to C:\Program Files\Seq\Native on Windows, and included at /bin/seq-server/Native in the Docker container, is the fastest way to export events (one or more orders of magnitude faster than the other options).

Unlike the first two possibilities, flaretl requires that the store is "cold", that is, the Seq server is stopped and no other process is accessing the stream data.

seq service stop
& "C:\Program Files\Seq\Native\flaretl.exe" export "C:\ProgramData\Seq\Stream" > export.clef
seq service start