Seq Documentation and Support

Seq Documentation and Support

Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!

Get Started    

POSTing Raw Events

Events can be sent directly to Seq via HTTP

In some situations it may be desirable to send events to Seq without using a logging library like Serilog. In that case, batches of events can be sent in JSON format directly to Seq's HTTP API.

Compact JSON format

Events are POSTed to the /api/events/raw endpoint:

POST https://localhost:5341/api/events/raw?clef

The /api/events/raw endpoint accepts payloads formatted using Serilog's compact JSON format.

If an API key is required, it can be specified as ?apiKey= in the URL, or sent in the X-Seq-ApiKey HTTP header.

To identify the payload as compact log event format, either:

  • Include ?clef in the query string: /api/events/raw?clef as shown in the above example
  • Specify the value application/vnd.serilog.clef in the ContentType header

Format

Batches of events in this format are newline-separated JSON documents:

{"@t":"2016-06-07T03:44:57.8532799Z","@mt":"Hello, {User}","User":"alice"}
{"@t":"2016-06-07T04:10:00.3457981Z","@mt":"Hello, {User}","User":"bob"}

Each event is a JSON object with event data at the top level. Any JSON property on the payload object is assumed to be a regular property of the event, apart from the reified properties below.

Reified properties

The format defines a handful of reified properties that have special meaning:

Property Name Description Required?
@t Timestamp An ISO 8601 timestamp Yes
@m Message A fully-rendered message describing the event
@mt Message Template Alternative to Message; specifies a message template over the event's properties that provides for rendering into a textual description of the event
@l Level An implementation-specific level identifier (string or number) Absence implies "informational"
@x Exception A language-dependent error representation potentially including backtrace
@i Event id An implementation specific event id (string or number)
@r Renderings If @mt includes tokens with programming-language-specific formatting, an array of pre-rendered values for each such token May be omitted; if present, the count of renderings must match the count of formatted tokens exactly

The @ sigil may be escaped at the start of a user property name by doubling, e.g. @@name denotes a property called @name.

Batch format

When events are batched into a single payload, a newline-delimited stream of JSON documents is required. Either \n or \r\n delimiters may be used. Batches of newline-separated compact JSON events can use the (unofficial) MIME type application/vnd.serilog.clef.

Status codes and response format

The POST request will return one of the following status codes:

Status code
Meaning

201 Created

The events were ingested successfully

400 Bad Request

The request was malformed; sometimes this indicates incorrect payload formatting, or more frequently, an included event exceeds the configured maximum event size

401 Unauthorized

Authorization is required; this status code may be returned if an API key is missing or invalid

403 Forbidden

The provided credentials don't have ingestion permission

413 Request Entity Too Large

The payload itself exceeds the configured maximum size

500 Internal Server Error

An internal error prevented the events from being ingested; check Seq's diagnostic log for more information

503 Service Unavailable

The Seq server is starting up and can't currently service the request, or, free storage space has fallen below the minimum required threshold; this status code may also be returned by HTTP proxies and other network infrastructure when Seq is unreachable

If the status code indicates success, the response will be of the form:

{"MinimumLevelAccepted": null}

The MinimumLevelAccepted value will be null if no level filter is applied, and one of the Serilog level values Verbose, Debug, Information, Warning, Error and Fatal if filtering is applied. The client may use these values to pre-filter events and therefore reduce network bandwidth utilization.

If the status code indicates failure, the response will be of the form:

{"Error": "This is an error message"}

Classic format

Versions of Seq prior to 3.3 only accept the classic payload format, which takes the form of a single JSON document POSTed to /api/events/raw. See the earlier versions of this documentation for details.

POSTing Raw Events


Events can be sent directly to Seq via HTTP

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.