Seq Documentation and Support

Welcome to the Seq documentation hub. You'll find comprehensive guides and documentation to help you start working with Seq as quickly as possible, as well as support if you get stuck. Let's jump right in!

Get Started    

GELF

Send GELF logs to Seq by installing Seq.Input.Gelf under Settings > Apps in Seq (Windows), or by deploying datalust/seq-input-gelf container alongside your datalust/seq container (Docker/Linux).

GELF (Graylog Extended Log Format) is a structured log event format that's implemented for logging libraries in many programming languages. Seq can receive GELF events via TCP and UDP, and supports common features such as compression and chunking.

GELF is not enabled out-of-the-box, and must be enabled one of two ways:

  • On Windows, the Seq.Input.Gelf app can be installed and configured
  • On Docker/Linux, the datalust/seq-input-gelf container can be deployed alongside Seq

Enabling GELF on Windows

On Windows, the GELF input is installed into Seq as a Seq App

GELF input installed through Settings > Apps

1. Install the app package

In Settings > Apps, choose Install from NuGet. The app package id is Seq.Input.Gelf.

2. Start an instance of the app

From the apps screen, choose Add Instance and give the new GELF input a name.

The default settings will cause the GELF input to listen on localhost UDP port 12201. Choose a different port and protocol if required.

Select Save Changes to start the input.

3. Configure Windows Firewall

Ensure UDP port 12201 (or the selected port and protocol, if you specified a different one), is allowed through Windows Firewall.

4. Log some events!

That's all there is to it. Events ingested through the input will appear in the Events stream. If the input doesn't work, check for diagnostic events raised by the input app (there is some status information shown under the app instance name).

Events ingested into Seq via the GELF Input app will be shown in the Ingestion view.

Enabling GELF in Docker

For Docker, the app is deployed as a Docker container that is expected to run alongside the Seq container. The datalust/seq-input-gelf image accepts TCP or UDP GELF payloads on port 12201, and forwards them over HTTP to the Seq ingestion endpoint specified in the SEQ_ADDRESS environment variable.

To run the container listening on UDP port 12201:

$ docker run \
    --rm \
    -it \
    -p 12201:12201/udp \
    -e SEQ_ADDRESS=https://seq.example.com:5341 \
    datalust/seq-input-gelf

Container configuration

A seq-input-gelf container can be configured using the following environment variables:

VariableDescriptionDefault
SEQ_ADDRESSThe address of the Seq server to forward events tohttp://localhost:5341
SEQ_API_KEYThe API key to use-
GELF_ADDRESSThe address and protocol to bind the GELF server to0.0.0.0:12201/udp
GELF_ENABLE_DIAGNOSTICSWhether to enable diagnostic logs and metrics (accepts True or False)False

Quick local setup with docker-compose

The following is an example docker-compose file that can be used to manage a local Seq container alongside seq-input-gelf in your development environment to collect log events from other containers:

version: '3'
services:
  seq-input-gelf:
    image: datalust/seq-input-gelf:latest
    depends_on:
      - seq
    ports:
      - "12201:12201/udp"
    environment:
      SEQ_ADDRESS: "http://seq:5341"
    restart: unless-stopped
  seq:
    image: datalust/seq:latest
    ports:
      - "5341:80"
    environment:
      ACCEPT_EULA: Y
    restart: unless-stopped
    volumes:
      - ./seq-data:/data

The service can be started using docker-compose up.

To collect logs from Docker's logging infrastructure, see Collecting Docker container logs.

Updated 2 months ago



GELF


Send GELF logs to Seq by installing Seq.Input.Gelf under Settings > Apps in Seq (Windows), or by deploying datalust/seq-input-gelf container alongside your datalust/seq container (Docker/Linux).

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.