Scalar Functions
Seq filters and queries can make use of system-provided functions and data.
The built-in scalar functions provide additional ways to work with structured data.
| Function | Description | Usage |
|---|---|---|
Arrived(id) | Given an event id, evaluates to that event's arrival order. Used in conjunction with the @Arrived built-in property. | @Arrived <= Arrived('event-78f6229870b208d2096c030000000000') |
Coalesce(first, second) | Evaluates to first if it is defined and non-null; otherwise, evaluates to second | Coalesce(Total, 0) |
Concat(first, second) | Concatenate two string values. | Concat('customer-', CustomerId) |
Contains(text, pattern) | Searches within a text value for a pattern. In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression. | Contains(CustomerName, 'a') |
DateTime(value) | Interprets the supplied text value as a date-time object. | DateTime(Order.Placed) < DateTime('2016-03-31 14:00:00 -7') |
ElementAt(coll, indexer) | Indexes into a collection. This is an alias of the [] indexing syntax, but permits the ci modifier to be used. | ElementAt(@Properties, 'test') ci |
EndsWith(text, pattern) | Searches for a pattern at the end of a text value. In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression. | EndsWith(CustomerName, /[ea]/) |
FromJson(text) | Parse a JSON-encoded string. | FromJson('{"x": 42}') |
Has(property) | Evaluates to true if the supplied expression can be bound, otherwise, false. | Has(OrderId) |
IndexOf(text, pattern) | Searches within text, returning the zero-based index of the first occurrence of pattern. If the text expression is defined, but the pattern does not appear, the result is -1.In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression. | IndexOf(CustomerName, 'al') = 0 |
Keys(obj) | Returns the list of keys present in a structure. | distinct(Keys(@Properties)) |
LastIndexOf(text, pattern) | Searches within text, returning the zero-based index of the last occurrence of pattern. If the text expression is defined, but the pattern does not appear, the result is -1. | LastIndexOf(Url, '/') |
Length(text) | Returns the length of a piece of text, in characters. | Length(CustomerName) = 5 |
Now() | Returns the current time, as a numeric Seq timestamp. | @Timestamp > now() - 1d |
Round(num, places) | Round the specified number to a set precision. Seq uses "round away from zero" for midpoint values. | Round(Elapsed, 1) |
StartsWith(text, pattern) | Searches for a pattern at the start of a text value. In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression. | StartsWith(CustomerName, 'Al') |
Substring(text, start, length) | Return a portion of text starting at zero-based offset start. The length argument may specify the number of characters to return, or pass null to capture to the end of the string. | Substring(CustomerName, 0, 2) |
TimeOfDay(datetime, offset) | Given a datetime and time zone offset in hours, return the time of day as a timespan value. Use in conjunction with TimeSpan(). | TimeOfDay(@Timestamp, -7) >= TimeSpan('15:00') |
TimeSpan(value) | Given a string in .NET TimeSpan format, return the number of ticks | TimeSpan(Elapsed) |
ToIsoString(value) | Seq's internal date/time representation is numeric (.NET Ticks). To display as a string, ToIsoString() converts this to ISO 8601 format. | ToIsoString(@Timestamp) |
ToJson(value) | Convert a value to a JSON string. | ToJson({'x': 42}) |
ToLower(text) | Convert a string to lowercase. | ToLower('TEST') |
ToNumber(text) | Convert a string value into a number. | ToNumber('42') |
TotalMilliseconds(timespan) | Given a property in .NET TimeSpan format (e.g. "00:12:33.880"), return the total number of milliseconds represented.The argument may alternatively be an object returned by TimeOfDay() or TimeSpan(). | TotalMilliseconds(Elapsed) > 100 |
ToUpper(text) | Convert a string to uppercase. | ToUpper('test') |
TypeOf(x) | Given a value, or structure tagged with its original type ($type or _typeTag added by Serilog), return the value's type as a string. | TypeOf(Message) = 'PlaceOrderCommand' |
Values(obj) | Returns the list of values present in a structure. | Values(@Properties) |
Updated over 4 years ago