Built-in Properties
Search expressions and queries can make use of system-provided data.
All Seq events expose a set of built-in properties that are distinguished by the @ symbol in their name:
| Property | Description | Example Contents | Usage |
|---|---|---|---|
@Arrived | An integer indicating the order in which the event arrived at the Seq server | 12344 | @Arrived <= Arrived('event-d8ce...0000') |
@Data | The internal representation of the event as a single structured object. | { "@t": ... } | Contains(ToJson(@Data), 'coffee') |
@EventType | A hash of the message template that was used to generate the event | 0x5432a8ff | @EventType <> 0x5432a8ff |
@Exception | The exception associated with the event if any, as a string | System.InvalidOp... | @Exception like '%zero%' |
@Id | The event's unique id in Seq | event-d8ce...0000 | @Id = 'event-d8ce...0000' |
@Level | The logging level of the event, as a string | Warning | @Level <> 'Warning' |
@Message | The text message associated with the event | Failed to open file... | @RenderedMessage like 'Failed%' |
@MessageTemplate | The message template used to generate the event | Logged in {Username} | @MessageTemplate = 'Logged in {Username}' |
@Properties | A dictionary with all properties associated with the event (Seq 3.1) | {"Name": "alice.example", "ThreadId": 10} | @Properties['some irregular identifier'] |
@Timestamp | The UTC timestamp associated with the event | 2015-02-28T13:56:20.293Z | @Timestamp > DateTime('2015-01-13 06:00Z') |
Quick filter shortcuts
Many queries listed here are provided as one-click shortcuts via the row of blue links beneath the message text in an expanded log event -
Id,Level,Typeand so-on.
Updated over 4 years ago