Importing Log Files

Applications that need to log to a local file can write them in JSON format for easy importing into Seq.

Both newline-delimited JSON and plain-text log files can be imported into Seq using the Command-line Client's seqcli ingest command.

The recommended format is Compact Log Event Format, produced by tools including Serilog.Formatting.Compact.

The `seqcli ingest` command

The easiest way to import logs is through seqcli ingest:

seqcli ingest -i log-*.txt --json --filter="@Level <> 'Debug'" -p Environment=Test

Logs can be imported from a file (-i <filename>), or ingested in real-time from STDIN.

The following options are supported:

Option	Description
`-i`, `--input=VALUE`	File to ingest, including the `*` wildcard; if not specified, `STDIN` will be used
`--invalid-data=VALUE`	Specify how invalid data is handled: `fail` (default) or `ignore`
`-p`, `--property=NAME=VALUE`	Specify name/value properties, e.g. `-p Customer=C123 -p Environment=Production`
`-x`, `--extract=VALUE`	An extraction pattern to apply to plain-text logs (ignored when `--json` is specified)
`--json`	Read the events as JSON (the default assumes plain text)
`-f`, `--filter=VALUE`	Filter expression to select a subset of events
`-m`, `--message=VALUE`	A message to associate with the ingested events; https://messagetemplates.org syntax is supported
`-l`, `--level=VALUE`	The level or severity to associate with the ingested events; this will override any level information present in the events themselves
`--send-failure=VALUE`	Specify how connection failures are handled: `fail` (default), `retry`, `continue`, or `ignore`
`-s`, `--server=VALUE`	The URL of the Seq server; by default the `connection.serverUrl` config value will be used
`-a`, `--apikey=VALUE`	The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used
`--profile=VALUE`	A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used

For more information, including the syntax for plain text parsing, see the detailed instructions.

Creating compatible JSON files with Serilog

The most common way to create CLEF files is by specifying CompactJsonFormatter when configuring a Serilog sink, for example the file sink.

This must be installed from NuGet first:

Install-Package Serilog.Sinks.File
Install-Package Serilog.Formatting.Compact

The formatter is passed either in C# configuration:

Log.Logger = new LoggerConfiguration()
  .WriteTo.File(new CompactJsonFormatter(), "./logs/myapp.json")
  .CreateLogger();

Or via XML <appSettings>:

<appSettings>
  <add key="serilog:using:File" value="Serilog.Sinks.File" />
  <add key="serilog:write-to:File.path" value="./logs/myapp.json" />
  <add key="serilog:write-to:File.formatter"
       value="Serilog.Formatting.Compact.CompactJsonFormatter, Serilog.Formatting.Compact" />

The seqcli ingest command

Creating compatible JSON files with Serilog

The `seqcli ingest` command