These docs are for v2021.3. Click to read the latest docs for v2024.3.

Log Files

Use seqcli to import plain-text and JSON log files

Applications that need to log to a local file can write them in JSON format for easy importing into Seq.

Both newline-delimited JSON and plain-text log files can be imported into Seq using the Command-line Client's seqcli ingest command.

The recommended format is Compact Log Event Format, produced by tools including Serilog.Formatting.Compact.

The seqcli ingest command

The easiest way to import logs is through seqcli ingest:

seqcli ingest -i log-*.txt --json --filter="@Level <> 'Debug'" -p Environment=Test

Logs can be imported from a file (-i <filename>), or ingested in real-time from STDIN.

The following options are supported:

-i, --input=VALUEFile to ingest, including the * wildcard; if not specified, STDIN will be used
--invalid-data=VALUESpecify how invalid data is handled: fail (default) or ignore
-p, --property=NAME=VALUESpecify name/value properties, e.g. -p Customer=C123 -p Environment=Production
-x, --extract=VALUEAn extraction pattern to apply to plain-text logs (ignored when --json is specified)
--jsonRead the events as JSON (the default assumes plain text)
-f, --filter=VALUEFilter expression to select a subset of events
-m, --message=VALUEA message to associate with the ingested events; syntax is supported
-l, --level=VALUEThe level or severity to associate with the ingested events; this will override any level information present in the events themselves
--send-failure=VALUESpecify how connection failures are handled: fail (default), retry, continue, or ignore
-s, --server=VALUEThe URL of the Seq server; by default the connection.serverUrl config value will be used
-a, --apikey=VALUEThe API key to use when connecting to the server; by default the connection.apiKey config value will be used
--profile=VALUEA connection profile to use; by default the connection.serverUrl and connection.apiKey config values will be used

For more information, including the syntax for plain text parsing, see the detailed instructions.

Creating compatible JSON files with Serilog

The most common way to create CLEF files is by specifying CompactJsonFormatter when configuring a Serilog sink, for example the file sink.

This must be installed from NuGet first:

Install-Package Serilog.Sinks.File
Install-Package Serilog.Formatting.Compact

The formatter is passed either in C# configuration:

Log.Logger = new LoggerConfiguration()
  .WriteTo.File(new CompactJsonFormatter(), "./logs/myapp.json")

Or via XML <appSettings>:

  <add key="serilog:using:File" value="Serilog.Sinks.File" />
  <add key="serilog:write-to:File.path" value="./logs/myapp.json" />
  <add key="serilog:write-to:File.formatter"
       value="Serilog.Formatting.Compact.CompactJsonFormatter, Serilog.Formatting.Compact" />

What’s Next