Documentation
DocumentationDiscussions
Documentation
These docs are for v2021.3. Click to read the latest docs for v2024.3.

Scalar Functions

Seq filters and queries can make use of system-provided functions and data.

The built-in scalar functions provide additional ways to work with structured data.

FunctionDescriptionUsage
Arrived(id)Given an event id, evaluates to that event's arrival order. Used in conjunction with the @Arrived built-in property.@Arrived <= Arrived('event-78f6229870b208d2096c030000000000')
Coalesce(first, second)Evaluates to first if it is defined and non-null; otherwise, evaluates to secondCoalesce(Total, 0)
Concat(first, second)Concatenate two string values.Concat('customer-', CustomerId)
Contains(text, pattern)Searches within a text value for a pattern.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
Contains(CustomerName, 'a')
DatePart(datetime, part, offset)Compute the specified part of datetime, at a given time zone offset. See also OffsetIn().DatePart(@Timestamp, 'hour', -7h)
DateTime(value)Interprets the supplied text value as a date-time object.DateTime(Order.Placed) < DateTime('2016-03-31 14:00:00 -7')
ElementAt(coll, indexer)Indexes into a collection. This is an alias of the [] indexing syntax, but permits the ci modifier to be used.ElementAt(@Properties, 'test') ci
EndsWith(text, pattern)Searches for a pattern at the end of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
EndsWith(CustomerName, /[ea]/)
FromJson(text)Parse a JSON-encoded string.FromJson('{"x": 42}')
Has(property)Evaluates to true if the supplied expression can be bound, otherwise, false.Has(OrderId)
IndexOf(text, pattern)Searches within text, returning the zero-based index of the first occurrence of pattern. If the text expression is defined, but the pattern does not appear, the result is -1.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
IndexOf(CustomerName, 'al') = 0
Keys(obj)Returns the list of keys present in a structure.distinct(Keys(@Properties))
LastIndexOf(text, pattern)Searches within text, returning the zero-based index of the last occurrence of pattern. If the text expression is defined, but the pattern does not appear, the result is -1.LastIndexOf(Url, '/')
Length(text)Returns the length of a piece of text, in characters.Length(CustomerName) = 5
Now()Returns the current time, as a numeric Seq timestamp.@Timestamp > now() - 1d
OffsetIn(timezone, instant)Get the offset from UTC in the specified IANA timezone at the specified instant.OffsetIn('Australia/Brisbane', @Timestamp)
Round(num, places)Round the specified number to a set precision. Seq uses "round away from zero" for midpoint values.Round(Elapsed, 1)
StartsWith(text, pattern)Searches for a pattern at the start of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
StartsWith(CustomerName, 'Al')
Substring(text, start, length)Return a portion of text starting at zero-based offset start. The length argument may specify the number of characters to return, or pass null to capture to the end of the string.Substring(CustomerName, 0, 2)
TimeOfDay(datetime, offset)Given a datetime and time zone offset in hours, return the time of day as a duration value. See also DatePart(..., 'time', ...), which computes the same value.TimeOfDay(@Timestamp, -7) >= 15h
TimeSpan(value)Given a string in d.hh:mm:ss.fff format, return the number of ticksTimeSpan(Elapsed)
ToIsoString(value)Seq's internal date/time representation is numeric (100-nanosecond intervals since 0001-01-01). To display as a string, ToIsoString() converts this to ISO 8601 format.ToIsoString(@Timestamp)
ToJson(value)Convert a value to a JSON string.ToJson({'x': 42})
ToLower(text)Convert a string to lowercase.ToLower('TEST')
ToNumber(text)Convert a string value into a number.ToNumber('42')
TotalMilliseconds(timespan)Given a timespan in ticks, return the total number of milliseconds represented.TotalMilliseconds(TimeSpan('10:00'))
ToUpper(text)Convert a string to uppercase.ToUpper('test')
TypeOf(x)Given a value, or structure tagged with its original type ($type or _typeTag added by Serilog), return the value's type as a string.TypeOf(Message) = 'PlaceOrderCommand'
Values(obj)Returns the list of values present in a structure.Values(@Properties)