Seq uses a newline-delimited JSON format for import and export of log data.
Log data can be exported from a Seq server in one of three ways.
seqcli command-line client is usually the nicest way to work.
Events are exported using
seqcli search with the
--json argument specified:
seqcli search -c 1000000000 --json --filter="Application = 'Ordering'"
The command accepts a variety of arguments to control which data is exported (run
seqcli help search to see them all).
Events are written to
STDOUT; to save them to a file, use redirection:
seqcli search -c 1000000000 --json --filter="Application = 'Ordering'" > ordering.clef
seqcli is installed and placed on the path by default when installing Seq on Windows. Other downloads and documentation are at: https://github.com/datalust/seqcli.
The tool is built on the HTTP API and the underlying code is in the Seq.Api NuGet package (C#), so if your task is programmatic that can be used directly instead.
Another alternative, if it's an ongoing process, is to install the Seq.App.JsonArchive extension and set up a continuous JSON export into a shared folder.
The app will export newline-formatted JSON files in a configurable chunk size.
With the app installed, configure an instance with the Stream incoming events option to export event data as it arrives.
flaretl tool, installed to
C:\Program Files\Seq\Native on Windows, and included at
/bin/seq-server/Native in the Docker container, is the fastest way to export events (one or more orders of magnitude faster than the other options).
Unlike the first two possibilities,
flaretl requires that the store is "cold", that is, the Seq server is stopped and no other process is accessing the stream data.
seq service stop & "C:\Program Files\Seq\Native\flaretl.exe" export "C:\ProgramData\Seq\Stream" > export.clef seq service start
Updated about 2 years ago