Built-in Properties
Search expressions and queries can make use of system-provided data.
All Seq events expose a set of built-in properties that are distinguished by the @ symbol in their name:
| Property | Description | Example Value | Usage |
|---|---|---|---|
@Arrived | An integer indicating the order in which the event arrived at the Seq server | 12344 | @Arrived <= Arrived('event-d8ce...0000') |
@Data | The internal representation of the event as a single structured object. | {@t: ...} | Contains(ToJson(@Data), 'coffee') |
@EventType | A hash of the message template that was used to generate the event | 0x5432a8ff | @EventType <> 0x5432a8ff |
@Exception | The exception associated with the event if any, as a string | 'System.InvalidOp...' | @Exception like '%zero%' |
@Id | The event's unique id in Seq | 'event-d8ce...0000' | @Id = 'event-d8ce...0000' |
@Level | The logging level of the event, as a string | 'Warning' | @Level <> 'Warning' |
@Message | The text message associated with the event | 'Failed to open file...' | @RenderedMessage like 'Failed%' |
@MessageTemplate | The message template used to generate the event | 'Logged in {Username}' | @MessageTemplate = 'Logged in {Username}' |
@Properties | An object containing properties associated with the event | {Name: 'alice', Count: 10} | @Properties['some irregular identifier'] |
@Resource | An object containing properties associated with the event origin, if any | {'service.name': 'Example'} | @Resource['service.name'] |
@SpanId | The span identifier associated with the event, if any, as a string | '180ab3544e957c9...' | @SpanId = '180ab3544e957c9...' |
@Timestamp | The timestamp associated with the event; convert to human-readable text with ToIsoString(@Timestamp) | 637840179774790019 | @Timestamp > DateTime('2015-01-13 06:00Z') |
@TraceId | The trace identifier associated with the event, if any, as a string | '6cf23c2886cbef...' | @TraceId = '6cf23c2886cbef...' |
Quick filter shortcuts
Many queries listed here are provided as one-click shortcuts via the row of blue links beneath the message text in an expanded log event -
Id,Level,Typeand so-on.
Updated over 1 year ago