Built-in Properties and Functions

@Arrived

An integer indicating the order in which the event arrived at the Seq server

12344

@Arrived <= Arrived("event-d8ce...0000")

@Document

The full JSON document representing the event, as a string

{ "Timestamp": ... }

Contains(@Document, "coffee")

@EventType

A hash of the message template that was used to generate the event

0x5432a8ff

@EventType != 0x5432a8ff

@Exception

The exception associated with the event if any, as a string

System.InvalidOp...

Contains(@Exception, "zero")

@Id

The event's unique id in Seq

event-d8ce...0000

@Id == "event-d8ce...0000"

@Level

The logging level of the event, as a string

Warning

@Level != "Warning"

@Message

The text message associated with the event

Failed to open file...

StartsWith(@RenderedMessage, "Failed")

@MessageTemplate

The message template used to generate the event

Logged in {Username}

@MessageTemplate == "Logged in {Username}"

@Properties

A dictionary with all properties associated with the event (Seq 3.1)

{"Name": "alice.example", "ThreadId": 10}

@Properties["some irregular identifier"]

@Timestamp

The UTC timestamp associated with the event

2015-02-28T13:56:20.293Z

@Timestamp > DateTime("2015-01-13 06:00Z")

Arrived(id)

Given an event id, evaluates to that event's arrival order. Used in conjunction with the @Arrived built-in property.

@Arrived <= Arrived("event-78f6229870b208d2096c030000000000")

Contains(text, pattern)

Searches within a text value for a pattern.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.

Contains(CustomerName, "a")

DateTime(value)

Interprets the supplied text value as a date-time object.

DateTime(Order.Placed) < DateTime("2016-03-31 14:00:00 -7")

EndsWith(text, pattern)

Searches for a pattern at the end of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.

EndsWith(CustomerName, /[ea]/)

Has(property)

Evaluates to true if the supplied expression can be bound, otherwise, false.

Has(OrderId)

IndexOf(text, pattern)

Searches within text, returning the zero-based index of the first occurrence. If the text expression is defined, but the pattern does not appear, the result is -1.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.

IndexOf(CustomerName, "al") == 0

Length(text)

Returns the length of a piece of text, in characters.

Length(CustomerName) == 5

Round(num, places)

Round the specified number to a set precision. Seq uses "round away from zero" for midpoint values.

Round(Elapsed, 1)

StartsWith(text, pattern)

Searches for a pattern at the start of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.

StartsWith(CustomerName, @"Al")

Substring(text, start, length)

Return a portion of text starting at zero-based offset start. The length argument may specify the number of characters to return, or pass null to capture to the end of the string.

Substring(CustomerName, 0, 2)

ToIsoString(value)

Seq's internal date/time representation is numeric (.NET Ticks). To display as a string, ToIsoString() converts this to ISO 8601 format.

ToIsoString(@Timestamp)

ToNumber(text)

Convert a string value into a number.

ToNumber('42')

TotalMilliseconds(timespan)

Given a property in .NET TimeSpan format (e.g. "00:12:33.880"), return the total number of milliseconds represented.

The argument may alternatively be an object returned by TimeOfDay() or TimeSpan().

TotalMilliseconds(Elapsed) > 100

TimeOfDay(datetime, offset)

Given a datetime and time zone offset in hours, return the time of day as a timespan value. Use in conjunction with TimeSpan().

TimeOfDay(@Timestamp, -7) >= TimeSpan("15:00")

TypeOf(structure)

Given a structured property tagged with its original type ($typeTag or _typeTag added by Serilog), return the original type as a string.

TypeOf(Message) == "PlaceOrderCommand"