Documentation
DocumentationDiscussions
These docs are for v3. Click to read the latest docs for v2024.2.

Built-in Properties and Functions

Seq filters and queries can make use of system-provided functions and data.

Built-in Properties

All Seq events expose a set of built-in properties that are distinguished by the @ symbol in their name:

PropertyDescriptionExample ContentsUsage
@ArrivedAn integer indicating the order in which the event arrived at the Seq server12344@Arrived <= Arrived("event-d8ce...0000")
@DocumentThe full JSON document representing the event, as a string{ "Timestamp": ... }Contains(@Document, "coffee")
@EventTypeA hash of the message template that was used to generate the event0x5432a8ff@EventType != 0x5432a8ff
@ExceptionThe exception associated with the event if any, as a stringSystem.InvalidOp...Contains(@Exception, "zero")
@IdThe event's unique id in Seqevent-d8ce...0000@Id == "event-d8ce...0000"
@LevelThe logging level of the event, as a stringWarning@Level != "Warning"
@MessageThe text message associated with the eventFailed to open file...StartsWith(@RenderedMessage, "Failed")
@MessageTemplateThe message template used to generate the eventLogged in {Username}@MessageTemplate == "Logged in {Username}"
@PropertiesA dictionary with all properties associated with the event (Seq 3.1){"Name": "alice.example", "ThreadId": 10}@Properties["some irregular identifier"]
@TimestampThe UTC timestamp associated with the event2015-02-28T13:56:20.293Z@Timestamp > DateTime("2015-01-13 06:00Z")

👍

Quick filter shortcuts

Many queries listed here are provided as one-click shortcuts via the row of blue links beneath the message text in an expanded log event - Id, Level, Type and so-on.

Functions

The built-in functions provide additional ways to work with structured data.

FunctionDescriptionUsage
Arrived(id)Given an event id, evaluates to that event's arrival order. Used in conjunction with the @Arrived built-in property.@Arrived <= Arrived("event-78f6229870b208d2096c030000000000")
Contains(text, pattern)Searches within a text value for a pattern.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
Contains(CustomerName, "a")
DateTime(value)Interprets the supplied text value as a date-time object.DateTime(Order.Placed) < DateTime("2016-03-31 14:00:00 -7")
EndsWith(text, pattern)Searches for a pattern at the end of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
EndsWith(CustomerName, /[ea]/)
Has(property)Evaluates to true if the supplied expression can be bound, otherwise, false.Has(OrderId)
IndexOf(text, pattern)Searches within text, returning the zero-based index of the first occurrence. If the text expression is defined, but the pattern does not appear, the result is -1.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
IndexOf(CustomerName, "al") == 0
Length(text)Returns the length of a piece of text, in characters.Length(CustomerName) == 5
Round(num, places)Round the specified number to a set precision. Seq uses "round away from zero" for midpoint values.Round(Elapsed, 1)
StartsWith(text, pattern)Searches for a pattern at the start of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
StartsWith(CustomerName, @"Al")
Substring(text, start, length)Return a portion of text starting at zero-based offset start. The length argument may specify the number of characters to return, or pass null to capture to the end of the string.Substring(CustomerName, 0, 2)
ToIsoString(value)Seq's internal date/time representation is numeric (.NET Ticks). To display as a string, ToIsoString() converts this to ISO 8601 format.ToIsoString(@Timestamp)
ToNumber(text)Convert a string value into a number.ToNumber('42')
TotalMilliseconds(timespan)Given a property in .NET TimeSpan format (e.g. "00:12:33.880"), return the total number of milliseconds represented.

The argument may alternatively be an object returned by TimeOfDay() or TimeSpan().
TotalMilliseconds(Elapsed) > 100
TimeOfDay(datetime, offset)Given a datetime and time zone offset in hours, return the time of day as a timespan value. Use in conjunction with TimeSpan().TimeOfDay(@Timestamp, -7) >= TimeSpan("15:00")
TypeOf(structure)Given a structured property tagged with its original type ($typeTag or _typeTag added by Serilog), return the original type as a string.TypeOf(Message) == "PlaceOrderCommand"