Documentation
DocumentationDiscussions
These docs are for v4.2. Click to read the latest docs for v2024.2.

Built-in Properties and Functions

Seq filters and queries can make use of system-provided functions and data.

Built-in Properties

All Seq events expose a set of built-in properties that are distinguished by the @ symbol in their name:

PropertyDescriptionExample ContentsUsage
@ArrivedAn integer indicating the order in which the event arrived at the Seq server12344@Arrived <= Arrived('event-d8ce...0000')
@DocumentThe full JSON document representing the event, as a string{ "Timestamp": ... }Contains(@Document, 'coffee')
@EventTypeA hash of the message template that was used to generate the event0x5432a8ff@EventType <> 0x5432a8ff
@ExceptionThe exception associated with the event if any, as a stringSystem.InvalidOp...@Exception like '%zero%'
@IdThe event's unique id in Seqevent-d8ce...0000@Id = 'event-d8ce...0000'
@LevelThe logging level of the event, as a stringWarning@Level <> 'Warning'
@MessageThe text message associated with the eventFailed to open file...@RenderedMessage like 'Failed%'
@MessageTemplateThe message template used to generate the eventLogged in {Username}@MessageTemplate = 'Logged in {Username}'
@PropertiesA dictionary with all properties associated with the event (Seq 3.1){"Name": "alice.example", "ThreadId": 10}@Properties['some irregular identifier']
@TimestampThe UTC timestamp associated with the event2015-02-28T13:56:20.293Z@Timestamp > DateTime('2015-01-13 06:00Z')

👍

Quick filter shortcuts

Many queries listed here are provided as one-click shortcuts via the row of blue links beneath the message text in an expanded log event - Id, Level, Type and so-on.

Functions

The built-in functions provide additional ways to work with structured data.

FunctionDescriptionUsage
Arrived(id)Given an event id, evaluates to that event's arrival order. Used in conjunction with the @Arrived built-in property.@Arrived <= Arrived('event-78f6229870b208d2096c030000000000')
Contains(text, pattern)Searches within a text value for a pattern.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
Contains(CustomerName, 'a')
DateTime(value)Interprets the supplied text value as a date-time object.DateTime(Order.Placed) < DateTime('2016-03-31 14:00:00 -7')
EndsWith(text, pattern)Searches for a pattern at the end of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
EndsWith(CustomerName, /[ea]/)
Has(property)Evaluates to true if the supplied expression can be bound, otherwise, false.Has(OrderId)
IndexOf(text, pattern)Searches within text, returning the zero-based index of the first occurrence. If the text expression is defined, but the pattern does not appear, the result is -1.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
IndexOf(CustomerName, 'al') = 0
Length(text)Returns the length of a piece of text, in characters.Length(CustomerName) = 5
Round(num, places)Round the specified number to a set precision. Seq uses "round away from zero" for midpoint values.Round(Elapsed, 1)
StartsWith(text, pattern)Searches for a pattern at the start of a text value.

In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression.
StartsWith(CustomerName, 'Al')
Substring(text, start, length)Return a portion of text starting at zero-based offset start. The length argument may specify the number of characters to return, or pass null to capture to the end of the string.Substring(CustomerName, 0, 2)
TimeOfDay(datetime, offset)Given a datetime and time zone offset in hours, return the time of day as a timespan value. Use in conjunction with TimeSpan().TimeOfDay(@Timestamp, -7) >= TimeSpan('15:00')
TimeSpan(datetime)Given a string in .NET TimeSpan format, return the number of ticksTimeSpan('Elapsed')
ToIsoString(value)Seq's internal date/time representation is numeric (.NET Ticks). To display as a string, ToIsoString() converts this to ISO 8601 format.ToIsoString(@Timestamp)
ToNumber(text)Convert a string value into a number.ToNumber('42')
TotalMilliseconds(timespan)Given a property in .NET TimeSpan format (e.g. "00:12:33.880"), return the total number of milliseconds represented.

The argument may alternatively be an object returned by TimeOfDay() or TimeSpan().
TotalMilliseconds(Elapsed) > 100
TypeOf(x)Given a value, or structure tagged with its original type ($type or _typeTag added by Serilog), return the value's type as a string.TypeOf(Message) = 'PlaceOrderCommand'