Importing Log Files

Applications that need to log to a local file can write them in JSON format for easy importing into Seq.

The recommended format is Compact Log Event Format, produced by Serilog.Formatting.Compact.

We provide a command-line tool, clef.exe, that can read, transform, and import CLEF files into Seq.

Installation

Windows installers for clef.exe are available from the Releases page in the GitHub project.

Alternatively, and for other platforms, you can download and build the source code locally using Visual Studio 2017.

📘
Other Formats
The SeqFlatFileImport tool from Octopus Deploy is an alternative that's capable of reading unstructured (plain text) and IIS log files. The seq-import.exe command-line tool can read the earlier alternative JSON format created by Serilog.

Usage

clef.exe is a command-line application.

clef [<args>]

Process CLEF-formatted events

Arguments:
  -i, --input=VALUE          CLEF file to read; if not specified, STDIN will
                               be used
  -o, --out-file=VALUE       Output file; if no output is specified, STDOUT
                               will be used
  -p, --property=VALUE1=VALUE2
                             Enrich events with additional properties, e.g. -p
                               Customer=C123 -p Environment=Production
      --filter=VALUE         Filter expression to select a subset of events
      --format-json          Format output as CLEF JSON
      --format-template=VALUE
                             Specify an output template to control plain text
                               formatting
      --out-seq=VALUE        Send output to Seq at the specified URL
      --out-seq-apikey=VALUE Specify the API key to use when writing to Seq,
                               if required

Example:

The simplest usage is to import a CLEF-formatted log file directly to Seq by specifying --out-seq and --out-seq-apikey, if an API key is required:

clef -i log-20170509.clef --out-seq="https://seq.example.com" --out-seq-apikey="1234567890"

Additional properties can be attached to the imported events by specifying them with the -p switch.

Creating compatible JSON files with Serilog

The most common way to create CLEF files is by specifying CompactJsonFormatter when configuring a Serilog sink, for example the rolling file sink.

This must be installed from NuGet first:

Install-Package Serilog.Formatting.Compact

The formatter is passed either in C# configuration:

Log.Logger = new LoggerConfiguration()
  .WriteTo.RollingFile(new CompactJsonFormatter(), "./logs/myapp.json")
  .CreateLogger();

Or via XML <appSettings>:

<appSettings>
  <add key="serilog:using:RollingFile" value="Serilog.Sinks.RollingFile" />
  <add key="serilog:write-to:RollingFile.pathFormat" value="./logs/myapp.json" />
  <add key="serilog:write-to:RollingFile.formatter"
       value="Serilog.Formatting.Compact.CompactJsonFormatter, Serilog.Formatting.Compact" />

Installation

📘Other Formats

Usage

Example:

Creating compatible JSON files with Serilog

📘
Other Formats