POSTing Raw Events

In some situations it may be desirable to send events to Seq without using a logging library like Serilog. In that case, batches of events can be sent in JSON format directly to Seq's HTTP API.

Events are POSTed to the /api/events/raw endpoint:

POST https://localhost:5341/api/events/raw

The body of the request contains one or more events in the format below:

{
  "Events": [{
    "Timestamp": "2015-05-09T22:09:08.12345+10:00",
    "Level": "Warning",
    "MessageTemplate": "Disk space is low on {Drive}",
    "Properties": {
      "Drive": "C:",
      "MachineName": "nblumhardt-rmbp"
    }
  }]
}

The Properties element can be omitted if an event does not carry any properties.

An Exception field can be specified at the top level (beside Properties, not under it) if required.

If an API key is required, it can be specified as ?apiKey= in the URL, or sent in the X-Seq-ApiKey HTTP header.

Sample Code using JSON.NET

The classes below can be used to serialize payloads using JSON.NET.

// This is the payload
class RawEvents
{
  public RawEvent[] Events { get; set; }
}

// Add these to RawEvents.Events
class RawEvent
{
  public DateTimeOffset Timestamp { get; set; }
  
  // Uses the Serilog level names
  public string Level { get; set; }
  
  public string MessageTemplate { get; set; }
  
  public Dictionary<string, object> Properties { get; set; }
  
  public string Exception { get; set; }
}

Compact JSON format

Since Seq version 3.3, the /api/events/raw endpoint will also accept payloads formatted using Serilog's compact JSON format.

Batches of events in this format are newline-separated JSON documents:

{"@t":"2016-06-07T03:44:57.8532799Z","@mt":"Hello, {User}","User":"alice"}
{"@t":"2016-06-07T04:10:00.3457981Z","@mt":"Hello, {User}","User":"bob"}

To identify a compact log event format payload, either:

• Include ?clef in the query string: /api/events/raw?clef
• Specify the value application/vnd.serilog.clef in the ContentType header