Built-in Properties and Functions
Seq filters and queries can make use of system-provided functions and data.
Built-in Properties
All Seq events expose a set of built-in properties that are distinguished by the @ symbol in their name:
| Property | Description | Example Contents | Usage |
|---|---|---|---|
@Arrived | An integer indicating the order in which the event arrived at the Seq server | 12344 | @Arrived <= Arrived('event-d8ce...0000') |
@Document | The full JSON document representing the event, as a string | { "Timestamp": ... } | Contains(@Document, 'coffee') |
@EventType | A hash of the message template that was used to generate the event | 0x5432a8ff | @EventType <> 0x5432a8ff |
@Exception | The exception associated with the event if any, as a string | System.InvalidOp... | @Exception like '%zero%' |
@Id | The event's unique id in Seq | event-d8ce...0000 | @Id = 'event-d8ce...0000' |
@Level | The logging level of the event, as a string | Warning | @Level <> 'Warning' |
@Message | The text message associated with the event | Failed to open file... | @RenderedMessage like 'Failed%' |
@MessageTemplate | The message template used to generate the event | Logged in {Username} | @MessageTemplate = 'Logged in {Username}' |
@Properties | A dictionary with all properties associated with the event (Seq 3.1) | {"Name": "alice.example", "ThreadId": 10} | @Properties['some irregular identifier'] |
@Timestamp | The UTC timestamp associated with the event | 2015-02-28T13:56:20.293Z | @Timestamp > DateTime('2015-01-13 06:00Z') |
Quick filter shortcuts
Many queries listed here are provided as one-click shortcuts via the row of blue links beneath the message text in an expanded log event -
Id,Level,Typeand so-on.
Functions
The built-in functions provide additional ways to work with structured data.
| Function | Description | Usage |
|---|---|---|
Arrived(id) | Given an event id, evaluates to that event's arrival order. Used in conjunction with the @Arrived built-in property. | @Arrived <= Arrived('event-78f6229870b208d2096c030000000000') |
Coalesce(first, second) | Evaluates to first if it is defined and non-null; otherwise, evaluates to second | Coalesce(Total, 0) |
Concat(first, second) | Concatenate two string values. | Concat('customer-', CustomerId) |
Contains(text, pattern) | Searches within a text value for a pattern. In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression. | Contains(CustomerName, 'a') |
DateTime(value) | Interprets the supplied text value as a date-time object. | DateTime(Order.Placed) < DateTime('2016-03-31 14:00:00 -7') |
EndsWith(text, pattern) | Searches for a pattern at the end of a text value. In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression. | EndsWith(CustomerName, /[ea]/) |
Has(property) | Evaluates to true if the supplied expression can be bound, otherwise, false. | Has(OrderId) |
IndexOf(text, pattern) | Searches within text, returning the zero-based index of the first occurrence of pattern. If the text expression is defined, but the pattern does not appear, the result is -1.In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression. | IndexOf(CustomerName, 'al') = 0 |
LastIndexOf(text, pattern) | Searches within text, returning the zero-based index of the last occurrence of pattern. If the text expression is defined, but the pattern does not appear, the result is -1. | LastIndexOf(Url, '/') |
Length(text) | Returns the length of a piece of text, in characters. | Length(CustomerName) = 5 |
Round(num, places) | Round the specified number to a set precision. Seq uses "round away from zero" for midpoint values. | Round(Elapsed, 1) |
StartsWith(text, pattern) | Searches for a pattern at the start of a text value. In all text comparisons, the operand may use @ to specify a case-sensitive match, or / to delimit a regular expression. | StartsWith(CustomerName, 'Al') |
Substring(text, start, length) | Return a portion of text starting at zero-based offset start. The length argument may specify the number of characters to return, or pass null to capture to the end of the string. | Substring(CustomerName, 0, 2) |
TimeOfDay(datetime, offset) | Given a datetime and time zone offset in hours, return the time of day as a timespan value. Use in conjunction with TimeSpan(). | TimeOfDay(@Timestamp, -7) >= TimeSpan('15:00') |
TimeSpan(value) | Given a string in .NET TimeSpan format, return the number of ticks | TimeSpan(Elapsed) |
ToIsoString(value) | Seq's internal date/time representation is numeric (.NET Ticks). To display as a string, ToIsoString() converts this to ISO 8601 format. | ToIsoString(@Timestamp) |
ToNumber(text) | Convert a string value into a number. | ToNumber('42') |
TotalMilliseconds(timespan) | Given a property in .NET TimeSpan format (e.g. "00:12:33.880"), return the total number of milliseconds represented.The argument may alternatively be an object returned by TimeOfDay() or TimeSpan(). | TotalMilliseconds(Elapsed) > 100 |
TypeOf(x) | Given a value, or structure tagged with its original type ($type or _typeTag added by Serilog), return the value's type as a string. | TypeOf(Message) = 'PlaceOrderCommand' |
Updated about 5 years ago