TL;DR: Seq 2025.2 is ready on datalust.co and as datalust/seq in your Docker container registry of choice.

Telemetry data often includes numeric values that change over time. This is roughly the definition of an observability 'metric'.

We've reviewed leader election and replication in Seq clusters. While these are tricky to get right, and involve nontrivial code, they're dwarfed in complexity by work sharing, which is the basis of Seq's scale-out functionality.

TL;DR: Heatmaps are a great way to visualize timing data over time.

Now that we've seen how Seq clusters coordinate the leader and follower roles, let's look one layer further down the stack.

It's been a while since we posted an update on Seq's hard-working command-line client, seqcli.

We spent the past 12 months making Seq HA-capable and able to scale work out across multiple nodes. This post is the first of three that dig into how clustering is implemented. It's not so much about using Seq, as about how it works inside, and along the way we'll touch on some of the trade-offs we chose.

TL;DR: Seq 2025.1 is here! If you're upgrading machines in a disaster recovery (DR) configuration, take note of the requirements for this upgrade. Otherwise, grab the MSI from datalust.co/download, or pull datalust/seq:latest from your preferred registry, and enjoy the most polished and productive Seq release yet.

Now in preview, Seq 2025.1 introduces high availability (HA), scale-out clustering in the Datacenter subscription tier.

Seq 2025.1 introduces a Replace function that replaces occurrences of a pattern with a replacement. To replace the word March with the word April:

TL;DR: Seq 2025.1 supports connecting system notifications to an output app instance to proactively receive notifications.

TL;DR: Dashboards, alerts and queries that include percentile calculations will run faster and more efficiently with Seq 2025.1, in exchange for a small reduction in accuracy.

TL;DR: ever wanted to reset the Seq events screen quickly, deselecting active signals, clearing the filter box, and resetting the date range? In Seq 2025.1, now in preview, that's Ctrl Space, followed by c. You can learn about this shortcut and others by pressing Ctrl K in any screen.

It's time to take the wraps off the next big Seq update! The 2025.1 preview MSIs are now on the Seq download page and datalust/seq:preview is ready to pull from Docker Hub.

This post continues on from a previous post, Enhancing .NET Aspire Observability with Seq. Since that post was published, a Seq component has been included in .NET Aspire, making it even easier to include Seq in your .NET Aspire solution.

This post describes our approach to implementing a disk-backed hashmap in Rust for indexing high-cardinality predicates in our diagnostics product, Seq. If you've ever wondered how a hashmap works, or what makes a disk-backed datastructure different from an in-memory one, you might find it interesting.

TL;DR: With Seq 2024.3, Seq gains user-defined high-cardinality indexes, its first new index type since the introduction of signal indexes back in 2018! If you're eager to skip to the binaries and dig around for yourself, you can get MSIs at https://datalust.co/download, or pull datalust/seq:latest from Docker Hub.

Now in preview, Seq 2024.3 introduces a new index type on event properties, known as expression indexes. Under the right circumstances, expression indexes reduce search time from minutes to milliseconds.

TL;DR: for the latest UX and performance improvements, pull datalust/seq:latest from Docker Hub, or grab the MSI from datalust.co/download.

Introducing the new Seq.App.Mail.* packages for SMTP and Microsoft365 email.

Seq 2024.1 introduced a change to the default display of nested event properties. Previous versions of Seq rendered collapsed nested structures that could be expanded to access a context menu on the nested properties. The newer scheme flattens nested properties into dotted names and makes the regular property context menu available for all nested properties.

Distributed tracing makes Seq even better for monitoring and troubleshooting the behavior and performance of complex distributed systems. The emerging standard for logging and tracing is OpenTelemetry, which Seq supports via the OpenTelemetry Protocol (OTLP).

.NET Aspire is a toolkit for development and deployment of microservice applications. It is a local orchestrator with support for deployment to production-grade orchestrators like Azure Container Apps or Kubernetes.

OpenTelemetry has emerged as an important standard for generating observability data. It provides a consistent model across all environments and reduces vendor lock-in. As such, we think it is important for Seq to support OpenTelemetry clients in addition to the other ingestion options that Seq provides.

Seq uses the OpenTelemetry service.name attribute, or Serilog-style Application property, to determine which color should be used for the spans belonging to a service.

Seq 2024.1 is here! 🎉 Get the Windows MSI at datalust.co/download, or pull datalust/seq:latest from Docker Hub.

Seq 2024.1 RC is ready for you to try! 🎉

TL;DR: Seq 2024.1 will fully support distributed tracing, including OpenTelemetry trace ingestion, trace indexing, and hierarchical trace visualization. The datalust/seq:preview container images and 2024.1.x-pre MSIs are ready to download and try in non-mission-critical environments. We'd love for you to check these out and share your experiences and feedback!

We've just released Seq 2023.4.10219 with some improvements to the new range selector, along with a handful of bug fixes.

TL;DR: Download Seq 2023.4 at datalust.co/download or pull datalust/seq from Docker Hub.

TL;DR: the new Seq.Apps.Testing package makes it easy to interactively debug Seq Apps in C#, by hosting them in a console app and sending events directly from Serilog.

TL;DR: Seq 2023.3 introduces the unnest set function and lateral cross joins, enabling natural queries over nested collections in log events.

TL;DR: Seq 2023.3 is now available from datalust.co and by pulling datalust/seq from Docker Hub. It adds support for SQL-style unnest() over JSON array data, and introduces secure internal auditing for the Seq Datacenter tier.

Structured logs are the latest component of the OpenTelemetry protocol (OTLP) to stabilize. The promise of structured logging with OTLP is huge: built around a common data model and tightly-specified protocol, fully-structured application logs should soon be able to be shipped from just about any application to any log server with a minimum of fuss.

TL;DR: Seq 2023.2 is out! It adds a native ingestion endpoint for OpenTelemetry Logs, which makes it easier getting structured logs into Seq from a wider range of sources.

Just yesterday we posted an update on Seq's support for the OpenTelemetry logs protocol. One slightly painful limitation, which resulted in quite a bit of extra setup complexity, was support for the gRPC transport only.

Hi! 👋 We've just published Seq 2023.2.9305-pre, the first preview MSI and Docker Hub :preview tag for the upcoming Seq 2023.2.

It's been a month since Seq 2023.1 was released, and in that time we've seen a great uptake of the new version for Seq installations large and small.

Log data is noisy! Sometimes a rock band playing at the foot of your bed kind of noisy. This isn't always a bad thing - a lot of good log data is speculative, and when it turns out to be important you're glad it's there.

Nearly a year in the making, Seq 2023.1 is faster, plays better with container hosts, and scales up like no Seq version before. Get the Windows MSI at 👉 datalust.co/download, or pull datalust/seq:latest from Docker Hub.

TL;DR: Seq's new query engine uses CPU cores and memory more intelligently. It's ready to try in non-mission-critical environments, and we're eager for your feedback!

It's not always possible to ship logs directly from an application to a centralized log server like Seq. Many interesting systems, new and old, write text or JSON log files locally, and rely on a separate collector to read, parse, and ship them.

As more functionality moves to the browser it can be useful to send log events to Seq directly from the browser. This can be accomplished using the seq-logging library.

A behind-the-scenes look at the next version of Seq

The benefits of centralized, structured logging should be available to all technology stacks, which is why there are Seq clients for many different programming languages, including Python, Java and JavaScript (Node.js).

Another (possibly final!) Seq 2022.1 maintenance release is now available from Docker Hub, AWS ECR, and at datalust.co/download.

The concept of log event "levels" is ubiquitous, appearing in practically every application logging library and language. We have an intuitive sense of what familiar levels like debug, warning, and error mean, but there's surprisingly little useful advice out there on how to use levels effectively. Here's one tip based on what I've learned building systems, and helping people to "log better" these last eight years:

We've just published a new patch for Seq 2022.1, including a number of bug fixes, and support for the ECR Public Gallery.

A journal entry  from the Seq Engineering Team

Alert notifications can be delivered from Seq via SMS by using a third-party SMS service and the new Seq.App.HttpRequest Seq app.

Seq uses a roles-and-permissions based scheme for managing user privileges. Users are assigned to roles, and roles carry one or more of a handful of permissions that API endpoints demand.

We've been working away on Seq 2022.1 for several months, improving usability, performance, and security. Today you can download the new MSI for Windows, or pull datalust/seq:latest from Docker Hub, and find out where all of our efforts have been focused!

In Seq 2022.1 we've hit a bit of an internal milestone. It's the first release of Seq ever with no dependency on any external storage engine. On Windows that means ESENT is no longer used for local metadata (document) storage, and on Linux that means no more LMDB. All traces of these other engines have been hoisted out-of-tree and all local storage now runs through Flare, the storage engine initially built for Seq's event store.

If your experience is anything like mine, debugging in production is as much about organizing information - clues, leads, sometimes frustrating dead-ends - as it is about unearthing it. Working through an issue, I need pen and paper, sticky notes, whiteboards and spreadsheets as much as I depend on searching logs.

Signals are one of Seq's most important and useful features. Activating and combining signals can very quickly limit a search or query down to a narrow stream of relevant events.

Seq 2021.4 has shipped! 🎉 Find downloads and container information at datalust.co/download.

Seq can monitor the event stream and trigger alerts when configured conditions occur. For example, a system produce an alert when an item runs out of stock.

Templates make it easy to copy entities like signals and dashboards from one Seq server to one or more others:

Seq 2021.4, scheduled for December, will be our first release targeting .NET 6 and ARM. Porting to the new instruction set began right at the start of 2021, which has meant targeting both .NET 5 and .NET 6 simultaneously over the course of the year. This post is a quick rundown of how we've made that work.

TL;DR: check out the complete, full-featured sample on GitHub.

Today we're very pleased to announce the release of Seq 2021.3. You can download the Windows installer from datalust.co, or pull the latest datalust/seq image from Docker Hub.

We're only two weeks away from the release of Seq 2021.3, on October 26th! The latest preview build is feature-complete, so now's a great time to share an update on what you can look forward to in this release.

Seq 2021 introduced a fantastic new visualization of how Seq uses disk and memory resources, under Data > Storage:

The first 2021.3 preview builds are now live on datalust.co/download and Docker Hub. Along with some other improvements, they include the very first pieces of clustered Seq: disaster recovery (DR) and zero-downtime upgrades through asynchronous replication.

Without the log data, searches, and dashboards that show what your application or system is up to, Seq is just a blank frame.

Seq internally stores all event timestamps in UTC.

Today we're pleased to take the wraps off of Seq 2021.2, which you can download from datalust.co, or pull from Docker Hub as datalust/seq:latest.

We love all things Docker, especially the opportunity it presents for streamlining how apps like Seq are deployed and operated.

In case you missed it, we've also included updates in 2020.5, which was released on Dec 24, 2020. 🎄

Seq 2020.4 has just hit the downloads page and Docker Hub.

This release improves stability for Seq customers using Azure Active Directory (AAD) authentication. We've also made some much-anticipated changes to live tailing to make it more responsive and easier to follow.

:::

Seq Forwarder is a tiny local server that imitates the Seq HTTP ingestion API. You can send logs to it using any Seq client library; by default it listens on port 15341:

:::

:::

Using Seq.Input.Syslog, Seq is able to ingest syslog messages --- both RFC3164 and RFC5424 formats --- as structured logs.

Seq 2020.1 includes some interesting query language improvements, including object literals, a universal ci case-insensitive text comparison modifier, conditional expressions, and a bunch of new built-ins. Now seems like a good time to reintroduce our much-loved query language from the ground, up!

Our brand new Ingestion view is designed to help Seq admins feel in control of their incoming data.

OpenID Connect is a standardized protocol that lets organizations streamline user management across multiple apps and services.

We've been hard at work since the release of Seq 5.1 last year, and today we're excited to finally take the wraps off Seq 2020.1.

TL;DR: in Seq 2020.1, the postfix ci keyword turns any text comparison into a case-insensitive one. Download the preview or pull datalust/seq:preview from Docker Hub to try it out!

Hi! We hope 2020 is treating you well, despite its unique challenges. At Datalust we've settled into a new fully-remote workflow, which, thankfully, we were reasonably well-prepared for by our existing partly-remote schedule. We know it hasn't been so easy for everyone, so if you're facing any difficulties we can help with, we hope you'll be in touch.

This week at Datalust, we welcomed our new software engineer, Larene Le Gassick, to the team!

One of the first major internal changes planned for Seq 6 just landed in the latest preview, 6.0.3403-pre.

Happy New Year from all of us at Datalust! 🥳

Seq 5.1.3200 is a new in-place update for Seq 5.1 that addresses a handful of bugs, and closes some small feature gaps. Binaries are available from the Seq downloads page, and container images from Docker Hub.

Today, we're introducing Datalust Accounts: a simple new facility that provides easy access to Seq license certificates and invoices.

Seq 5.1.3118 is a straightforward in-place update that fixes several issues in earlier 5.x builds. Binaries are now available from the Seq downloads page and from Docker Hub.

We're delighted to have two people from Datalust speaking at NDC Oslo in June this year. Read on below for sessions and times, and if you're lucky enough to be in Oslo for the event, we hope you'll say "Hi!"

Seq maintenanance release 5.1.3093 is now available from the Seq downloads page and on Docker Hub.

Custom inputs are an exciting new feature in Seq 5.1. For me, anyway, there's something magical about plug-in systems and being able to extend an app in ways its creators might not have envisaged.

Seq Apps are plug-ins that read or write events to the Seq event stream. Seq apps have been around a long time, but they've been refreshed and updated recently, first to support non-.NET programming languages, and more recently, to support .NET Standard and a more efficient C# API.

If you run a public-facing web site, chances are you use an uptime monitoring service like StatusCake, Pingdom, or the cries of frustrated users, to alert you when it's offline.

Nested somewhere under C:\inetpub\logs, IIS, the popular Windows web server, writes files like this:

When we shipped Seq 5.0 back in November, our new storage engine was compiled against Rust's unstable nightly channel. As of Seq 5.1, we can instead use the supported stable channel. That feels like a bit of a milestone so I'd like to share a few details about our journey from nightly to stable, and celebrate the progress the community has made on the language, libraries, and tooling over the last twelve months that made that journey painless for us.

We've spent four solid months extending and refining Seq 5. TL/DR? Download the Seq 5.1 installer for Windows or pull datalust/seq from Docker Hub.

Seq 5.1 is on its way! Version 5.0 was a major turning point for Seq, and we're still coming to terms with everything we can now build on its foundations.

Docker's built-in logging infrastructure takes STDOUT and STDERR from a running container, and sends each line of text to one of several logging drivers. This makes it possible to monitor and diagnose issues in containerized apps without any special logging configuration in the app itself.

Today we're excited to take the wraps off Seq 5, a major update to our much-loved log server --- bringing faster storage and lower resource requirements, support for Docker on Linux, beautiful new dark and light themes, and a host of improvements throughout the product.

TL;DR: The latest Seq beta build adds workspaces to help keep the Seq user interface focused even when a large number of signals, queries, and dashboards are in use. We've used this opportunity to align how signals, queries, workspaces, and dashboards are shared and managed in team settings.

TL;DR: Seq 5.0.2138-pre is our first supported beta from the 5.x series, and will be upgradable through to RTM. Seq 5 includes massive storage improvements for high-volume deployments. Download from https://getseq.net/download or pull the Docker image.

Seq is a log server that's built using a few programming languages; we have a storage engine called Flare written in Rust, and a server application written in C#. Our language stack is something I've talked about previously.

At Datalust we've been busy building Flare: a storage engine for our log server, Seq, written in the Rust programming language.

TL;DR: We're rolling out an all-new logo. We hope you like it!

At Datalust we build a log server called Seq. It's really a database, written in C#, with its own SQL-based query language, that's specifically designed for storing and querying structured log data.

Plain-text logs are still with us! --- Although newline-delimited JSON is, thankfully, an increasingly common format for log files and streams, painting a complete picture of a system still does sometimes mean slurping up unstructured output, or sifting through plain text.

Seq is a log server designed for modern structured logging and application monitoring. It's used in all kinds of organizations, with a wide variety of development technologies.

What's been cooking this last month in the Seq kitchen? Today we published version 5.0.949-pre as a new datalust/seq Docker image, and for the first time, a .NET Core-based Windows MSI that's available from the Seq downloads page.

It's here! Version 4.5 adds NLog to the list of industrial-strength logging libraries for .NET with full structured logging support.

This week we hit the first major milestone on our journey towards a cross-platform Seq. It's been on the radar for several years, but over the last two months we've done the work of retargeting Seq from the full .NET Framework to to .NET Core and .NET Standard.

Today we're announcing the first developer preview of datalust/seq, our official Linux-based Docker image for the Seq log server.

Seq frequently gets integrated into all kinds of ops tools and processes:

Seq can archive events for long-term storage to a set of regular log files, either directly to a SAN or to somewhere that a background task can pick them up and send them to off-site storage.

Seq 4.2 is now available for download. This release is one of our biggest point releases ever, with UX improvements, optimizations, polish, and bug-fixes throughout.

Structured logging has exploded in popularity over the past few years. We've put together this streamlined guide to Serilog, .NET's favorite structured logging library, so you can get up and running fast.

Seq 4.2.280-pre introduces signal groups, a huge improvement to how signals are organized and combined to produce a filtered view of the log stream.

This week we're delighted to welcome Ashley Mannix to the Datalust team! Ashley brings a wealth of engineering talent and valuable insight, at a time when Seq is growing faster and being used in increasingly challenging and sophisticated scenarios.

An updated guide to Serilog.Sinks.Seq

The Seq dashboard is generally used for charting values over time. There are a few monitoring scenarios, though, in which a single value of some measurement is most important:

Since Seq 4 first shipped in May, we've been hard at work on Seq 4.1, which contributes to all-round performance and polish, and further enhances the new dashboarding experience.

We're happy to announce the general availability of Seq 4.0, now with beautiful dashboards powered directly from application log data.

NLog 4.5 (now in alpha status) makes it significantly easier to filter, correlate, and analyze large volumes of log data from complex, asynchronous and distributed systems.

ASP.NET Core comes with request logging built-in. This is great for getting an app up-and-running, but the events are not as descriptive or efficient as hand-crafted request logging can be. Here is a typical trace from a single GET request to /about:

Seq 3.4 is ready to download!

ASP.NET Core comes with some great built-in logging. Framework components such as Routing, MVC and EntityFramework have been updated to support structured logging throughout - for example, when MVC selects a controller and action it includes ActionName in a log event so that later, you can drill down easily to requests hitting a specific action. The framework also adds convenient properties like RequestId to log events by default, making it trivial to zoom in on just the events raised during handling of a particular HTTP request. Setting up truly great application logging in an ASP.NET app has never been easier.

We're delighted to announce the release of Seq 3.3, a major milestone for Seq that raises the bar for usability and convenience.

Last week we wrote a brief post showing off some of the UX improvements coming in Seq 3.3, which we'd planned to release in late September 2016.

Seq supports two distinct syntaxes for working with events. The C#-inspired filter syntax used for searching:

Log data is pretty unruly stuff. As apps evolve it tends to grow in volume fairly quickly, and in the noise it can be hard to work out where application CPU overhead, network bandwidth, and storage space is actually going.

Thanks to the excellent support for ASP.NET Core in Serilog, Seq is pretty amazing in combination with the new ASP.NET libraries.

TL;DR download Seq 3.2 here!

Last month, we took the wraps off of Seq Forwarder, a Windows service that collects and forwards events for occasionally (or unreliably) connected machines.

This week we're taking a look at how Energy Essentials uses Seq in their solutions for the utilities sector.

Today our cadence of monthly releases continues with the general availability of Seq 3.1, the latest update to our log management platform for modern .NET apps.

Our series focusing on the exciting variety of businesses that use Seq continues this week with Precision Discovery.

Durable log shipping turned out to be an unexpectedly popular feature in the Serilog sink for Seq. In this mode, the sink writes log events to a local buffer file, and sends them to Seq in the background using a cursor into the buffer file.

Bunyan is a structured logging library for Node.js. From the README:

There's a great little introduction to structured logging in ASP.NET Core with Serilog and Seq on Channel 9 today.

Today we're pleased to announce the production release of Seq 3.0, a major update to our log server for .NET apps. Downloads are now live on the Seq website.

We are delighted by the wide variety of businesses using Seq. This year we will be featuring some of our customers here, to share their experiences adopting Seq and structured logging.

What we expect is the final pre-release version of Seq 3.0 is now on the downloads page. This version includes many improvements across the board:

A new preview of Seq 3.0 is up on the downloads page. Over last week's 3.0.19-pre build, this one brings:

We are delighted by the wide variety of businesses using Seq. This year we will be featuring some of our customers here, to share their experiences adopting Seq and structured logging.

The recent 3.0.19-pre Seq preview adds Azure Active Directory (AAD) as an authentication option, alongside Active Directory and basic usernames/passwords.

We are delighted by the wide variety of businesses using Seq. This year we will be featuring some of our customers here, to share their experiences adopting Seq and structured logging.

TL;DR: A new Seq 3.0 preview build is available. This one rounds out the syntax of Seq 3.0's most interesting feature, SQL Queries.

Update July 2016: RTM is here! This post was originally written for RC1, but has now been brought up-to-date to cover .NET Core 1.0.

Great logs need to be built-in from the first day of a project. It's only by using your application logs during development and testing that they will deliver their full value in production.

When a new issue shows up in a complex environment, it's nice to know what recently changed. The Seq step template for Octopus Deploy lets you record deployment events to Seq, so that you can view and filter them alongside other events in your logs.

Slack is a great way to keep your development team in sync with each other and the operations environment.

Seq 2.4, just released, continues the theme of refinement in the 2.x series.

Since our last update, version 2.3 shipped, including some huge efficiency wins, and a whole bunch of bug fixes.

We're pleased to announce the next major revision of Seq is ready to download.

We've started to share some of our plans and progress for the next major version of Seq, expected mid-2015. You can catch a sneak peek of Seq/2 on Nicholas Blumhardt's blog.

While the UserVoice site warms up, we're relying largely on the responses to our recent user survey to shape the Seq roadmap. More than a third of respondents rated integrated Active Directory authentication as a top-priority feature, so we're pleased to announce support for it with Seq 1.6, freshly released.

TL;DR: Seq 1.5 is out!

Not that long ago, even releasing software was stressful. Great tools to automate builds, testing and deployment have largely fixed that: if a project is set up carefully, "pressing the button" on a new release can even be fun.

Seq 1.5 is just around the corner. It's the biggest improvement we've made to the product since 1.0, with a major storage overhaul that makes Seq both faster and easier to manage.

Perhaps the most useful, but seldom-noticed benefit of a structured log is having the first-class notion of an event type.

Collecting too much log data makes the "needle in the haystack" all the more difficult to find, but for practical reasons it is often easier to collect as much data as possible anyway and "sort it out later" via Seq retention policies.