Show table of contents Hide table of contents

Platform:

Log Files

Applications that need to log to a local file can write them in JSON format for easy importing into Seq.

Both newline-delimited JSON and plain-text log files can be imported into Seq using the Command-line Client's seqcli ingest command.

The recommended format is Compact Log Event Format, produced by tools including Serilog.Formatting.Compact.

The seqcli ingest command

The easiest way to import logs is through seqcli ingest:

seqcli ingest -i log-*.txt --json --filter="@Level <> 'Debug'" -p Environment=Test

Logs can be imported from a file (-i <filename>), or ingested in real-time from STDIN.

The following options are supported:

Option Description
-i, --input=VALUE File to ingest, including the * wildcard; if not specified, STDIN will be used
--invalid-data=VALUE Specify how invalid data is handled: fail (default) or ignore
-p, --property=NAME=VALUE Specify name/value properties, e.g. -p Customer=C123 -p Environment=Production
-x, --extract=VALUE An extraction pattern to apply to plain-text logs (ignored when --json is specified)
--json Read the events as JSON (the default assumes plain text)
-f, --filter=VALUE Filter expression to select a subset of events
-m, --message=VALUE A message to associate with the ingested events; https://messagetemplates.org syntax is supported
-l, --level=VALUE The level or severity to associate with the ingested events; this will override any level information present in the events themselves
--send-failure=VALUE Specify how connection failures are handled: fail (default), retry, continue, or ignore
-s, --server=VALUE The URL of the Seq server; by default the connection.serverUrl config value will be used
-a, --apikey=VALUE The API key to use when connecting to the server; by default the connection.apiKey config value will be used
--profile=VALUE A connection profile to use; by default the connection.serverUrl and connection.apiKey config values will be used

For more information, including the syntax for plain text parsing, see the detailed instructions.

Creating compatible JSON files with Serilog

The most common way to create CLEF files is by specifying CompactJsonFormatter when configuring a Serilog sink, for example the file sink.

This must be installed from NuGet first:

Install-Package Serilog.Sinks.File
Install-Package Serilog.Formatting.Compact

The formatter is passed either in C# configuration:

Log.Logger = new LoggerConfiguration()
  .WriteTo.File(new CompactJsonFormatter(), "./logs/myapp.json")
  .CreateLogger();

Or via XML <appSettings>:

<appSettings>
  <add key="serilog:using:File" value="Serilog.Sinks.File" />
  <add key="serilog:write-to:File.path" value="./logs/myapp.json" />
  <add key="serilog:write-to:File.formatter"
       value="Serilog.Formatting.Compact.CompactJsonFormatter, Serilog.Formatting.Compact" />