Search code examples
loggingseq

How can I query a json file in Seq?

I'm completely new in logging but familiar in SQL queries. I'm now experimenting with Serilog and Seq. I managed to make JSON lines log file with Serilog and could import the file into Seq by the seqcli ingest -i command. I can query my stream but in a very limited way. E.g.

select * from stream

works as shown on the screenshot below (the example file is Seq's own log):

enter image description here

I can also query the @Timestamp, @Arrived and @Data colums as

select @Timestamp, @Arrived, @Data from stream

but I don't know how can I reach the properties inside @Data. I expect something like

select @Timestamp, @Arrived, @Data.@[email protected] from stream

but this doesn't work. How can I list for example the @Data.@[email protected] values?

UPDATE

Interesting that Seq shows something else than the original content of the file. This part: enter image description here looks in the original file simply as this:

{"@t":"2022-03-30T14:24:49.0999009Z","@mt":"Creating default workspace for {UserId}","UserId":"user-admin"}

so, regarding this, I would expect

select @mt.UserId from stream

or some similar query work.

Solution

  • When importing using seqcli ingest, you need to specify --json, e.g.:

    seqcli ingest -i ./some.log --json