I seem to have a problem selecting log events that have a sub-property encoded as a DateTime() string. Could just be my syntax is in error, but:
selecting events called SpotPrice with a 'numeric' sub-property using: SpotPrice.PriceSeqId > 50000 works, returns events with a PriceSeqId greater than 50,000
whereas, trying to select from the same events but on a sub-property called DateTimeUTC fails, using something like:
DatePart(DateTime(SpotPrice.DateTimeUTC), 'month', OffsetIn('America/New_York', DateTime(SpotPrice.DateTimeUTC))) = 4
(as an aside, this expression: SpotPrice.DateTimeUTC = '2024-05-03T15:13:24.1714197' works, and returns a single event)
Needless to say, I'm trying to select events that have their own (internal) datetimes (generated by some remote server) instead of selecting events based upon SEQ's own @TimeStamp. Any pointers appreciated.
Have also tried numerous variants on the search, such as: DateTime(SpotPrice.DateTimeUTC) > DateTime('2024-05-03T15:13:16.2726572') etc
am using Seq 2023.4.10097, logging Serilog events from a Windows C# app.
The SEQ log: from SEQ browser
image showing Timestamp and event sub-property SpotPrice.DateTimeUTC on different day
The query returns no results because DateTime('2024-05-03T15:13:24.171419') is null. Without a time zone Seq can't know how to parse the date.
Since the date string is UTC you can do DateTime(concat(SpotPrice.DateTimeUTC, 'Z')) and it should work.
