Seq and Serilog can be easily combined and when we keep in mind some of the important aspects of writing log messages, we can fully leverage the benefits of both tools. Today I will show you some features I find particularly helpful when working with Seq.
This post is part of the Improve Your Log Messages series. You can find the other parts here:
- Part 1: The Missed Opportunities of Log Files
- Part 2: Structured Logging with Serilog
- Part 3: RavenDB as a Sink for Serilog
- Part 4: Seq as a Sink for Serilog
- Part 5: How to Influence the Output of Serilog
- Part 6: Monitor your Application with Seq
- Part 7: Debugging Serilog
- Part 8: Elasticsearch as a Sink for Serilog
- Part 9: Monitor your Applications with Kibana
- Part 10: Closing the Feedback Loop from Log Messages to Knowledge
- Part 11: How To Analyse IIS Log Files
- Part 12: Using Logstash to Analyse IIS Log Files with Kibana
- Part 13: Analysing Apache Log Files with Logstash and Kibana
- Part 14: How to Analyse SharePoint Log Files
Making Queries
Filtering your events in Seq is a really simple thing: All you need to do is to expand an event and click on the green tick in front of the property you care about.
This opens the context menu where you can specify if you want all events matching this field, it must contain a field like that or if the field must be on the same type. This is all it takes and Seq will filter the events accordingly:
To reuse them later you can click on Require and it will add the first filter to a query. You can repeat this step until all your filters are completed. Then you can click save and should as a following step rename this query to something meaningful:
The best thing on Seq is that it’s so fast. You can combine filters as you like and get a result immediately. This may change with a massive amount of stored events, but on my machine I could get immediate feedback even with 100’000 stored events.
Creating Views
Views are a complement to queries and can be used to specify a more general context. To create a View you use the dropdown menu of the Require button:
As soon as you saved your view it will appear in the list of views at the right side of the screen:
To select one you simply click on the name. From there on you can add another query, rename or delete the view.
Using the Dashboard
The dashboard is the place where you can get an overview on all the important things. All the views, queries or ad-hoc filters can be pinned to the dashboard. It starts out empty but with a few clicks you can customize your dashboard in any way you want.
Pinned queries and views will be added as a counter to the dashboard. As long as nothing happens your dashboard will be boring. But as soon as events occur that matches your pinned items the counters will increment and updated. With this information you see at a glance how your application is behaving:
If you not only care about the last day you can use the small circle in the top left corner to pin the counter to the chart area. From here you can select different ranges varying from the last day to the last year:
You can add multiple views/queries to the chart area and then visually search for events that occur together. This may help you to find out if you really have a big problem or if your users are today especially active and only that pushed your errors up.
More on Seq
If you want to know more on Seq (and Serilog) I can recommend these resources:
- “Modern Structured Logging With Serilog and Seq” by Jason Roberts is a Pluralsight course that shows you in 2 hours all you need to know to get started with Seq and Serilog.
- Nicholas Blumhardt’s blog is full of gems about Seq and Serilog. Should you need to know something that’s not already clear or documented you find him on Twitter as @nblumhardt
- The official website getseq.net contains not only the download page, but hosts a wiki with documentation as well. If you want to know even more you should read their blog at blog.getseq.net.
Next
With Seq you can easily interpret the events created by your application. If you follow along you may have made one or another error in the configuration of Serilog. Next week I will explain how you can debug Serilog to find out what went wrong.