skills.rest
datalust
datalustOFFICIAL
Explore all skills by this author →
WebsiteGitHub

seq-search-and-query

Search and query log events and spans in Seq using its native expression language.

167|30|Updated Feb 5, 2018
Search Tags:#diagnostics#tracing#opentelemetry#query language#log search#seq#seqcli
One-click install
npx skills add https://github.com/datalust/seqcli --skill seq-search-and-query-datalust
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: seq-search-and-query
Source: https://github.com/datalust/seqcli/tree/main/src/SeqCli/Skills/Resources/seq-search-and-query
Command: npx skills add https://github.com/datalust/seqcli --skill seq-search-and-query-datalust

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Investigating production issues in Seq requires writing searches and queries in Seq's own expression language, which is not SQL and has many non-obvious rules. This Skill prevents confidently-wrong diagnostics by enforcing a disciplined investigation workflow and providing the complete grammar, functions, and gotchas needed to write correct Seq searches and queries. ## Core Features & Use Cases - Diagnostic Session Workflow: Enforces a five-step investigation process: check signals, sample events, confirm schema, inspect events, and verify conclusions against real data. - Complete Language Reference: Documents the event data model, type system, scalar and aggregate functions, and full EBNF grammar for expressions and queries. - Tracing Tactics: Provides recipes for reconstructing traces, ranking services by span latency, and correlating log events with spans via @TraceId and @SpanId. - Use Case: An engineer investigating elevated latency runs a grouped query computing p95 span duration per service over the last 30 minutes, correctly aliasing group keys and ordering by aggregate aliases. ## Quick Start Ask the assistant to search Seq for errors in the last hour and summarize which services are producing them.

Frequently Asked Questions about seq-search-and-query

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search logs in Seq from the command line?▼

Use seqcli search with a filter expression, for example matching @Level or message text with the like operator. Pass --native for round-trippable output or --json for programmatic consumption, and constrain results with @Timestamp bounds.

How do I write a query in Seq's query language?▼

Seq queries use select, from stream, where, group by, having, order by, and limit clauses, but the language is not SQL. Group keys must be aliased and excluded from the select list, and aggregate aliases are used in having and order by.

Is Seq's query language the same as SQL?▼

No, Seq's query language is not SQL and SQL semantics will produce errors. It has its own grammar, dynamic type system with undefined values, duration literals, and functions like percentile() and interval() that differ from standard SQL.

How do I find all events belonging to a trace in Seq?▼

Filter on @TraceId equals the trace id string to match all spans and log events in the trace. Use seqcli trace -i <traceid> or the seq_load_trace MCP tool to reconstruct the call tree, and add 'not Has(@Start)' to find only log events.

Why does my Seq query fail when grouping by a property?▼

Group keys are automatically included in result rowsets and must not appear in the select list. Alias the group key with 'group by <expr> as <alias>' and reference that alias in order by; adding the key to select causes failure.

How do I compare timestamps in Seq queries?▼

Timestamps are .NET DateTime ticks, so comparing them with strings fails. Use duration literals like Now() - 10m for relative windows and the DateTime() function to convert ISO-8601 strings for absolute bounds.

Related Skills

Explore More Software Engineering Skills→
hopeoverturehopeoverture
6

sentry-and-otel-setup

Configure Sentry and OpenTelemetry error tracking and performance monitoring for Next.js applications.

Community
Advanced
Proxy2021Proxy2021
5

api_monitor

Aggregate endpoint metrics, latency, and alert status to monitor API health.

Community
Advanced
clix-soclix-so
5

clix-event-tracking

Design and validate Clix event tracking strategies with snake_case naming and JSON primitive properties.

Official
Advanced
rudironsonirudironsoni

dotnet-structured-logging

Design log aggregation pipelines for .NET distributed systems using ELK, Seq, or Grafana Loki.

Community
Advanced