datalust/seqcli/seq-search-and-query
Claude Code and agent skill by datalust/seqcli
- community
Checking that the SKILL.md file is still in the repository.
Search and query logs and spans in Seq. Use when interacting with Seq.
Install
npx vskill@latest install datalust/seqcli/seq-search-and-querySKILL.md
Seq is a storage service for log and trace telemetry. Search Seq to retrieve matching log events and spans. Query Seq to compute tabular, aggregate results from log events and spans.
Seq's query language is not SQL — assuming SQL semantics will produce errors. Do NOT rely on prior knowledge of Seq's query language. Always use the grammar, rules, and examples in this document as a basis for Seq queries and searches.
Starting a Diagnostic Session
Being "confidently wrong" is the most common and worst failure mode when working with diagnostic data. EVERY diagnostic session MUST begin with the following steps:
- Check for relevant signals. Many event filtering problems have already been solved and the resulting filters saved as efficiently indexed signals.
- Retrieve a sample of relevant events. Use signals identified in (1) where appropriate, event search and query supports them.
- Proactively confirm the schema of the search results using appropriate tools.
- Inspect a subset of relevant events in full.
- Determine how the correctness of any conclusions can be verified using real diagnostic data.
DO NOT skip steps just because early results suggest a quicker path to a solution: this is the path to being confidently wrong!
Event Data Model
All events stored in Seq use the same data model. Spans are distinguished from log events by the presence of the @Start property. The following built-in properties are supported.
| Built in property name | Type | Description | |
|---|---|---|---|
@Arrived | number | An integer indicating the order in which the event arrived at the Seq server relative to other events in the same batch. | |
@Data | object | A compact internal representation of the event as a single structured object. High runtime cost, should be avoided when possible. | |
@Elapsed | number? | The elapsed duration of a span, expressed in 100 nanosecond ticks. In the same domain as Seq's duration literals such as 1s, 23ms, or 3d. Only present on spans, not present on log events. | |
@EventType | number | A numeric hash of the message template that was used to generate the event. The message template itself is in the @MessageTemplate property. | |
@Exception | string? | The exception associated with the event if any, as a string. This normally incorporates the exception type, message, and stack trace. | |
@Id | string | The event's unique id in Seq. | |
@Level | string | The severity of a log event, or completion status of a span. Values are source-dependent, so for example 'Error', 'ERROR', and 'err' would all be typical values. | |
@Message | string | Human-readable text associated with the event. Often the result of substituting @Properties values into @MessageTemplate. For spans, this property carries the span name. | |
@MessageTemplate | string | A message template, following the messagetemplates.org syntax. Message templates collectively identify events generated from the same line of logging/tracing code. | |
@ParentId | string? | The @SpanId of the parent of a given span, if any. The parent span will always belong to the same trace, that is, share a @TraceId value. Only present on spans, not log events. | |
@Properties | object? | An object containing the user-defined properties of a log event or span. Properties with names that are valid C-style identifiers can be accessed implicitly, so RequestPath is syntactically equivalent to @Properties['RequestPath']. Properties generally conform to naming conventions used throughout the Seq server - sometimes simple PascalCase names, and at other times using the OpenTelemetry semantic conventions. See also @Resource and @Scope. | |
@Resource | object? | For an OpenTelemetry log event or span, the properties associated with the OpenTelemetry resource. These may follow the OTel semantic conventions, but may also be domain-specific or user-defined. | |
@Scope | object? | For an OpenTelemetry log event or span, the properties associated with the OpenTelemetry scope. These may match definitions in the OTel semantic conventions, but may also be domain-specific or user-defined. | |
@SpanId | string? | The W3C span id that uniquely identifies a span within a trace. Log events recorded during the span carry the same @SpanId value as the span itself. | |
@SpanKind | string? | The OpenTelemetry span kind. Only present on spans, not log events. | |
@Start | number? | The time at which the span started. @Timestamp minus @Start is the @Elapsed time of the span. In the same units as Seq's duration literal syntax. | |
@Timestamp | number | The time at which an event was recorded (completion time, for spans). Carried on all log events and spans. In the same units as Seq's duration literal syntax. | |
@TraceId | string? | The W3C trace id that uniquely identifies a trace. All spans and log events within a trace carry the same trace id value. |
Tip: if searching or querying withseqcli, pass--nativeto show results in round-trippable, agent-friendly syntax. Consider--jsoninstead for programmatic scenarios, but take care: in JSON output mode, built-in property names are abbreviated.
Type System
Stored data and intermediate values in expression evaluation are typed dynamically. Values are always one of the following types.
| Type name | Description | Example literals | |
|---|---|---|---|
| null | The atom null. Null is a value in Seq's type system. | null | |
| boolean | The atoms true and false. | true, false | |
| number | Decimal numbers with the range and precision of .NET's decimal type. | 0, 12.34, 56ms, DateTime('2026-05-29T10:56:01.43278Z'), 0xa1b234ff | |
| array | An ordered array of values. | [], [17, null, {a: 'test'}] | |
| object | An unordered set of name/value pairs. | {}, {a: 'test', 'b c': 17, d: []} |
In expression evaluation, Seq does not perform any type coercion.
The results of functions and operators that receive invalid arguments are undefined, which is the absence of a value (_undefined_ has the same "poison" semantics as NULL in standard SQL).
Type notation in this document column uses the suffix ? on a type name to indicate values that may be undefined. The synthetic type name any is used as an alias for null | boolean | number | array | object.
Scalar Functions and Operators
These built-in functions and operators work with individual values. See Aggregate Functions for information on functions like count() and distinct() that work with sets of values.
This is the start of the file. Read the full SKILL.md on GitHub.
Security
- Security scanPassed, 100 of 100Pattern checks on the skill's files.
- Model reviewNot runA model review is scheduled for the next rescan.
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingsrc/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md
Popularity
- 7-day trend score
- 0
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/datalust/seqcli/seq-search-and-query)