{"id":23626333,"url":"https://github.com/datalust/seqcli","last_synced_at":"2025-10-04T06:26:44.353Z","repository":{"id":29271814,"uuid":"120374080","full_name":"datalust/seqcli","owner":"datalust","description":"The Seq command-line client. Administer, log, ingest, search, from any OS.","archived":false,"fork":false,"pushed_at":"2025-03-28T00:05:49.000Z","size":12184,"stargazers_count":151,"open_issues_count":18,"forks_count":22,"subscribers_count":7,"default_branch":"dev","last_synced_at":"2025-03-28T16:05:23.890Z","etag":null,"topics":["seq"],"latest_commit_sha":null,"homepage":"https://datalust.co/seq","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/datalust.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-02-05T23:12:41.000Z","updated_at":"2025-03-28T00:05:54.000Z","dependencies_parsed_at":"2023-10-12T15:26:31.143Z","dependency_job_id":"810f87b6-d03f-4f1f-8bb9-65276db49d67","html_url":"https://github.com/datalust/seqcli","commit_stats":{"total_commits":410,"total_committers":11,"mean_commits":37.27272727272727,"dds":0.275609756097561,"last_synced_commit":"16da172bf51ef40e5880cd09da0547e5034c2332"},"previous_names":[],"tags_count":77,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datalust%2Fseqcli","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datalust%2Fseqcli/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datalust%2Fseqcli/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datalust%2Fseqcli/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/datalust","download_url":"https://codeload.github.com/datalust/seqcli/tar.gz/refs/heads/dev","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247217172,"owners_count":20903008,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["seq"],"created_at":"2024-12-27T22:52:58.735Z","updated_at":"2025-10-04T06:26:44.345Z","avatar_url":"https://github.com/datalust.png","language":"C#","readme":"# `seqcli` [![CI](https://github.com/datalust/seqcli/actions/workflows/ci.yml/badge.svg?branch=dev\u0026event=push)](https://github.com/datalust/seqcli/actions/workflows/ci.yml) [![GitHub release](https://img.shields.io/github/release/datalust/seqcli.svg)](https://github.com/datalust/seqcli/releases)\n\nThe [Seq](https://datalust.co/seq) client command-line app. Supports logging (`seqcli log`), searching (`search`), tailing (`tail`), querying (`query`) and [JSON or plain-text log file](https://github.com/serilog/serilog-formatting-compact) ingestion (`ingest`), and [much more](https://github.com/datalust/seqcli#commands).\n\n![SeqCli Screenshot](https://raw.githubusercontent.com/datalust/seqcli/dev/asset/SeqCli.png)\n\n## Getting started\n\nThe Seq installer for Windows includes `seqcli`. Otherwise, download the [release for your operating system](https://github.com/datalust/seqcli/releases). Or, if you have `dotnet` installed, `seqcli` can be installed as a global tool using:\n\n```\ndotnet tool install --global seqcli\n```\n\nTo set a default server URL and API key, run:\n\n```\nseqcli config set -k connection.serverUrl -v https://your-seq-server\nseqcli config set -k connection.apiKey -v your-api-key\n```\n\nThe API key will be stored in your `SeqCli.json` configuration file; on Windows, this is encrypted using DPAPI; on Mac/Linux the key is stored in plain text unless an encryptor is defined in `encryption.encryptor`. As an alternative to storing the API key in configuration, it can be passed to each command via the `--apikey=` argument.\n\n`seqcli` is also available as a Docker container under [`datalust/seqcli`](https://store.docker.com/community/images/datalust/seqcli):\n\n```\ndocker run --rm datalust/seqcli:latest \u003ccommand\u003e [\u003cargs\u003e]\n```\n\nTo connect to Seq in a docker container on the local machine use the machine's IP address (not localhost) or specify [docker host networking](https://docs.docker.com/network/host/) with `--net host`.\n\nUse Docker networks and volumes to make local files and other containers accessible to `seqcli` within its container.\n\n### Environment variable overrides\n\nEach setting value can be overridden at runtime by specifying an environment variable of the form `SEQCLI_\u003csetting path\u003e`, where \u003csetting path\u003e contains one element for each dotted segment of the setting name, separated by underscores.\n\nFor example the setting `connection.serverUrl` can overridden with the `SEQCLI_CONNECTION_SERVERURL` variable.\n\n### Connecting without an API key\n\nIf you're automating Seq setup, chances are you won't have an API key yet for `seqcli` to use. During the initial Seq server configuration, you can specify `firstRun.adminUsername` and `firstRun.adminPasswordHash` (or the equivalent environment variables `SEQ_FIRSTRUN_ADMINUSERNAME` and `SEQ_FIRSTRUN_ADMINPASSWORDHASH`) to set an initial username and password for the administrator account. You can use these to create an API key, and then use the API key token with the remaining `seqcli` commands.\n\nThe `seqcli apikey create` command accepts `--connect-username` and `--connect-password-stdin`, and prints the new API key token to `STDOUT` (PowerShell syntax is used below):\n\n```\n$user = \"admin\"\n$pw = \"thepassword\"\n$token = (\n  echo $pw |\n  seqcli apikey create `\n    -t CLI `\n    --permissions=\"Read,Write,Project,Organization,System\" `\n    --connect-username $user --connect-password-stdin\n)\n```\n\n## Contributing\n\nSee `CONTRIBUTING.md`.\n\n## Permissions\n\nWhen connecting with an API key the allowed operations are determined by the [permissions assigned to that API key](https://docs.datalust.co/docs/api-keys#api-keys-and-permissions).\n\nTo determine the permission required for a command check the 'Permission demand' column of the [equivalent server API operation](https://docs.datalust.co/docs/server-http-api). For example, the command `apikey create` uses the [`POST api/apikeys` endpoint](https://docs.datalust.co/docs/server-http-api#apiapikeys), which requires the `Write` permission.\n\n## Usage\n\nAll `seqcli` commands follow the same pattern:\n\n```\nseqcli \u003ccommand\u003e [\u003cargs\u003e]\n```\n\n### Command help\n\nThe complete list of supported commands can be viewed by running:\n\n```\nseqcli help\n```\n\nTo show usage information for a specific command, run `seqcli help \u003ccommand\u003e`, for example:\n\n```\nseqcli help apikey create\n```\n\nThis also works for command groups; to list all `apikey` sub-commands, run:\n\n```\nseqcli help apikey\n```\n\nAvailable commands:\n\n - `apikey`\n   - [`apikey create`](#apikey-create) \u0026mdash; Create an API key for automation or ingestion.\n   - [`apikey list`](#apikey-list) \u0026mdash; List available API keys.\n   - [`apikey remove`](#apikey-remove) \u0026mdash; Remove an API key from the server.\n   - [`apikey update`](#apikey-update) \u0026mdash; Update an existing API key.\n - `app`\n   - [`app define`](#app-define) \u0026mdash; Generate an app definition for a .NET `[SeqApp]` plug-in.\n   - [`app install`](#app-install) \u0026mdash; Install an app package.\n   - [`app list`](#app-list) \u0026mdash; List installed app packages.\n   - [`app run`](#app-run) \u0026mdash; Host a .NET `[SeqApp]` plug-in.\n   - [`app uninstall`](#app-uninstall) \u0026mdash; Uninstall an app package.\n   - [`app update`](#app-update) \u0026mdash; Update an installed app package.\n - `appinstance`\n   - [`appinstance create`](#appinstance-create) \u0026mdash; Create an instance of an installed app.\n   - [`appinstance list`](#appinstance-list) \u0026mdash; List instances of installed apps.\n   - [`appinstance remove`](#appinstance-remove) \u0026mdash; Remove an app instance from the server.\n   - [`appinstance update`](#appinstance-update) \u0026mdash; Update an existing app instance.\n - [`bench`](#bench) \u0026mdash; Measure query performance.\n - [`cluster health`](#cluster-health) \u0026mdash; Probe a Seq node's `/health/cluster` endpoint, and print the returned status. This command can also be used to wait on a timeout until the cluster is healthy..\n - `config`\n   - [`config clear`](#config-clear) \u0026mdash; Clear fields in the `SeqCli.json` file.\n   - [`config get`](#config-get) \u0026mdash; View a field from the `SeqCli.json` file.\n   - [`config list`](#config-list) \u0026mdash; View all fields in the `SeqCli.json` file.\n   - [`config set`](#config-set) \u0026mdash; Set a field in the `SeqCli.json` file.\n - `dashboard`\n   - [`dashboard list`](#dashboard-list) \u0026mdash; List dashboards.\n   - [`dashboard remove`](#dashboard-remove) \u0026mdash; Remove a dashboard from the server.\n   - [`dashboard render`](#dashboard-render) \u0026mdash; Produce a CSV or JSON result set from a dashboard chart.\n - [`diagnostics ingestionlog`](#diagnostics-ingestionlog) \u0026mdash; Retrieve the ingestion log.\n - `expressionindex`\n   - [`expressionindex create`](#expressionindex-create) \u0026mdash; Create an expression index.\n   - [`expressionindex list`](#expressionindex-list) \u0026mdash; List expression indexes.\n   - [`expressionindex remove`](#expressionindex-remove) \u0026mdash; Remove an expression index from the server.\n - `feed`\n   - [`feed create`](#feed-create) \u0026mdash; Create a NuGet feed.\n   - [`feed list`](#feed-list) \u0026mdash; List NuGet feeds.\n   - [`feed remove`](#feed-remove) \u0026mdash; Remove a NuGet feed from the server.\n   - [`feed update`](#feed-update) \u0026mdash; Update an existing NuGet feed.\n - `forwarder`\n   - [`forwarder install`](#forwarder-install) \u0026mdash; Install the forwarder as a Windows service.\n   - [`forwarder restart`](#forwarder-restart) \u0026mdash; Restart the forwarder Windows service.\n   - [`forwarder run`](#forwarder-run) \u0026mdash; Listen on an HTTP endpoint and forward ingested logs to Seq.\n   - [`forwarder start`](#forwarder-start) \u0026mdash; Start the forwarder Windows service.\n   - [`forwarder status`](#forwarder-status) \u0026mdash; Show the status of the forwarder Windows service.\n   - [`forwarder stop`](#forwarder-stop) \u0026mdash; Stop the forwarder Windows service.\n   - [`forwarder truncate`](#forwarder-truncate) \u0026mdash; Empty the forwarder's persistent log buffer.\n   - [`forwarder uninstall`](#forwarder-uninstall) \u0026mdash; Uninstall the forwarder Windows service.\n - [`help`](#help) \u0026mdash; Show information about available commands.\n - `index`\n   - [`index list`](#index-list) \u0026mdash; List indexes.\n   - [`index suppress`](#index-suppress) \u0026mdash; Suppress an index.\n - [`ingest`](#ingest) \u0026mdash; Send log events from a file or `STDIN`.\n - `license`\n   - [`license apply`](#license-apply) \u0026mdash; Apply a license to the Seq server.\n   - [`license show`](#license-show) \u0026mdash; Shows license applied to the Seq server.\n - [`log`](#log) \u0026mdash; Send a structured log event to the server.\n - `node`\n   - [`node health`](#node-health) \u0026mdash; Probe a Seq node's `/health` endpoint, and print the returned HTTP status code, or 'Unreachable' if the endpoint could not be queried; note that no API key is required.\n   - [`node list`](#node-list) \u0026mdash; List nodes in the Seq cluster.\n - [`print`](#print) \u0026mdash; Pretty-print events in CLEF/JSON format, from a file or `STDIN`.\n - `profile`\n   - [`profile create`](#profile-create) \u0026mdash; Create or replace a connection profile.\n   - [`profile list`](#profile-list) \u0026mdash; List connection profiles.\n   - [`profile remove`](#profile-remove) \u0026mdash; Remove a connection profile.\n - [`query`](#query) \u0026mdash; Execute an SQL query and receive results in CSV format.\n - `retention`\n   - [`retention create`](#retention-create) \u0026mdash; Create a retention policy.\n   - [`retention list`](#retention-list) \u0026mdash; List retention policies.\n   - [`retention remove`](#retention-remove) \u0026mdash; Remove a retention policy from the server.\n   - [`retention update`](#retention-update) \u0026mdash; Update an existing retention policy.\n - `sample`\n   - [`sample ingest`](#sample-ingest) \u0026mdash; Log sample events into a Seq instance.\n   - [`sample setup`](#sample-setup) \u0026mdash; Configure a Seq instance with sample dashboards, signals, users, and so on.\n - [`search`](#search) \u0026mdash; Retrieve log events that match a given filter.\n - `setting`\n   - [`setting clear`](#setting-clear) \u0026mdash; Clear a runtime-configurable server setting.\n   - [`setting names`](#setting-names) \u0026mdash; Print the names of all supported settings.\n   - [`setting set`](#setting-set) \u0026mdash; Change a runtime-configurable server setting.\n   - [`setting show`](#setting-show) \u0026mdash; Print the current value of a runtime-configurable server setting.\n - `signal`\n   - [`signal create`](#signal-create) \u0026mdash; Create a signal.\n   - [`signal import`](#signal-import) \u0026mdash; Import signals in newline-delimited JSON format.\n   - [`signal list`](#signal-list) \u0026mdash; List available signals.\n   - [`signal remove`](#signal-remove) \u0026mdash; Remove a signal from the server.\n   - [`signal update`](#signal-update) \u0026mdash; Update an existing signal.\n - [`tail`](#tail) \u0026mdash; Stream log events matching a filter.\n - `template`\n   - [`template export`](#template-export) \u0026mdash; Export entities into template files.\n   - [`template import`](#template-import) \u0026mdash; Import entities from template files.\n - `user`\n   - [`user create`](#user-create) \u0026mdash; Create a user.\n   - [`user list`](#user-list) \u0026mdash; List users.\n   - [`user remove`](#user-remove) \u0026mdash; Remove a user from the server.\n   - [`user update`](#user-update) \u0026mdash; Update an existing user.\n - [`version`](#version) \u0026mdash; Print the current executable version.\n - `workspace`\n   - [`workspace create`](#workspace-create) \u0026mdash; Create a workspace.\n   - [`workspace list`](#workspace-list) \u0026mdash; List available workspaces.\n   - [`workspace remove`](#workspace-remove) \u0026mdash; Remove a workspace from the server.\n   - [`workspace update`](#workspace-update) \u0026mdash; Update an existing workspace.\n\n### `apikey create`\n\nCreate an API key for automation or ingestion.\n\nExample:\n\n```\nseqcli apikey create -t 'Test API Key' -p Environment=Test\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | A title for the API key |\n|       `--token=VALUE` | A pre-allocated API key token; by default, a new token will be generated and written to `STDOUT` |\n| `-p`, `--property=NAME=VALUE` | Specify name/value properties, e.g. `-p Customer=C123 -p Environment=Production` |\n|       `--filter=VALUE` | A filter to apply to incoming events |\n|       `--minimum-level=VALUE` | The minimum event level/severity to accept; the default is to accept all events |\n|       `--use-server-timestamps` | Discard client-supplied timestamps and use server clock values |\n|       `--permissions=VALUE` | A comma-separated list of permissions to delegate to the API key; valid permissions are `Ingest` (default), `Read`, `Write`, `Project`, `Organization`, and `System` |\n|       `--connect-username=VALUE` | A username to connect with, useful primarily when setting up the first API key; servers with an 'Individual' subscription only allow one simultaneous request with this option |\n|       `--connect-password=VALUE` | When `connect-username` is specified, a corresponding password |\n|       `--connect-password-stdin` | When `connect-username` is specified, read the corresponding password from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `apikey list`\n\nList available API keys.\n\nExample:\n\n```\nseqcli apikey list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the API key(s) to list |\n| `-i`, `--id=VALUE` | The id of a single API key to list |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `apikey remove`\n\nRemove an API key from the server.\n\nExample:\n\n```\nseqcli apikey remove -t 'Test API Key'\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the API key(s) to remove |\n| `-i`, `--id=VALUE` | The id of a single API key to remove |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `apikey update`\n\nUpdate an existing API key.\n\nExample:\n\n```\nseqcli apikey update --json '{...}'\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--json=VALUE` | The updated API key in JSON format; this can be produced using `seqcli apikey list --json` |\n|       `--json-stdin` | Read the updated API key as JSON from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `app define`\n\nGenerate an app definition for a .NET `[SeqApp]` plug-in.\n\nExample:\n\n```\nseqcli app define -d \"./bin/Debug/netstandard2.2\"\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-d`, `--directory=VALUE` | The directory containing .NET Standard assemblies; defaults to the current directory |\n|       `--type=VALUE` | The [SeqApp] plug-in type name; defaults to scanning assemblies for a single type marked with this attribute |\n|       `--indented` | Format the definition over multiple lines with indentation |\n\n### `app install`\n\nInstall an app package.\n\nExample:\n\n```\nseqcli app install --package-id 'Seq.App.JsonArchive'\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--package-id=VALUE` | The package id of the app to install |\n|       `--version=VALUE` | The package version to install; the default is to install the latest version |\n|       `--feed-id=VALUE` | The id of the NuGet feed to install the package from; may be omitted if only one feed is configured |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `app list`\n\nList installed app packages.\n\nExample:\n\n```\nseqcli app list\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--package-id=VALUE` | The package id of the app(s) to list |\n| `-i`, `--id=VALUE` | The id of a single app to list |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `app run`\n\nHost a .NET `[SeqApp]` plug-in.\n\nExample:\n\n```\nseqcli tail --json | seqcli app run -d \"./bin/Debug/netstandard2.2\" -p ToAddress=example@example.com\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-d`, `--directory=VALUE` | The directory containing .NET Standard assemblies; defaults to the current directory |\n|       `--type=VALUE` | The [SeqApp] plug-in type name; defaults to scanning assemblies for a single type marked with this attribute |\n| `-p`, `--property=NAME=VALUE` | Specify name/value settings for the app, e.g. `-p ToAddress=example@example.com -p Subject=\"Alert!\"` |\n|       `--storage=VALUE` | A directory in which app-specific data can be stored; defaults to the current directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server, used only for app configuration (no connection is made to the server); by default the `connection.serverUrl` value will be used |\n|       `--server-instance=VALUE` | The instance name of the Seq server, used only for app configuration; defaults to no instance name |\n| `-t`, `--title=VALUE` | The app instance title, used only for app configuration; defaults to a placeholder title. |\n|       `--id=VALUE` | The app instance id, used only for app configuration; defaults to a placeholder id. |\n|       `--read-env` | Read app configuration and settings from environment variables, as specified in https://docs.datalust.co/docs/seq-apps-in-other-languages; ignores all options except --directory and --type |\n\n### `app uninstall`\n\nUninstall an app package.\n\nExample:\n\n```\nseqcli app uninstall --package-id 'Seq.App.JsonArchive'\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--package-id=VALUE` | The package id of the app package to uninstall |\n| `-i`, `--id=VALUE` | The id of a single app package to uninstall |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `app update`\n\nUpdate an installed app package.\n\nExample:\n\n```\nseqcli app update -n 'HTML Email'\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--id=VALUE` | The id of a single installed app to update |\n| `-n`, `--name=VALUE` | The name of the installed app to update |\n|       `--all` | Update all installed apps; not compatible with `-i` or `-n` |\n|       `--version=VALUE` | The package version to update to; the default is to update to the latest version in the associated feed |\n|       `--force` | Update the app even if the target version is already installed |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `appinstance create`\n\nCreate an instance of an installed app.\n\nExample:\n\n```\nseqcli appinstance create -t 'Email Ops' --app hostedapp-314159 -p To=ops@example.com\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | A title for the app instance |\n|       `--app=VALUE` | The id of the installed app package to instantiate |\n| `-p`, `--property=NAME=VALUE` | Specify name/value settings for the app, e.g. `-p ToAddress=example@example.com -p Subject=\"Alert!\"` |\n|       `--stream[=VALUE]` | Stream incoming events to this app instance as they're ingested; optionally accepts a signal expression limiting which events should be streamed, for example `signal-1,signal-2` |\n|       `--overridable=VALUE` | Specify setting names that may be overridden by users when invoking the app |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `appinstance list`\n\nList instances of installed apps.\n\nExample:\n\n```\nseqcli appinstance list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the app instance(s) to list |\n| `-i`, `--id=VALUE` | The id of a single app instance to list |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `appinstance remove`\n\nRemove an app instance from the server.\n\nExample:\n\n```\nseqcli appinstance remove -t 'Email Ops'\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the app instance(s) to remove |\n| `-i`, `--id=VALUE` | The id of a single app instance to remove |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `appinstance update`\n\nUpdate an existing app instance.\n\nExample:\n\n```\nseqcli appinstance update --json '{...}'\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--json=VALUE` | The updated app instance in JSON format; this can be produced using `seqcli appinstance list --json` |\n|       `--json-stdin` | Read the updated app instance as JSON from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `bench`\n\nMeasure query performance.\n\n| Option | Description |\n| ------ | ----------- |\n| `-r`, `--runs=VALUE` | The number of runs to execute; the default is 10 |\n| `-c`, `--cases=VALUE` | A JSON file containing the set of cases to run. Defaults to a standard set of cases. |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--start=VALUE` | ISO 8601 date/time to query from |\n|       `--end=VALUE` | ISO 8601 date/time to query to |\n|       `--timeout=VALUE` | The execution timeout in milliseconds |\n|       `--reporting-server=VALUE` | The address of a Seq server to send bench results to |\n|       `--reporting-apikey=VALUE` | The API key to use when connecting to the reporting server |\n|       `--description=VALUE` | Optional description of the bench test run |\n|       `--with-ingestion` | Should the benchmark include sending events to Seq |\n|       `--with-queries` | Should the benchmark include querying Seq |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `cluster health`\n\nProbe a Seq node's `/health/cluster` endpoint, and print the returned status. This command can also be used to wait on a timeout until the cluster is healthy..\n\nExample:\n\n```\nseqcli cluster health -s https://seq.example.com --wait-until-healthy\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--wait-until-healthy` | Wait until the cluster returns a status of healthy |\n|       `--timeout=VALUE` | The execution timeout in milliseconds |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `config clear`\n\nClear fields in the `SeqCli.json` file.\n\n| Option | Description |\n| ------ | ----------- |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-k`, `--key=VALUE` | The field, for example `connection.serverUrl` |\n\n### `config get`\n\nView a field from the `SeqCli.json` file.\n\n| Option | Description |\n| ------ | ----------- |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-k`, `--key=VALUE` | The field, for example `connection.serverUrl` |\n\n### `config list`\n\nView all fields in the `SeqCli.json` file.\n\n| Option | Description |\n| ------ | ----------- |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `config set`\n\nSet a field in the `SeqCli.json` file.\n\n| Option | Description |\n| ------ | ----------- |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-k`, `--key=VALUE` | The field, for example `connection.serverUrl` |\n| `-v`, `--value=VALUE` | The field value, comma-separated if multiple values are accepted |\n|       `--value-stdin` | Read the value from `STDIN` |\n\n### `dashboard list`\n\nList dashboards.\n\nExample:\n\n```\nseqcli dashboard list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the dashboard(s) to list |\n| `-i`, `--id=VALUE` | The id of a single dashboard to list |\n| `-o`, `--owner=VALUE` | The id of the user to list dashboards for; by default, shared dashboards are listed |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `dashboard remove`\n\nRemove a dashboard from the server.\n\nExample:\n\n```\nseqcli dashboard remove -i dashboard-159\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the dashboard(s) to remove |\n| `-i`, `--id=VALUE` | The id of a single dashboard to remove |\n| `-o`, `--owner=VALUE` | The id of the user to remove dashboards for; by default, shared dashboards are removed |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `dashboard render`\n\nProduce a CSV or JSON result set from a dashboard chart.\n\nExample:\n\n```\nseqcli dashboard render -i dashboard-159 -c 'Response Time (ms)' --last 7d --by 1h\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--id=VALUE` | The id of a single dashboard to render |\n| `-c`, `--chart=VALUE` | The title of a chart on the dashboard to render |\n|       `--last=VALUE` | A duration over which the chart should be rendered, e.g. `7d`; this will be aligned to an interval boundary; either `--last` or `--start` and `--end` must be specified |\n|       `--by=VALUE` | The time-slice interval for the chart data, as a duration, e.g. `1h` |\n|       `--start=VALUE` | ISO 8601 date/time to query from |\n|       `--end=VALUE` | ISO 8601 date/time to query to |\n|       `--signal=VALUE` | A signal expression or list of intersected signal ids to apply, for example `signal-1,signal-2` |\n|       `--timeout=VALUE` | The execution timeout in milliseconds |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `diagnostics ingestionlog`\n\nRetrieve the ingestion log.\n\nExample:\n\n```\nseqcli diagnostics ingestionlog\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `expressionindex create`\n\nCreate an expression index.\n\nExample:\n\n```\nseqcli expressionindex create --expression \"ServerName\"\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-e`, `--expression=VALUE` | The expression to index |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `expressionindex list`\n\nList expression indexes.\n\nExample:\n\n```\nseqcli expressionindex list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--id=VALUE` | The id of a single expression index to list |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `expressionindex remove`\n\nRemove an expression index from the server.\n\nExample:\n\n```\nseqcli expressionindex -i expressionindex-2529\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--id=VALUE` | The id of an expression index to remove |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `feed create`\n\nCreate a NuGet feed.\n\nExample:\n\n```\nseqcli feed create -n 'CI' --location=\"https://f.feedz.io/example/ci\" -u Seq --password-stdin\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | A unique name for the feed |\n| `-l`, `--location=VALUE` | The feed location; this may be a NuGet v2 or v3 feed URL, or a local filesystem path on the Seq server |\n| `-u`, `--username=VALUE` | The username Seq should supply when connecting to the feed, if authentication is required |\n| `-p`, `--password=VALUE` | A feed password, if authentication is required; note that `--password-stdin` is more secure |\n|       `--password-stdin` | Read the feed password from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `feed list`\n\nList NuGet feeds.\n\nExample:\n\n```\nseqcli feed list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The name of the feed to list |\n| `-i`, `--id=VALUE` | The id of a single feed to list |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `feed remove`\n\nRemove a NuGet feed from the server.\n\nExample:\n\n```\nseqcli feed remove -n CI\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The name of the feed to remove |\n| `-i`, `--id=VALUE` | The id of a single feed to remove |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `feed update`\n\nUpdate an existing NuGet feed.\n\nExample:\n\n```\nseqcli feed update --json '{...}'\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--json=VALUE` | The updated NuGet feed in JSON format; this can be produced using `seqcli feed list --json` |\n|       `--json-stdin` | Read the updated NuGet feed as JSON from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `forwarder install`\n\n\u003e Preview command: only available when the `--pre` command-line flag is specified. This command is supported on **Windows** platforms only.\n\nInstall the forwarder as a Windows service.\n\n| Option | Description |\n| ------ | ----------- |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-l`, `--listen=VALUE` | Set the address `seqcli forwarder` will listen at; http://127.0.0.1:15341/ is used by default. |\n| `-u`, `--username=VALUE` | The name of a Windows account to run the service under; if not specified the `NT AUTHORITY\\LocalService` account will be used |\n| `-p`, `--password=VALUE` | The password for the Windows account to run the service under |\n\n### `forwarder restart`\n\n\u003e Preview command: only available when the `--pre` command-line flag is specified. This command is supported on **Windows** platforms only.\n\nRestart the forwarder Windows service.\n\n### `forwarder run`\n\n\u003e Preview command: only available when the `--pre` command-line flag is specified.\n\nListen on an HTTP endpoint and forward ingested logs to Seq.\n\n| Option | Description |\n| ------ | ----------- |\n|       `--nologo` |  |\n| `-l`, `--listen=VALUE` | Set the address `seqcli forwarder` will listen at; http://127.0.0.1:15341/ is used by default. |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `forwarder start`\n\n\u003e Preview command: only available when the `--pre` command-line flag is specified. This command is supported on **Windows** platforms only.\n\nStart the forwarder Windows service.\n\n### `forwarder status`\n\n\u003e Preview command: only available when the `--pre` command-line flag is specified. This command is supported on **Windows** platforms only.\n\nShow the status of the forwarder Windows service.\n\n### `forwarder stop`\n\n\u003e Preview command: only available when the `--pre` command-line flag is specified. This command is supported on **Windows** platforms only.\n\nStop the forwarder Windows service.\n\n### `forwarder truncate`\n\n\u003e Preview command: only available when the `--pre` command-line flag is specified.\n\nEmpty the forwarder's persistent log buffer.\n\n| Option | Description |\n| ------ | ----------- |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-y`, `--confirm` | Answer [y]es when prompted to continue |\n\n### `forwarder uninstall`\n\n\u003e Preview command: only available when the `--pre` command-line flag is specified. This command is supported on **Windows** platforms only.\n\nUninstall the forwarder Windows service.\n\n### `help`\n\nShow information about available commands.\n\nExample:\n\n```\nseqcli help search\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--pre` | Show preview commands |\n| `-m`, `--markdown` | Generate markdown for use in documentation |\n\n### `index list`\n\nList indexes.\n\nExample:\n\n```\nseqcli index list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--id=VALUE` | The id of a single index to list |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `index suppress`\n\nSuppress an index.\n\nExample:\n\n```\nseqcli index suppress -i index-2191448f1d9b4f22bd32c6edef752748\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--id=VALUE` | The id of an index to suppress |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `ingest`\n\nSend log events from a file or `STDIN`.\n\nExample:\n\n```\nseqcli ingest -i log-*.txt --json --filter=\"@Level \u003c\u003e 'Debug'\" -p Environment=Test\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--input=VALUE` | File(s) to ingest, including the `*` wildcard; if not specified, `STDIN` will be used |\n|       `--invalid-data=VALUE` | Specify how invalid data is handled: `fail` (default) or `ignore` |\n| `-p`, `--property=NAME=VALUE` | Specify name/value properties, e.g. `-p Customer=C123 -p Environment=Production` |\n| `-x`, `--extract=VALUE` | An extraction pattern to apply to plain-text logs (ignored when `--json` is specified) |\n|       `--json` | Read the events as JSON (the default assumes plain text) |\n| `-f`, `--filter=VALUE` | Filter expression to select a subset of events |\n| `-m`, `--message=VALUE` | A message to associate with the ingested events; https://messagetemplates.org syntax is supported |\n| `-l`, `--level=VALUE` | The level or severity to associate with the ingested events; this will override any level information present in the events themselves |\n|       `--send-failure=VALUE` | Specify how connection failures are handled: `fail` (default), `retry`, `continue`, or `ignore` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--batch-size=VALUE` | The maximum number of events to send in each request to the ingestion endpoint; if not specified a value of `100` will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `license apply`\n\nApply a license to the Seq server.\n\nExample:\n\n```\nseqcli license apply --certificate=\"license.txt\"\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-c`, `--certificate=VALUE` | Certificate file; the file must be UTF-8 text |\n|       `--certificate-stdin` | Read the license certificate from `STDIN` |\n|       `--automatically-refresh` | If the license is for a subscription, periodically check `datalust.co` and automatically refresh the certificate when the subscription is changed or renewed |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `license show`\n\nShows license applied to the Seq server.\n\nExample:\n\n```\nseqcli license show\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `log`\n\nSend a structured log event to the server.\n\nExample:\n\n```\nseqcli log -m 'Hello, {Name}!' -p Name=World -p App=Test\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-m`, `--message=VALUE` | A message to associate with the event (the default is to send no message); https://messagetemplates.org syntax is supported |\n| `-l`, `--level=VALUE` | The level or severity of the event (the default is `Information`) |\n| `-t`, `--timestamp=VALUE` | The event timestamp as ISO-8601 (the current UTC timestamp will be used by default) |\n| `-x`, `--exception=VALUE` | Additional exception or error information to send, if any |\n| `-p`, `--property=NAME=VALUE` | Specify name/value properties, e.g. `-p Customer=C123 -p Environment=Production` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `node health`\n\nProbe a Seq node's `/health` endpoint, and print the returned HTTP status code, or 'Unreachable' if the endpoint could not be queried; note that no API key is required.\n\nExample:\n\n```\nseqcli node health -s https://seq-2.example.com\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--wait-until-healthy` | Wait until the node returns a status of healthy |\n|       `--timeout=VALUE` | The execution timeout in milliseconds |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `node list`\n\nList nodes in the Seq cluster.\n\nExample:\n\n```\nseqcli node list --json\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The name of the cluster node to list |\n| `-i`, `--id=VALUE` | The id of a single cluster node to list |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `print`\n\nPretty-print events in CLEF/JSON format, from a file or `STDIN`.\n\nExample:\n\n```\nseqcli print -i log-20201028.clef\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--input=VALUE` | CLEF file to read, including the `*` wildcard; if not specified, `STDIN` will be used |\n| `-f`, `--filter=VALUE` | Filter expression to select a subset of events |\n|       `--template=VALUE` | Specify an output template to control plain text formatting |\n|       `--invalid-data=VALUE` | Specify how invalid data is handled: `fail` (default) or `ignore` |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `profile create`\n\nCreate or replace a connection profile.\n\nExample:\n\n```\nseqcli profile create -n Production -s https://seq.example.com -a th15ISanAPIk3y\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The name of the connection profile |\n| `-s`, `--server=VALUE` | The URL of the Seq server |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server, if required |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `profile list`\n\nList connection profiles.\n\nExample:\n\n```\nseqcli profile list\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `profile remove`\n\nRemove a connection profile.\n\nExample:\n\n```\nseqcli profile remove -n Production\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The name of the connection profile to remove |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `query`\n\nExecute an SQL query and receive results in CSV format.\n\nExample:\n\n```\nseqcli query -q \"select count(*) from stream group by @Level\" --start=\"2018-02-28T13:00Z\"\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-q`, `--query=VALUE` | The query to execute |\n|       `--start=VALUE` | ISO 8601 date/time to query from |\n|       `--end=VALUE` | ISO 8601 date/time to query to |\n|       `--signal=VALUE` | A signal expression or list of intersected signal ids to apply, for example `signal-1,signal-2` |\n|       `--timeout=VALUE` | The execution timeout in milliseconds |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n|       `--trace` | Enable detailed (server-side) query tracing |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `retention create`\n\nCreate a retention policy.\n\nExample:\n\n```\nseqcli retention create --after 30d --delete-all-events\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--after=VALUE` | A duration after which the policy will delete events, e.g. `7d` |\n|       `--delete-all-events` | The policy should delete all events (currently the only supported option) |\n|       `--delete=VALUE` | Stream incoming events to this app instance as they're ingested; optionally accepts a signal expression limiting which events should be streamed |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `retention list`\n\nList retention policies.\n\nExample:\n\n```\nseqcli retention list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--id=VALUE` | The id of a single retention policy to list |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `retention remove`\n\nRemove a retention policy from the server.\n\nExample:\n\n```\nseqcli retention remove -i retentionpolicy-17\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--id=VALUE` | The id of a single retention policy to remove |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `retention update`\n\nUpdate an existing retention policy.\n\nExample:\n\n```\nseqcli retention update --json '{...}'\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--json=VALUE` | The updated retention policy in JSON format; this can be produced using `seqcli retention list --json` |\n|       `--json-stdin` | Read the updated retention policy as JSON from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `sample ingest`\n\nLog sample events into a Seq instance.\n\nExample:\n\n```\nseqcli sample ingest\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-y`, `--confirm` | Answer [y]es when prompted to continue |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--quiet` | Don't echo ingested events to `STDOUT` |\n|       `--setup` | Configure sample dashboards, signals, users, and so on before starting ingestion |\n|       `--simulations=VALUE` | Number of concurrent simulations to run; the default runs a single simulation |\n|       `--batch-size=VALUE` | The maximum number of events to send in each request to the ingestion endpoint; if not specified a value of `100` will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `sample setup`\n\nConfigure a Seq instance with sample dashboards, signals, users, and so on.\n\nExample:\n\n```\nseqcli sample setup\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-y`, `--confirm` | Answer [y]es when prompted to continue |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `search`\n\nRetrieve log events that match a given filter.\n\nExample:\n\n```\nseqcli search -f \"@Exception like '%TimeoutException%'\" -c 30\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-f`, `--filter=VALUE` | A filter to apply to the search, for example `Host = 'xmpweb-01.example.com'` |\n| `-c`, `--count=VALUE` | The maximum number of events to retrieve; the default is 1 |\n|       `--start=VALUE` | ISO 8601 date/time to query from |\n|       `--end=VALUE` | ISO 8601 date/time to query to |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n|       `--signal=VALUE` | A signal expression or list of intersected signal ids to apply, for example `signal-1,signal-2` |\n|       `--request-timeout=VALUE` | The time allowed for retrieving each page of events, in milliseconds; the default is 100000 |\n|       `--trace` | Enable detailed (server-side) query tracing |\n|       `--no-websockets` | Do not use WebSocket-driven streaming searches |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `setting clear`\n\nClear a runtime-configurable server setting.\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The setting name, for example `OpenIdConnectClientSecret` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `setting names`\n\nPrint the names of all supported settings.\n\n### `setting set`\n\nChange a runtime-configurable server setting.\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The setting name, for example `OpenIdConnectClientSecret` |\n| `-v`, `--value=VALUE` | The setting value, comma-separated if multiple values are accepted |\n|       `--value-stdin` | Read the value from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `setting show`\n\nPrint the current value of a runtime-configurable server setting.\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The setting name, for example `OpenIdConnectClientSecret` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `signal create`\n\nCreate a signal.\n\nExample:\n\n```\nseqcli signal create -t 'Exceptions' -f \"@Exception is not null\"\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | A title for the signal |\n|       `--description=VALUE` | A description for the signal |\n| `-f`, `--filter=VALUE` | Filter to associate with the signal |\n| `-c`, `--column=VALUE` | Column to associate with the signal; this argument can be used multiple times |\n|       `--group=VALUE` | An explicit group name to associate with the signal; the default is to infer the group from the filter |\n|       `--no-group` | Specify that no group should be inferred; the default is to infer the group from the filter |\n|       `--protected` | Specify that the signal is editable only by administrators |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `signal import`\n\nImport signals in newline-delimited JSON format.\n\nExample:\n\n```\nseqcli signal import -i ./Exceptions.json\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--merge` | Update signals that have ids matching those in the imported data; the default is to always create new signals |\n| `-i`, `--input=VALUE` | File to import; if not specified, `STDIN` will be used |\n| `-o`, `--owner=VALUE` | The id of the user to import signals for; by default, shared signals are imported |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `signal list`\n\nList available signals.\n\nExample:\n\n```\nseqcli signal list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the signal(s) to list |\n| `-i`, `--id=VALUE` | The id of a single signal to list |\n| `-o`, `--owner=VALUE` | The id of the user to list signals for; by default, shared signals are listed |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `signal remove`\n\nRemove a signal from the server.\n\nExample:\n\n```\nseqcli signal remove -t 'Test Signal'\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the signal(s) to remove |\n| `-i`, `--id=VALUE` | The id of a single signal to remove |\n| `-o`, `--owner=VALUE` | The id of the user to remove signals for; by default, shared signals are removed |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `signal update`\n\nUpdate an existing signal.\n\nExample:\n\n```\nseqcli signal update --json '{...}'\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--json=VALUE` | The updated signal in JSON format; this can be produced using `seqcli signal list --json` |\n|       `--json-stdin` | Read the updated signal as JSON from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `tail`\n\nStream log events matching a filter.\n\n| Option | Description |\n| ------ | ----------- |\n| `-f`, `--filter=VALUE` | An optional server-side filter to apply to the stream, for example `@Level = 'Error'` |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n|       `--signal=VALUE` | A signal expression or list of intersected signal ids to apply, for example `signal-1,signal-2` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `template export`\n\nExport entities into template files.\n\nExample:\n\n```\nseqcli template export -o ./Templates\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-o`, `--output=VALUE` | The directory in which to write template files; the directory must exist; any existing files with names matching the exported templates will be overwritten; the default is `.` |\n| `-i`, `--include=VALUE` | The id of a signal, dashboard, saved query, workspace, or retention policy to export; this argument may be specified multiple times; the default is to export all shared entities |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `template import`\n\nImport entities from template files.\n\nExample:\n\n```\nseqcli template import -i ./Templates\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-i`, `--input=VALUE` | The directory from which to read the set of `.template` files; the default is `.` |\n|       `--state=VALUE` | The path of a file which will persist a mapping of template names to the ids of the created entities on the target server, avoiding duplicates when multiple imports are performed; by default, `import.state` in the input directory will be used |\n|       `--merge` | For templates with no entries in the `.state` file, first check for existing entities with matching names or titles; does not support merging of retention policies |\n| `-g`, `--arg=NAME=VALUE` | Template arguments, e.g. `-g ownerId=user-314159` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `user create`\n\nCreate a user.\n\nExample:\n\n```\nseqcli user create -n alice -d 'Alice Example' -r 'User (read/write)' --password-stdin\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | A unique username for the user |\n| `-d`, `--display-name=VALUE` | A long-form name to aid in identifying the user |\n| `-f`, `--filter=VALUE` | A view filter that limits the events visible to the user |\n| `-r`, `--role=VALUE` | The title of a role that grants the user permissions on the server; if not specified, the default new user role will be assigned |\n| `-e`, `--email=VALUE` | The user's email address (enables a Gravatar image for the user) |\n| `-p`, `--password=VALUE` | An initial password for the user, if username/password authentication is in use; note that `--password-stdin` is more secure |\n|       `--password-stdin` | Read the initial password for the user from `STDIN`, if username/password authentication is in use |\n|       `--no-password-change` | Don't force the user to change their password at next login |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `user list`\n\nList users.\n\nExample:\n\n```\nseqcli user list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The username of the user(s) to list |\n| `-i`, `--id=VALUE` | The id of a single user to list |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `user remove`\n\nRemove a user from the server.\n\nExample:\n\n```\nseqcli user remove -n alice\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-n`, `--name=VALUE` | The username of the user(s) to remove |\n| `-i`, `--id=VALUE` | The id of a single user to remove |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `user update`\n\nUpdate an existing user.\n\nExample:\n\n```\nseqcli user update --json '{...}'\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--json=VALUE` | The updated user in JSON format; this can be produced using `seqcli user list --json` |\n|       `--json-stdin` | Read the updated user as JSON from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `version`\n\nPrint the current executable version.\n\n### `workspace create`\n\nCreate a workspace.\n\nExample:\n\n```\nseqcli workspace create -t 'My Workspace' -c signal-314159 -c dashboard-628318\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | A title for the workspace |\n|       `--description=VALUE` | A description for the workspace |\n| `-c`, `--content=VALUE` | The id of a dashboard, signal, or saved query to include in the workspace |\n|       `--protected` | Specify that the workspace is editable only by administrators |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `workspace list`\n\nList available workspaces.\n\nExample:\n\n```\nseqcli workspace list\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the workspace(s) to list |\n| `-i`, `--id=VALUE` | The id of a single workspace to list |\n| `-o`, `--owner=VALUE` | The id of the user to list workspaces for; by default, shared workspaces are listed |\n|       `--json` | Print output in newline-delimited JSON (the default is plain text) |\n|       `--no-color` | Don't colorize text output |\n|       `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n\n### `workspace remove`\n\nRemove a workspace from the server.\n\nExample:\n\n```\nseqcli workspace remove -t 'My Workspace'\n```\n\n| Option | Description |\n| ------ | ----------- |\n| `-t`, `--title=VALUE` | The title of the workspace(s) to remove |\n| `-i`, `--id=VALUE` | The id of a single workspace to remove |\n| `-o`, `--owner=VALUE` | The id of the user to remove workspaces for; by default, shared workspaces are removed |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n### `workspace update`\n\nUpdate an existing workspace.\n\nExample:\n\n```\nseqcli workspace update --json '{...}'\n```\n\n| Option | Description |\n| ------ | ----------- |\n|       `--json=VALUE` | The updated workspace in JSON format; this can be produced using `seqcli workspace list --json` |\n|       `--json-stdin` | Read the updated workspace as JSON from `STDIN` |\n| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |\n| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |\n|       `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |\n|       `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |\n\n## Extraction patterns\n\nThe `seqcli ingest` command can be used for parsing plain text logs into structured log events.\n\n```shell\nseqcli ingest -x \"{@t:timestamp} [{@l:level}] {@m:*}{:n}{@x:*}\"\n```\n\nThe `-x` argument above is an _extraction pattern_ that will parse events like:\n\n```\n2018-02-21 13:29:00.123 +10:00 [ERR] The operation failed\nSystem.DivideByZeroException: Attempt to divide by zero\n  at SomeClass.SomeMethod()\n```\n\n### Syntax\n\nExtraction patterns have a simple high-level syntax:\n\n * Text that appears in the pattern is matched literally - so a pattern like `Hello, world!` will match logging statements that are made up of this greeting only,\n * Text between `{curly braces}` is a _match expression_ that identifies a part of the event to be extracted, and\n * Literal curly braces are escaped by doubling, so `{{` will match the literal text `{`, and `}}` matches `}`.\n \nMatch expressions have the form:\n\n```\n{name:matcher}\n```\n\nBoth the name and matcher are optional, but either one or the other must be specified. Hence `{@t:timestamp}` specifies a name of `@t` and value `timestamp`, `{IPAddress}` specifies a name only, and `{:n}` a value only (in this case the built-in newline matcher).\n\nThe _name_ is the property name to be extracted; there are four built-in property names that get special handling:\n\n * `@t` - the event's timestamp\n * `@m` - the textual message associated with the event\n * `@l` - the event's level\n * `@x` - the exception or backtrace associated with the event\n \nOther property names are attached to the event payload, so `{Elapsed:dec}` will extract a property called `Elapsed`, using the `dec` decimal matcher.\n\nMatch expressions with no name are consumed from the input, but are not added to the event payload.\n\n### Matchers\n\nMatchers identify chunks of the input event.\n\nDifferent matchers are needed so that a piece of text like `200OK` can be separated into separate properties, i.e. `{StatusCode:nat}{Status:alpha}`. Here, the `nat` (natural number) matcher also coerces the result into a numeric value, so that it is attached to the event payload numerically as `200` instead of as the text `\"200\"`.\n\nThere are three kinds of matchers:\n\n * Matchers like `alpha` and `nat` are built-in _named_ matchers.\n * The special matchers `*`, `**` and so-on, are _non-greedy content_ matchers; these will match any text up until the next pattern element matches (`*`), the next two elements match, and so-on. We saw this in action with the `{@m:*}{:n}` elements in the example - the message is all of the text up until the next newline.\n * More complex _compound_ matchers are described using a sub-expression. These are prefixed with an equals sign `=`, like `{Phone:={:nat}-{:nat}-{:nat}}`. This will extract chunks of text like `123-456-7890` into the `Phone` property.\n\n| Matcher | Description | Example |\n|---|---|---|\n| `*`, `**`, ... | Non-greedy content | |\n| `alpha` | One or more letters | `Abc` |\n| `alphanum` | One or more letters or numbers | `a1b2` |\n| `dec` | A decimal number | `12.345` |\n| `ident` | A C-style identifier  | `countOfMatches` |\n| `int` | An integer | `-123` |\n| `iso8601dt` | An ISO-8601 date-time | `2020-01-28T13:50:01.123` |\n| `level` | A logging level name | `INF` |\n| `line` | Any single-line content | `one line!` |\n| `n` | A newline character or sequence | |\n| `nat` | A nonnegative number | `123` |\n| `s` | One or more space or tab characters | ` ` |\n| `serilogdt` | A datetime in the default Serilog file logging format | `2020-01-28 13:50:01.123 +10:00` |\n| `syslogdt` | A datetime in syslog format | `Dec  8 09:12:13` |\n| `t` | A single tab character | `\t` |\n| `timestamp` | A datetime in any recognized format | |\n| `token` | Any sequence of non-whitespace characters | `1+x$3` |\n| `trailingident` | Multiline content with indented trailing lines | |\n| `unixdt` | A datetime in Unix time format supporting seconds (10-digit) or milliseconds (12-digit) | `1608694199.999` |\n| `w3cdt` | A W3C log format date/time pair | `2019-04-02 05:18:01` |\n\n### Processing\n\nExtraction patterns are processed from left to right. When the first non-matching pattern is encountered, extraction stops; any remaining text that couldn't be matched will be attached to the resulting event in an `@unmatched` property.\n\nMulti-line events are handled by looking for lines that start with the first element of the extraction pattern to be used. This works well if the first line of each event begins with something unambiguous like an `iso8601dt` timestamp; if the lines begin with less specific syntax, the first few elements of the extraction pattern might be grouped to identify the start of events more accurately:\n\n```\n{:=[{@t} {@l}]} {@m:*}\n```\n\nHere the literal text `[`, a timestamp token, adjacent space ` `, level and closing `]` are all grouped so that they constitute a single logical pattern element to identify the start of events.\n\nWhen logs are streamed into `seqcli ingest` in real time, a 10 ms deadline is applied, within which any trailing lines that make up the event must be received.\n\n### Examples\n\n#### Tail systemd logs\n\n```shell\njournalctl -f -n 0 |\n  seqcli ingest -x \"{@t:syslogdt} {host} {ident:*}: {@m:*}{:n}\" --invalid-data=ignore\n```\n\n#### Tail `/var/log/syslog`\n\n```shell\ntail -c 0 -F /var/log/syslog |\n  seqcli ingest -x \"{@t:syslogdt} {host} {ident:*}: {@m:*}{:n}\"\n```\n\n#### Ingest an IIS/W3C web server log\n\nThis example ingests log files in the format:\n\n```shell\n#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) \ncs(Referer) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken\n```\n\nThe extraction pattern is wrapped in the example for display purposes, and must appear all in one string argument when invoked.\n\n```shell\nseqcli ingest -i http.log --invalid-data=ignore -x \"{@t:w3cdt} {ServerIP} {@m:={Method} {RequestPath}} \n{Query} {Port:nat} {Username} {ClientIP} {UserAgent} {Referer} {StatusCode:nat} {Substatus:nat} \n{Win32Status:nat} {ResponseBytes:nat} {RequestBytes:nat} {Elapsed}{:n}\"\n```\n\nA nested `{@m:=` pattern is used to collect a substring of the log line for display as the event's message.\n\n## Updating entities\n\nThe `seqcli * update` family of commands make it possible to perform arbitrary updates to many complex entity types.\n\nThe `update` commands, like `seqcli signal update` shown in the example below, receive an updated JSON representation of an\nentity via `STDIN`.\n\nThis works particularly well with tools like `jq` and modern shells with native JSON support, such as PowerShell:\n\n```\nPS \u003e $warnings = (seqcli signal list -i signal-m33302 --json | ConvertFrom-Json)\n\nPS \u003e $warnings.Title                                                                                                                \nWarnings\n\nPS \u003e $warnings.Title = \"Alarms\"\n\nPS \u003e (echo $warnings | ConvertTo-Json) | seqcli signal update --json-stdin        \n\nPS \u003e seqcli signal list -i signal-m33302 --json                                 \n{\"Title\": \"Alarms\", \"Description\": \"Automatically created\", \"Filters\": [{\"De...\n```\n\n## Store-and-forward ingestion proxy (preview)\n\nThe `seqcli forwarder` family of commands provide simple, durable ingestion buffering for occasionally-connected and\nintermittently-disconnected systems. The forwarder implements the Seq ingestion API, so applications that write\ndirectly to Seq can instead write to the forwarder, which will persist data locally until it can be sent to the\ndestination Seq server.\n\n\u003e [!NOTE]\n\u003e \n\u003e Forwarder is designed for local use in isolated environments \u0026mdash; for example, locally on a firewalled machine, or\n\u003e within a secured container network.\n\u003e \n\u003e The forwarder HTTP API does not authenticate incoming requests. By default, only the ingestion endpoint is exposed,\n\u003e but if you opt into additional APIs such as the ingestion log, ensure the API is not reachable externally. Even in the\n\u003e default configuration, be aware that clients may trigger disk space exhaustion and other issues by sending\n\u003e excessive or maliciously-crafted ingestion traffic.\n\n### Running the forwarder\n\nTo start a forwarder instance at the terminal, listening on port 5341 and forwarding to `seq.example.com`, run:\n\n```shell\nseqcli forwarder run --pre --listen http://127.0.0.1:5341 -s https://seq.example.com\n```\n\n\u003e While the `forwarder` command group is in preview, all `forwarder` commands require the `--pre` switch; you'll\n\u003e also need to supply `--pre` when requesting help, e.g. `seqcli help forwarder run --pre`.\n\nYou can test your forwarder using the `seqcli log` command:\n\n```shell\nseqcli log -m Test -s http://127.0.0.1:5341\n```\n\nIf forwarding is successful, the event will appear in the target Seq instance within a few seconds. If it isn't,\nand `seqcli log` didn't report an error, run through these troubleshooting steps:\n\n 1. Read the output of the `seqcli forwarder run` command: are the paths and URLs in there the ones you expect?\n 2. Check the destination Seq server's ingestion log; if the payload is being rejected by Seq, its likely you need to configure an API key for the forwarder's outbound connections, or API key forwarding (see below).\n 3. Check the forwarder's log file; this will be in the `SeqCli/Logs` subdirectory of the forwarder's storage path, which will be your user's home directory unless you overrode it with `--storage` or `SEQCLI_STORAGE_PATH`.\n 4. Enable the forwarder's ingestion log temporarily, ensuring this isn't accessible to untrusted callers.\n\n### The forwarder's ingestion log\n\nThe ingestion log records ingestion issues in a short in-memory buffer, so repetitive ingestion issues don't chew up\ndisk space. The ingestion log may contain fragments of event data so it's not enabled by default; you can turn it on\nwith:\n\n```shell\nSEQCLI_FORWARDER_DIAGNOSTICS_EXPOSEINGESTIONLOG=True seqcli forwarder run \u003cother args\u003e\n```\n\nThe log can be retrieved by pointing `seqcli` at the forwarder:\n\n```shell\nseqcli diagnostics ingestionlog -s http://127.0.0.1:5341\n```\n\nIf the ingestion log contains relevant entries but doesn't include enough information to track down the issue, you\ncan opt in to showing even more information with `SEQCLI_FORWARDER_DIAGNOSTICS_INGESTIONLOGSHOWDETAIL=True`.\n\n### Configuring the forwarder\n\nThe forwarder reads its configuration from the environment and the `SeqCli.json` file. Run `seqcli config` to view\nall of the supported `forwarder.*` (`SEQCLI_FORWARDER_*`) settings.\n\nLocally buffered events are stored in the `SeqCli/Buffer` subdirectory of the directory containing `SeqCli.json`. By \ndefault, this will be your user account's home folder.\n\nTo change the location of the `SeqCli.json` config file and local buffers, specify the `--storage` argument\nor set the `SEQCLI_STORAGE_PATH` environment variable when configuring and running the forwarder.\n\n### Connection authentication and API key forwarding\n\nWhen connecting to Seq, `seqcli forwarder` will ignore any API keys attached to incoming payloads, and instead use the server URL \nand API key stored in `SeqCli.json`, in the `SEQCLI_CONNECTION_*` environment variables, or passed on \nthe `forwarder run` command line.\n\nTo use the API keys from incoming payloads instead, set `forwarder.useApiKeyForwarding` or `SEQCLI_FORWARDER_USEAPIKEYFORWARDING`\nto `True`.\n\n\u003e [!WARNING]\n\u003e \n\u003e In order for durable buffering to work, `seqcli forwarder` needs to store the incoming API keys in its local buffer\n\u003e storage.\n\u003e \n\u003e On Windows, these will be encrypted using machine-scoped DPAPI by default, and on other platforms they'll be saved\n\u003e as plain text. To perform encryption of stored API keys, supply shell scripts in the `encryption.encryptor` and\n\u003e `encryption.decryptor` (`SEQCLI_ENCRYPTION_ENCRYPTOR` and `SEQCLI_ENCRYPTION_DECRYPTOR`) configuration entries. The scripts\n\u003e will need to process data on `STDIN` and `STDOUT`: you can verify their effects by examining the `api.key` files stored\n\u003e in subdirectories of `SeqCli/Buffer`.\n\n### Windows service installation\n\nOn Windows it's possible to install the forwarder as a service, using the `seqcli forwarder install` command. Pass\na directory to make readable by the service in the `--storage` argument when installing the it. Make sure this directory\nis also passed in `--storage` when configuring the forwarder.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatalust%2Fseqcli","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdatalust%2Fseqcli","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatalust%2Fseqcli/lists"}