datalust / seq-app-jsonarchive

Record events to a set of newline-delimited JSON streams

Seq JSON Archive App

Record events from Seq to a set of newline-delimited JSON files. The format is lossless, preserving all of the event's properties along with its internal Seq-generated event id and type.

Installing the app

Instructions for installation can be found in the Seq documentation.

The package id of this package is Seq.App.JsonArchive.

Reading archived events

Events in the newline-delimited JSON files can be imported into Seq using seqcli ingest --json -i <glob>.

Along with regular JSON parsers, the JSON-formatted events written into the archive files can be transformed into Serilog events using Serilog.Formatting.Compact.Reader.

seq-app-jsonarchive's Issues

Encode UTC dates/times in place of Unix timestamps in filenames

The JSON archive files produced by this app are currently numbered using their creation time in seconds-since-epoch:

This makes it awkward to home in on a set of files likely to contain a particular event timestamp range by eye.

The current timestamp format was chosen because the colon : that appears in ISO-8601 date/time formatting is not allowed in filenames on Windows. This ticket proposes that we introduce a new formatting option "Format filenames with human-readable dates/times", which would produce filenames using ISO-8601 full formatting, but without :, resembling:

logs-2022-04-30T075301Z.json

(Changing the default formatting will be likely to break existing log shipping schemes, hence this isn't proposed as a new default.)