Seq supports two distinct syntaxes for working with events. The C#-inspired filter syntax used for searching:
Application == "Patient Portal" && StartsWith(Environment, "Test-")
And the SQL dialect for computing aggregate results:
select count(*)
from stream
where Application = 'Patient Portal' and Environment like 'Test-%'
group by time(1d)
Although the Application and Environment expressions in both of these examples are exactly equivalent, how to convert from one syntax to the other is not always obvious (in the case of selection by event type), and sometimes requires trial-and-error.
Seq 3.3, now available as a pre-release download, addresses this by accepting SQL expressions as search filters.
You can see this in action in the screenshot below, along with the improved filter box that's part of an overall better query editing experience coming in Seq 3.3.
All of the current C#-style syntax continues to work, but filtering shortcuts like the "green tick" Find and Find on this event type will now generate SQL expressions so that it's trivial to add the select boilerplate and compute a SQL result set, without changing double- to single-quotes, == to =, && to and, and so-forth.
If you're familiar with the C#-style filtering syntax, you'll need to keep in mind that string equality = and <> comparisons in SQL are case-sensitive; Seq provides like and not like as case-insensitive equivalents.
With a few more features planned, we're expecting a final build of Seq 3.3 to be available in late September. We'd love to hear your feedback on the changes in the preview build.
Happy logging!