Nearly a year in the making, Seq 2023.1 is faster, plays better with container hosts, and scales up like no Seq version before. Get the Windows MSI at 👉 datalust.co/download, or pull datalust/seq:latest from Docker Hub.In 2023, structured logs remain the richest, most flexible, and best-supported foundation for application diagnostics. At Datalust we're obsessed with building the world's most efficient system for diagnosing production issues using structured logs.
Available today, Seq 2023.1 introduces a brand new query engine, built in Rust, that parallelizes work efficiently across large numbers of cores, makes better use of signal indexes to accelerate queries, and works in harmony with the host operating system to manage memory safely in containerized environments.
Read on for some release highlights! If you're keen to skip to upgrade instructions, you'll find them at the bottom of this post.
🔥 Extreme sparse index performance
Here's Seq 2023.1 blasting Seq 2022.1 out of the water, searching for "test" in the sparse "Warnings" signal:
im4gn.4xlarge instance type, 16 cores, 64 GB RAM.2023.1 completes the full search in 0.8 seconds, while the earlier version takes 2 minutes, 20 seconds. How is such a staggering gain possible?
The original Seq storage architecture uses signal indexes for disk-backed searches, but has to use brute-force to search the "recent" data in its RAM cache. This is because the index information is page-based and doesn't correspond to the cache's in-memory representation.
In Seq 2023.1, the storage architecture is unified. Because "Warnings" is a sparse signal (matches a small proportion of the event stream), the new version can employ the index to process the entire query using a fraction of the CPU time and minimal I/O.
While the impact of this change is dependent upon the density of the index and other factors, practically all searches within signal indexes will see some benefits from upgrading.
🤹♀️ Smooth multicore scaling
Sometimes there is no alternative but to crunch a large amount of data, and Seq 2023.1 does it more efficiently by translating searches and queries into dataflow-based query plans. Careful partitioning and optimization enables nodes in the resulting dataflow graph to use large numbers of CPU cores with minimal coordination overhead.
Worst-case performance, where the entire log stream must be processed in order to return a query result outside of an index, now dramatically improves as host resources are scaled up:
select max(Elapsed) from stream where @EventType = 0x94002ebf, 100 GB data set, AWS Graviton im4gn instance family.Seq previously used between 1 and 4 cores to process each search or query; the new engine utilizes as many cores as the host can provide, as long as the disk and page cache can supply data. At the largest instance size shown on the chart, 2023.1 crunches through 100 GB raw data in 13 seconds.
In combination with Seq 2023.1's reduced heap usage, which avoids long GC pauses at larger RAM sizes, it's now much easier to scale up when you need more performance.
⚓ Easier management in Docker and K8s
Our experience supporting Seq in Docker and Kubernetes has impressed on us just how delicate the interplay between the container host and the containerized application needs to be for optimal performance and stability.
Seq 2023.1 bakes in everything we've learned over five years of running Seq under Docker:
- Seq no longer needs the host to provide accurate memory limit information in order to function reliably,
- Seq now uses memory mapped pages for caching, so the host operating system can fully manage memory pressure and Seq can avoid the dreaded OOM killer, and
- Minimizing long-lived data on the .NET heap means Seq avoids CPU-sapping GC activity when running close to full memory utilization.
Even if you're enjoying smooth sailing under Docker or K8s today, we expect these changes to improve hardware utilization and help you get more bang for your infrastructure buck.
✅ More improvements
You can find the full 2023.1 release notes on GitHub. Seq 2023.1 is a deep foundational release, with improvements like a stricter content security policy for the Seq web UI, fully cross-platform backup and restore, and much more behind-the-scenes work to make your everyday experience with Seq more enjoyable.
🚀 Upgrading
Seq 2023.1 is an easy in-place upgrade from earlier versions in the 202x series. Most users should simply download and run the Windows MSI from 👉 datalust.co/download, or pull the datalust/seq:latest tag from Docker Hub.
We've taken the opportunity to shrink Seq's dependency footprint and retire some very old code, so upgrades from Seq 5.x and earlier must go via 2022.1.7929, which you can find in past releases or using the 2022.1 Docker image tag.If you're running a carefully-tuned Seq instance and would like our help to make sure allocated CPU, RAM, and I/O resources are optimal for Seq 2023.1, please reach out. To maximize performance, Seq 2023.1 uses available resources more aggressively, which may be important if your current infrastructure is shared between applications or is operating near capacity.
The care, time, and effort that we've put into Seq 2023.1 means we want you to have a great experience upgrading and using the new version. If you need help at any point in the process, please get in touch through support@datalust.co.
Enjoy!