Seq 2024.2 released 🎉

TL;DR: for the latest UX and performance improvements, pull datalust/seq:latest from Docker Hub, or grab the MSI from datalust.co/download.

Seq 2024.2 is ready to go! Few releases come together as smoothly as this one has. We allocated some time after the major tracing-related changes in 2024.1 to incorporate feedback, and to work on polish and performance.

First, the new trace view has been significantly refined. If you're using Seq to capture distributed, hierarchical trace data from OpenTelemetry or SerilogTracing, you'll appreciate the quality-of-life improvements here.

Next, searches that restrict on @EventType are dramatically faster in Seq 2024.1. Event types allow related logs and spans to be efficiently retrieved, and Seq now automatically applies a high-cardinality index to this field.

Read on to learn about these and other improvements landing in this release.

Powered-up trace view

Shown in the screenshot above, Seq's hierarchical trace view now:

• Shows markers corresponding to any events in the active search results that carry the id of any span in the trace
• Renders span names using the same "syntax highlighted" style that Seq uses for messages in the events view
• Automatically finds and expands the event view of a span when the span is clicked and Find just this is chosen, making it easier to access span properties
• Provides search-by-span-type, by clicking on a span and choosing Find this type
• Shows an arrow glyph next to span names when that span is a Client or Producer, revealing where execution leaves a system, and making it easier to distinguish between client and server spans when these appear as parent/child pairs
• Displays the color of a span in a narrow strip next to the service name, making it easier to visually match the hierarchical information on the left, with the timing bars of the same color on the right

Event type indexing

There are two broad benefits that come with structured logging. The first is that events can be filtered or analyzed based on their properties without fragile log parsing.

The second benefit is more subtle, and easily overlooked, but is actually every bit as powerful as the first: events have well-defined types that identify them, independently of the property values they're parameterized with.

If you write an event to Seq using a message template:

log.Information("Quota {Quota} MB exceeded by {Username}", 150, "nblumhardt");

Then the Quota and Username values are captured as properties.

The string "Quota {Quota} MB exceeded by {Username}" is also captured, both in the @MessageTemplate event property, and in @EventType, which Seq computes using a MurmurHash3 hash of the template string.

Event types are powerful because they provide a succinct and accurate way to identify all "quota exceeded" events, or events matching any other template, like this:

Without message templates and their derived event types, a filter resembling @Message like 'Quota % MB exceeded by %' is the best we can do, and these are things are hard to write accurately when the original message format isn't obvious or distinct enough to reverse engineer from a message.

Seq has always made it easy to filter and exclude events from a search based on @EventType. Seq 2024.2 makes it fast: searches that restrict on @EventType will often yield a page of results in under a second, irrespective of the volume of data being searched.

Behind the scenes, Seq uses the same new, lightweight hash index implementation for event type indexing as it does for trace ids. (We'll be opening this up to support user-defined high-cardinality indexes in 2024.3!)

Event types are everywhere, so we hope you'll see some surprising and welcome performance improvements in your existing dashboards and searches, once your upgraded Seq instance has had some time to build indexes.

Easily switch between flattened and nested object views

Seq 2024.1 defaults to flattening out the keys of nested objects in the event properties view. We've had a lot of feedback about this and we're still working to achieve a "best of both worlds" option that suits all types of data.

Although it's possible to globally turn this off in your user preferences, it's also now possible to simply collapse a large object by clicking on one of its flattened keys:

One fewer click to adjust custom date ranges

Another feedback-driven change is in the date selector that was introduced in Seq 2023.4. While the new control makes it much easier to select relative time ranges (last day, last week, etc.), it introduced an extra click when choosing a "custom" date range with start and end dates.

Today's release gets rid of that extra click: once you've set a start and end date, clicking on the selector again will jump straight back to the custom range picker, so that you can easily tweak the start and end times to refine your search:

Clicking "reset" will take you back to the default, relative range selection behavior.

Upgrading

There's quite a bit more to the release than we've listed here: you can find the full release notes in the GitHub milestone.

Seq 2024.2 is a highly-compatible in-place update. Most users should simply pull the datalust/seq:latest tag and restart, or click through the Windows installer and post-install setup wizard.

If you've scripted your Seq setup to configure Azure Active Directory authentication (such as automatically refreshing client secrets), you should check this ticket for information about setting name changes related to renaming of Azure Active Directory to Microsoft Entra ID.

If you run into any difficulties, please reach out to support@datalust.co.

We hope you enjoy the new version, and we'd love to hear how you go!