### Install SeqCLI Forwarder

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Installs the forwarder as a Windows service. This is a preview command and requires the `--pre` flag. It is only supported on Windows platforms.

```bash
seqcli forwarder install --storage=VALUE --listen=VALUE --username=VALUE --password=VALUE
```

--------------------------------

### Install an App Package

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Install an app package to your Seq server. You can specify the package ID, version, and the NuGet feed to use.

```bash
seqcli app install --package-id 'Seq.App.JsonArchive'
```

--------------------------------

### Install seqcli as a Global Tool

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Installs the seqcli command-line tool globally using the .NET CLI. Requires dotnet to be installed.

```bash
dotnet tool install --global seqcli
```

--------------------------------

### Setup Sample Data and Configurations

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Configures a Seq instance with sample dashboards, signals, and users. Use the `--confirm` flag to bypass prompts if needed.

```bash
seqcli sample setup
```

--------------------------------

### Example Template Syntax

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Templates/README.md

Demonstrates the basic syntax for a SeqCli template, including the use of the `ref()` function to import another template.

```json
{
    "Title": "Web",
    "SignalId": ref("signal-HTTP Requests.json")
}
```

--------------------------------

### Show usage for a specific seqcli command

Source: https://github.com/datalust/seqcli/blob/dev/README.md

To get detailed usage information for a particular command, append the command name to `seqcli help`. For example, to see help for the `apikey create` command.

```bash
seqcli help apikey create
```

--------------------------------

### Start SeqCLI Forwarder Service

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Starts the forwarder Windows service. This is a preview command and requires the `--pre` flag. It is only supported on Windows platforms.

```bash
seqcli forwarder start
```

--------------------------------

### Run SeqCLI Forwarder Instance

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Start a forwarder instance to buffer ingestion locally and forward to a Seq server. Requires the --pre switch for preview versions.

```shell
seqcli forwarder run --pre --listen http://127.0.0.1:5341 -s https://seq.example.com
```

--------------------------------

### Create a new app instance

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to create a new instance of an installed application on Seq. You can specify the instance title, the app ID, and various properties for the app instance.

```bash
seqcli appinstance create -t 'Email Ops' --app hostedapp-314159 -p To=ops@example.com
```

--------------------------------

### List existing app instances

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This command lists all installed app instances on Seq. You can filter the list by title or ID, and control the output format.

```bash
seqcli appinstance list
```

--------------------------------

### Get SeqCLI Help Information

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Shows information about available commands. Use the `--pre` flag to show preview commands and `--markdown` to generate markdown output.

```bash
seqcli help search
```

--------------------------------

### List Installed App Packages

Source: https://github.com/datalust/seqcli/blob/dev/README.md

List the app packages currently installed on your Seq server. You can filter by package ID or a specific app ID.

```bash
seqcli app list
```

--------------------------------

### SeqCLI multi-line event processing example

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Illustrates how SeqCLI handles multi-line events by grouping elements to identify the start of an event. This pattern uses literal characters, a timestamp, space, level, and closing bracket to define the event start.

```text
{:=[{@t} {@l}]} {@m:*}
```

--------------------------------

### Extraction pattern syntax example

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Demonstrates the basic syntax for extraction patterns, including literal text and match expressions enclosed in curly braces.

```plaintext
{name:matcher}
```

--------------------------------

### Create Retention Policy with SeqCLI

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use the `retention create` command to establish a new retention policy. This example creates a policy that deletes all events after 30 days.

```bash
seqcli retention create --after 30d --delete-all-events
```

--------------------------------

### Update an Installed SeqApp

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Update an installed SeqApp by its name. By default, it updates to the latest version.

```bash
seqcli app update -n 'HTML Email'
```

--------------------------------

### Example log line for extraction pattern

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This is an example of a log line that can be parsed by the extraction pattern `{@t:timestamp} [{@l:level}] {@m:*}{:n}{@x:*}`.

```text
2018-02-21 13:29:00.123 +10:00 [ERR] The operation failed
System.DivideByZeroException: Attempt to divide by zero
  at SomeClass.SomeMethod()
```

--------------------------------

### Ingest IIS/W3C web server log with SeqCLI

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This example demonstrates ingesting an IIS/W3C web server log file into Seq. It uses a comprehensive extraction pattern to parse various fields including date, time, IP addresses, HTTP method, URI, status codes, and more. A nested pattern is used to capture the message.

```shell
seqcli ingest -i http.log --invalid-data=ignore -x "{@t:w3cdt} {ServerIP} {@m:={Method} {RequestPath}} 
{Query} {Port:nat} {Username} {ClientIP} {UserAgent} {Referer} {StatusCode:nat} {Substatus:nat} 
{Win32Status:nat} {ResponseBytes:nat} {RequestBytes:nat} {Elapsed}{:n}"
```

--------------------------------

### Execute SQL Query with SeqCLI

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use the `query` command to execute an SQL query against Seq and receive results in CSV format. Specify the query and optionally a start time.

```bash
seqcli query -q "select count(*) from stream group by @Level" --start="2018-02-28T13:00Z"
```

--------------------------------

### Get a specific field from SeqCLI.json

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Retrieves the value of a specified field from the SeqCli.json configuration file. Use the -k option to identify the field.

```bash
seqcli config get -k connection.serverUrl
```

--------------------------------

### Get SeqCLI Forwarder Status

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Shows the status of the forwarder Windows service. This is a preview command and requires the `--pre` flag. It is only supported on Windows platforms.

```bash
seqcli forwarder status
```

--------------------------------

### Reconstruct Trace in Execution Order

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Selects trace spans ordered by their start time to reconstruct a trace. Use this to view the sequence of events within a trace.

```seq
select
   @SpanId as span_id,
   @ParentId as parent_id,
   @Resource.service.name as service,
   @Message as span_name,
   @SpanKind as kind,
   @Start as start,                    -- raw ticks — order by THIS column
   ToIsoString(@Start) as start_iso,   -- readable copy, for display only
   TotalMilliseconds(@Elapsed) as ms
from stream
where @TraceId = '0af7651916cd43dd8448eb211c80319c' and Has(@Start)
order by start asc
limit 1000 -- traces can be large; if the result looks truncated, raise this

```

--------------------------------

### SeqCLI compound matcher example

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Demonstrates a compound matcher in SeqCLI for extracting phone numbers. The pattern uses nested numeric matchers to parse a string like '123-456-7890'.

```text
{Phone:={:nat}-{:nat}-{:nat}}
```

--------------------------------

### List All Supported Server Setting Names

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Prints the names of all settings that can be configured at runtime. Use this to discover available settings.

```bash
seqcli setting names
```

--------------------------------

### Run a SeqApp Plugin

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Host a .NET SeqApp plug-in by specifying the directory containing assemblies and optional app properties.

```bash
seqcli tail --json | seqcli app run -d "./bin/Debug/netstandard2.2" -p ToAddress=example@example.com
```

--------------------------------

### Apply Seq License from File

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Apply a license to the Seq server by providing the certificate file path. The certificate file must be UTF-8 encoded text.

```bash
seqcli license apply --certificate="license.txt"
```

--------------------------------

### Create a workspace with content

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Creates a new workspace and includes specified signals and dashboards.

```bash
seqcli workspace create -t 'My Workspace' -c signal-314159 -c dashboard-628318
```

--------------------------------

### Match all spans

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Filters events to include only spans, excluding log events. This is achieved by checking for the presence of the `@Start` field, which is specific to spans.

```seq
Has(@Start)
```

--------------------------------

### Basic seqcli Command Structure

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Illustrates the fundamental syntax for executing any seqcli command. Replace <command> with the desired operation and [<args>] with its arguments.

```bash
seqcli <command> [<args>]
```

--------------------------------

### List all fields in SeqCLI.json

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Displays all configured fields within the SeqCli.json file.

```bash
seqcli config list
```

--------------------------------

### Case-insensitive prefix search for event level

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Performs a case-insensitive search for events where the `@Level` field starts with 'err'. Useful for quickly finding error-level events.

```seq
@Level like 'err%' ci
```

--------------------------------

### Show all seqcli commands

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Run this command to view the complete list of supported commands in seqcli.

```bash
seqcli help
```

--------------------------------

### List all workspaces

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Lists all available workspaces on the Seq server.

```bash
seqcli workspace list
```

--------------------------------

### List Seq Connection Profiles

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Lists all configured connection profiles.

```bash
seqcli profile list
```

--------------------------------

### Ingest Sample Events

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Logs sample events into a Seq instance. Use the `--confirm` flag to bypass prompts if needed.

```bash
seqcli sample ingest
```

--------------------------------

### Create a New User

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to create a new user on the Seq server. It supports setting display names, roles, and securely reading passwords from stdin.

```bash
seqcli user create -n alice -d 'Alice Example' -r 'User (read/write)' --password-stdin
```

--------------------------------

### Show Server Setting Value

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Displays the current value of a specified runtime-configurable server setting. Use this to check the current configuration of a setting.

```bash
seqcli setting show -n "OpenIdConnectClientSecret"
```

--------------------------------

### Create a NuGet Feed

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to create a new NuGet feed. Specify the feed name, location, and authentication details. The password can be provided via stdin for enhanced security.

```bash
seqcli feed create -n 'CI' --location="https://f.feedz.io/example/ci" -u Seq --password-stdin
```

--------------------------------

### Retrieve a specific trace span

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Constructs a search expression to pinpoint a specific trace span by its Trace ID, Span ID, and the presence of a start time. This is useful for detailed trace analysis.

```seq
@TraceId = '...' and @SpanId = '...' and Has(@Start)
```

--------------------------------

### Import Entities from Template Files

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to import entities defined in template files. Specify the input directory containing the .template files.

```bash
seqcli template import -i ./Templates
```

--------------------------------

### Generate App Definition

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Generate an app definition for a .NET [SeqApp] plug-in. Specify the directory containing the assemblies.

```bash
seqcli app define -d "./bin/Debug/netstandard2.2"
```

--------------------------------

### Create Seq Connection Profile

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Creates or replaces a connection profile with a given name, server URL, and API key.

```bash
seqcli profile create -n Production -s https://seq.example.com -a th15ISanAPIk3y
```

--------------------------------

### Run SeqCLI Forwarder

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Listens on an HTTP endpoint and forwards ingested logs to Seq. This is a preview command and requires the `--pre` flag.

```bash
seqcli forwarder run --nologo --listen=VALUE --server=VALUE --apikey=VALUE --profile=VALUE --storage=VALUE
```

--------------------------------

### Create an API Key

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to generate a new API key for automation or ingestion. You can specify a title and properties for the key.

```bash
seqcli apikey create -t 'Test API Key' -p Environment=Test
```

--------------------------------

### List Available API Keys

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This command lists all available API keys. You can filter the list by title or ID.

```bash
seqcli apikey list
```

--------------------------------

### List NuGet Feeds

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This command lists all configured NuGet feeds. Options are available to filter by name or ID, and to output in JSON format.

```bash
seqcli feed list
```

--------------------------------

### Run EndToEnd Tests with Docker Seq Server and License from Stdin

Source: https://github.com/datalust/seqcli/blob/dev/CONTRIBUTING.md

This shell command runs the EndToEnd integration tests, including multi-user tests, by providing a Seq license via standard input to a Docker Seq server. Ensure 'license.txt' contains a valid license.

```shell
/SeqCli.EndToEnd$ cat license.txt | dotnet run -- --docker-server --license-certificate-stdin
```

--------------------------------

### Run XUnit Tests for SeqCli.Tests

Source: https://github.com/datalust/seqcli/blob/dev/CONTRIBUTING.md

This shell command executes the standard xUnit tests for the SeqCli.Tests project. This is used for unit and integration testing of the SeqCLI itself.

```shell
/SeqCli.Tests$ dotnet test
```

--------------------------------

### Show Seq License

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Displays the license applied to the Seq server. Supports server and API key configuration.

```bash
seqcli license show
```

--------------------------------

### List Users on Seq Server

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to list users on the Seq server. You can filter by name or ID, and choose the output format.

```bash
seqcli user list
```

--------------------------------

### Set a Server Setting

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Changes a runtime-configurable server setting to a new value. This command allows direct modification of server configurations.

```bash
seqcli setting set -n "OpenIdConnectClientSecret" -v "some-secret-value"
```

--------------------------------

### List Retention Policies with SeqCLI

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use the `retention list` command to view existing retention policies. This command retrieves all configured policies.

```bash
seqcli retention list
```

--------------------------------

### Create a SeqCLI Expression Index

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Create a new expression index on the Seq server. Specify the expression to index and optionally configure server connection details and output format.

```bash
seqcli expressionindex create --expression "ServerName"
```

--------------------------------

### Execute SeqCLI Command and Assert Output

Source: https://github.com/datalust/seqcli/blob/dev/CONTRIBUTING.md

This C# snippet demonstrates how to execute a seqcli command and assert its exit code and output. It's typically used within the EndToEnd test project.

```csharp
var exit = runner.Exec("apikey list", "-t Test --json --no-color");
Assert.Equal(0, exit);

var output = runner.LastRunProcess!.Output;
Assert.Contains("\"AssignedPermissions\": [\"Ingest\"]", output);
```

--------------------------------

### Update an existing app instance

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This command updates an existing app instance with new JSON configuration. The JSON can be provided directly or read from standard input.

```bash
seqcli appinstance update --json '{...}'
```

--------------------------------

### Create API Key with PowerShell

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Creates a new API key for seqcli using PowerShell. It prompts for the password via stdin and specifies permissions. The new token is captured in a variable.

```powershell
$user = "admin"
$pw = "thepassword"
$token = (
  echo $pw |
  seqcli apikey create \
    -t CLI \
    --permissions="Read,Write,Project,Organization,System" \
    --connect-username $user --connect-password-stdin
)
```

--------------------------------

### Run EndToEnd Tests with Docker Seq Server

Source: https://github.com/datalust/seqcli/blob/dev/CONTRIBUTING.md

This shell command executes the EndToEnd integration tests using a Docker container for the Seq server. This is the recommended way to run tests if a local Seq executable is not available.

```shell
/SeqCli.EndToEnd$ dotnet run -- --docker-server
```

--------------------------------

### List sub-commands for a seqcli command group

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This command lists all available sub-commands within a specific command group, such as `apikey`. This is useful for understanding the full scope of a command group's functionality.

```bash
seqcli help apikey
```

--------------------------------

### Test Forwarder with SeqCLI Log

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Send a test message to the forwarder to verify its operation. The message should appear in the target Seq instance if forwarding is successful.

```shell
seqcli log -m Test -s http://127.0.0.1:5341
```

--------------------------------

### Configure Default Seq Server URL

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Sets the default Seq server URL in the seqcli configuration file. This avoids needing to specify the server with each command.

```bash
seqcli config set -k connection.serverUrl -v https://your-seq-server
```

--------------------------------

### Configure Default Seq API Key

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Sets the default API key for connecting to the Seq server in the seqcli configuration file. This key is used for authentication.

```bash
seqcli config set -k connection.apiKey -v your-api-key
```

--------------------------------

### Run seqcli using Docker

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Executes a seqcli command within a Docker container. The container is removed after execution. Replace <command> [<args>] with the desired seqcli command.

```bash
docker run --rm datalust/seqcli:latest <command> [<args>]
```

--------------------------------

### List SeqCLI Indexes

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Lists available indexes. Use `--json` for newline-delimited JSON output, `--no-color` to disable colorization, or `--force-color` to enable it.

```bash
seqcli index list --id=VALUE --json --no-color --force-color --storage=VALUE --server=VALUE --apikey=VALUE --profile=VALUE
```

--------------------------------

### Enable Forwarder Ingestion Log

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Configure the forwarder to expose its ingestion log for diagnostics. This setting should only be enabled temporarily and not be accessible externally.

```shell
SEQCLI_FORWARDER_DIAGNOSTICS_EXPOSEINGESTIONLOG=True seqcli forwarder run <other args>
```

--------------------------------

### Import signals from a JSON file

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Import signals defined in a newline-delimited JSON file. This is useful for migrating or backing up signal configurations. The `--merge` option can be used to update existing signals.

```bash
seqcli signal import -i ./Exceptions.json
```

--------------------------------

### Run Specific EndToEnd Tests by Regex

Source: https://github.com/datalust/seqcli/blob/dev/CONTRIBUTING.md

This shell command executes a subset of EndToEnd integration tests that match the provided regular expressions. This is useful for targeting specific tests during development.

```shell
/SeqCli.EndToEnd$ dotnet run -- --docker-server *TestCase.cs Command*
```

--------------------------------

### Update a user with JSON

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Updates an existing user by providing their updated details in JSON format.

```bash
seqcli user update --json '{...}'
```

--------------------------------

### Export Templates to Directory

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Export Seq entities such as signals, dashboards, or saved queries into template files. Specify the output directory where the template files will be written.

```bash
seqcli template export -o ./Templates
```

--------------------------------

### Update a workspace using JSON

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This command updates an existing workspace by providing its new configuration in JSON format. The JSON can be generated using `seqcli workspace list --json`.

```bash
seqcli workspace update --json '{...}'
```

--------------------------------

### Set Server Setting from Stdin

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Changes a runtime-configurable server setting by reading the value from standard input. This is useful for setting values that are sensitive or complex.

```bash
seqcli setting set --value-stdin -n "OpenIdConnectClientSecret"
```

--------------------------------

### Tail /var/log/syslog with SeqCLI

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This command tails the `/var/log/syslog` file in real-time and ingests its content into Seq. It employs an extraction pattern to parse syslog timestamps, host, identifier, and the message.

```shell
tail -c 0 -F /var/log/syslog | \
  seqcli ingest -x "{@t:syslogdt} {host} {ident:*}: {@m:*}{:n}"
```

--------------------------------

### Seq CLI Base Grammar: Durations and Regular Expressions

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Defines the syntax for specifying durations with various time units and for regular expressions.

```ebnf
duration = { natural , time_unit }- ;
time_unit = 'd' | 'h' | 'ms' | 'm' | 'us' | 'μs' | 'ns' | 's' ;
regular_expression = '/' , { regex_char } , '/' ;
regex_char = '\/' | ? any character except '/' ? ;
```

--------------------------------

### Abstract HttpServer Class Definition

Source: https://github.com/datalust/seqcli/blob/dev/src/Roastery/README.md

Defines the base structure for HTTP server components in the simulation. It includes a method to invoke asynchronous HTTP requests and return responses.

```csharp
abstract class HttpServer
{
    public abstract Task<HttpResponse> InvokeAsync(HttpRequest request);
}
```

--------------------------------

### List Dashboards with SeqCli

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Lists all available dashboards. Supports filtering by title, ID, or owner. Output can be plain text or JSON.

```bash
seqcli dashboard list
```

--------------------------------

### Restart SeqCLI Forwarder Service

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Restarts the forwarder Windows service. This is a preview command and requires the `--pre` flag. It is only supported on Windows platforms.

```bash
seqcli forwarder restart
```

--------------------------------

### Set a field in SeqCLI.json from STDIN

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Sets a field in the SeqCli.json configuration file by reading the value from standard input. Use -k to specify the field.

```bash
seqcli config set --key connection.serverUrl --value-stdin
```

--------------------------------

### Uninstall SeqCLI Forwarder Service

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Uninstalls the forwarder Windows service. This is a preview command and requires the `--pre` flag. It is only supported on Windows platforms.

```bash
seqcli forwarder uninstall
```

--------------------------------

### Seq CLI Base Grammar: Literals and Numbers

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Defines the syntax for string literals, numbers (including hexadecimal), and natural numbers.

```ebnf
string_literal = "'" , { string_char } , "'" ;
string_char = "''" | ? any character except single quote ? ;
number = natural , [ '.' , natural ] ;
hex_number = '0x' , hex_digit , { hex_digit } ;
natural = digit , { digit } ;
hex_digit = digit | 'a' | 'b' | 'c' | 'd' | 'e' | 'f'
   | 'A' | 'B' | 'C' | 'D' | 'E' | 'F' ;
```

--------------------------------

### Retrieve SeqCLI Ingestion Log

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to retrieve the ingestion log from the Seq server. Options for server URL, API key, and storage path are available.

```bash
seqcli diagnostics ingestionlog
```

--------------------------------

### Clear a Server Setting

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Clears a runtime-configurable server setting by its name. This is useful for resetting settings to their default values.

```bash
seqcli setting clear -n "OpenIdConnectClientSecret"
```

--------------------------------

### List SeqCLI Expression Indexes

Source: https://github.com/datalust/seqcli/blob/dev/README.md

List existing expression indexes on the Seq server. You can filter by ID or specify output format and connection details.

```bash
seqcli expressionindex list
```

--------------------------------

### Retrieve Forwarder Ingestion Log

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Fetch the ingestion log from a running forwarder instance to diagnose ingestion issues. Ensure the forwarder is accessible.

```shell
seqcli diagnostics ingestionlog -s http://127.0.0.1:5341
```

--------------------------------

### List Seq Cluster Nodes

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Lists nodes in the Seq cluster. Use the `--json` flag for newline-delimited JSON output.

```bash
seqcli node list --json
```

--------------------------------

### Tail systemd logs with SeqCLI

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This command tails systemd journal logs in real-time and ingests them into Seq. It uses a specific extraction pattern to parse timestamps, host, identifier, and the message content.

```shell
journalctl -f -n 0 | \
  seqcli ingest -x "{@t:syslogdt} {host} {ident:*}: {@m:*}{:n}" --invalid-data=ignore
```

--------------------------------

### Remove an app instance

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to remove an app instance from Seq. You can identify the instance to remove by its title or ID.

```bash
seqcli appinstance remove -t 'Email Ops'
```

--------------------------------

### List available signals

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Retrieve a list of all available signals. You can filter the list by title or ID, or specify an owner. The output can be plain text or JSON.

```bash
seqcli signal list
```

--------------------------------

### Create a new signal

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to create a new signal. Specify a title and a filter expression. The filter determines which events the signal will capture.

```bash
seqcli signal create -t 'Exceptions' -f "@Exception is not null"
```

--------------------------------

### Stop SeqCLI Forwarder Service

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Stops the forwarder Windows service. This is a preview command and requires the `--pre` flag. It is only supported on Windows platforms.

```bash
seqcli forwarder stop
```

--------------------------------

### Update a NuGet Feed

Source: https://github.com/datalust/seqcli/blob/dev/README.md

This command updates an existing NuGet feed. The updated feed details are provided as a JSON object, either directly via the --json option or from stdin using --json-stdin.

```bash
seqcli feed update --json '{...}'
```

--------------------------------

### Update a Signal with JSON

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Update an existing signal by providing its new configuration in JSON format. The JSON can be obtained using `seqcli signal list --json`.

```bash
seqcli signal update --json '{...}'
```

--------------------------------

### Render Dashboard Chart Data with SeqCli

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Renders chart data from a specified dashboard and chart into CSV or JSON format. Supports time range filtering and interval slicing.

```bash
seqcli dashboard render -i dashboard-159 -c 'Response Time (ms)' --last 7d --by 1h
```

--------------------------------

### Seq CLI Aggregate Function: top()

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Selects the first 'n' values of an expression. Cannot be used with other aggregate functions.

```seq-query
top(StatusCode, 5)
```

--------------------------------

### Group events by service name and order results

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Selects the count of all events, groups them by service name, and orders the results alphabetically by service name. This query provides an overview of event volume per service.

```seq
select count(*)
from stream
group by @Resource.service.name as service
order by service
```

--------------------------------

### Ingest Logs with Filtering and Properties

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Send log events from files or STDIN to Seq. Supports JSON or plain text input, filtering, and custom properties. Specify input files using wildcards.

```bash
seqcli ingest -i log-*.txt --json --filter="@Level <> 'Debug'" -p Environment=Test
```

--------------------------------

### Update an API Key

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Use this command to update an existing API key. The updated key can be provided as a JSON string or via STDIN.

```bash
seqcli apikey update --json '{...}'
```

--------------------------------

### Pretty-Print CLEF/JSON Events

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Prints events in CLEF/JSON format from a file or STDIN. Supports filtering and custom output templates.

```bash
seqcli print -i log-20201028.clef
```

--------------------------------

### Ingest logs with a custom extraction pattern

Source: https://github.com/datalust/seqcli/blob/dev/README.md

The `seqcli ingest` command parses plain text logs into structured events using a specified extraction pattern. The `-x` argument defines how to parse the log lines.

```shell
seqcli ingest -x "{@t:timestamp} [{@l:level}] {@m:*}{:n}{@x:*}"
```

--------------------------------

### Uninstall a SeqApp Package

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Uninstall a SeqApp package using its package ID.

```bash
seqcli app uninstall --package-id 'Seq.App.JsonArchive'
```

--------------------------------

### Stream Log Events with Filter

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Stream log events from the Seq server. An optional server-side filter can be applied to narrow down the stream. Output can be plain text or newline-delimited JSON.

```bash
seqcli tail -f "@Level = 'Error'"
```

--------------------------------

### Update a Retention Policy with JSON

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Updates an existing retention policy by providing the updated policy details in JSON format. The JSON can be obtained using `seqcli retention list --json`.

```bash
seqcli retention update --json '{...}'
```

--------------------------------

### Run Seq cluster health check

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Checks the health of a Seq cluster and can optionally wait until it is healthy. Specify the Seq server URL using the -s option.

```bash
seqcli cluster health -s https://seq.example.com --wait-until-healthy
```

--------------------------------

### Search Log Events with Filter and Count

Source: https://github.com/datalust/seqcli/blob/dev/README.md

Retrieves log events matching a specific filter and limits the number of results. Use this to find specific log entries based on criteria like exception types.

```bash
seqcli search -f "@Exception like '%TimeoutException%'" -c 30
```

--------------------------------

### Render timestamp as ISO-8601 string

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Converts a numeric timestamp value into a human-readable ISO-8601 formatted string. Uses the `ToIsoString` function.

```seq
ToIsoString(@Timestamp)
```

--------------------------------

### Seq CLI Aggregate Function: first()

Source: https://github.com/datalust/seqcli/blob/dev/src/SeqCli/Skills/Resources/seq-search-and-query/SKILL.md

Returns the value of an expression applied to the first event in the target range.

```seq-query
first(Elapsed)
```