Column presentation is not very readable

[atombender]

I'm evaluating Seq as a possible replacement for Kibana. Right now, the UI falls short in some key areas (which is a little disappointing considering how uniformly terrible the Kibana UI is).

Here's a screenshot:

Several problems:

• The columns have no labels. So the number 93.471 is coming from the elapsed field, but that's not clear. If I wanted to show more than one numeric column, it would get completely unreadable.
• Columns have no apparent ordering (or maybe it's alphabetical?). So the elapsed time appears before the message.
• Columns are not aligned. This makes the events much harder to read.

Event expanded:

As a last point, when I open Seq, I just get this default view of just timestamps:

Apparently Seq does not have any fields rendered by default? Would it not make sense to provide a default?

[nblumhardt]

Thanks for the feedback!

It's generally expected that events arriving at Seq will have some kind of message attached to them - do you have control over the log source that's producing the events without messages? They look a little like syslog, which might be handled better by installing the Seq.Input.Syslog app, in case you haven't spotted it.

It's actually quite surprising (and cool :-) ) that you've been able to work around this using "columns" - it's not really the intended use of the feature (these are normally considered extra embellishments rather than the primary presentation of an event), but seeing this is great food-for-thought for us. I can see how it falls short in this scenario.

(The columns you'll get when running e.g. select count(*) from stream group by context, time(1h), might be closer to what you're expecting.)

To set the default signal, so that you don't get a blank view every time you open Seq, you can edit your "Personal" workspace (nav bar, left-hand-side), and choose the signal that adds your desired columns as the default signal for the workspace.

HTH! Thanks again 👍

[atombender]

I'm testing this locally with the GELF UDP input, and I finally discovered it was using the wrong format — I was using this Go module, but it makes some odd assumptions that the input data is already formatted in a special way, and ends up not sending the right message. This one kind of works, in that I do get the mesage. But now I no longer get another fields. Do you guys have a recommended client for Go, maybe one that talks to Seq natively instead of going through GELF?

I guess I'm confused about what columns are intended for. The default view is this message-oriented view which show each event as a timestamp and message, with the option to include more fields as "columns" (even though they're not columns in the classical sense — they're not lined up!). I can do an SQL query and get an actual columnar table view, but that's a very different view. I tried doing select * from stream limit 1000, which took about 30 seconds to run for the timeframe (I only have a few hundred events today), and that doesn't seem to be how you normally query? For one, it doesn't support the "live tailing" mode.

[liammclennan]

We don't maintain a Go client, but let me know if https://docs.datalust.co/docs/using-go helps.

Seq is designed for structured logging with message templates (https://messagetemplates.org/). If you send events with no message then you'll see something like what you have. Columns are meant as a way of highlighting particular values. For example, some people will log HTTP requests and set a column for response time, to make it easy to visually scan. Here is some more info https://docs.datalust.co/docs/signals#showing-properties-as-columns.