Support alert create/update/remove/enable/disable in the CLI#475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KodrAus merged 10 commits into from
Jul 24, 2026
Merged

Support alert create/update/remove/enable/disable in the CLI #475

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
3b7d061
Initial Alert CLI implementation
amannix-ro Jul 13, 2026
5e1d571
update CLI args for alert creation
amannix-ro Jul 14, 2026
1d1be45
move aliased column parser into a dedicated utility
amannix-ro Jul 14, 2026
ff0573b
use preview container on Linux for now
amannix-ro Jul 14, 2026
a32b028
simplify alias expression parser and container tag passing
amannix-ro Jul 14, 2026
9339d5a
add alert enable/disable commands
amannix-ro Jul 14, 2026
77633b4
cleanup and refactoring based on review
KodrAus Jul 15, 2026
ad19b36
document default notification level
KodrAus Jul 24, 2026
db11f48
Merge branch 'dev' of https://github.com/datalust/seqcli into feat/al…
KodrAus Jul 24, 2026
d68bfdb
use 2026.1 release container
KodrAus Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -65,6 +65,7 @@ jobs:
DOTNET_CLI_TELEMETRY_OPTOUT: true
DOCKER_USER: ${{ secrets.DOCKER_USER }}
DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
SEQ_DOCKER_TAG: 2026.1
shell: pwsh
run: |
./build/Build.Linux.ps1
./build/Build.Linux.ps1 -SeqDockerTag $env:SEQ_DOCKER_TAG
144 changes: 144 additions & 0 deletions README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -120,6 +120,13 @@ seqcli help apikey

Available commands:

- `alert`
- [`alert create`](#alert-create) — Create an alert.
- [`alert disable`](#alert-disable) — Disable one or more alerts.
- [`alert enable`](#alert-enable) — Enable one or more alerts.
- [`alert list`](#alert-list) — List alerts.
- [`alert remove`](#alert-remove) — Remove an alert from the server.
- [`alert update`](#alert-update) — Update an existing alert.
- `apikey`
- [`apikey create`](#apikey-create) — Create an API key for automation or ingestion.
- [`apikey list`](#apikey-list) — List available API keys.
Expand DownExpand Up@@ -221,6 +228,143 @@ Available commands:
- [`workspace remove`](#workspace-remove) — Remove a workspace from the server.
- [`workspace update`](#workspace-update) — Update an existing workspace.

### `alert create`

Create an alert.

Example:

```
seqcli alert create -t 'Too many errors' --select "count(*) as errors" --from stream --signal signal-m33302 --where "@Level = 'Error'" --window 5m --having "errors > 10" --notification-level Error --suppression-time 10m
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | A title for the alert |
| `--description=VALUE` | A description for the alert |
| `--from=VALUE` | The data source the alert queries; either `stream` (the default) or `series` |
| `--signal=VALUE` | A signal expression limiting the alert's input, for example `signal-1` or `signal-1,signal-2` |
| `--lateral=VALUE` | A lateral join over a set-valued function applied to the data source, in the form `<setFunctionCall> as <alias>`, for example `unnest(http.server.request.duration.buckets) as bucket`; this argument can be used multiple times |
| `--where=VALUE` | A predicate that selects the events the alert will consider |
| `--select=VALUE` | A measurement the alert condition will test, for example `count(*) as errors`; this argument can be used multiple times |
| `--group-by=VALUE` | An expression to group measurements by, for example `ServiceName` or `ServiceName ci as service`; the `ci` modifier makes the grouping case-insensitive; this argument can be used multiple times |
| `--window=VALUE` | The measurement window over which the alert condition is evaluated, as a duration, for example `1m` or `1h` |
| `--having=VALUE` | The alert condition; a predicate over the grouped measurements, for example `errors > 10` |
| `--notification-level=VALUE` | The level of the notifications raised by the alert, for example `Warning` or `Error` |
| `--suppression-time=VALUE` | A duration for which notifications are suppressed after the alert triggers, for example `10m` or `1h` |
| `--notification-app=VALUE` | The id of an app instance that will be notified when the alert triggers; this argument can be used multiple times |
| `--protected` | Specify that the alert is editable only by administrators |
| `--disabled` | Create the alert in a disabled state; disabled alerts are not processed and do not send notifications |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert disable`

Disable one or more alerts.

Example:

```
seqcli alert disable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to disable |
| `-i`, `--id=VALUE` | The id of a single alert to disable |
| `-o`, `--owner=VALUE` | The id of the user to disable alerts for; by default, shared alerts are disabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert enable`

Enable one or more alerts.

Example:

```
seqcli alert enable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to enable |
| `-i`, `--id=VALUE` | The id of a single alert to enable |
| `-o`, `--owner=VALUE` | The id of the user to enable alerts for; by default, shared alerts are enabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert list`

List alerts.

Example:

```
seqcli alert list
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to list |
| `-i`, `--id=VALUE` | The id of a single alert to list |
| `-o`, `--owner=VALUE` | The id of the user to list alerts for; by default, shared alerts are listed |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |

### `alert remove`

Remove an alert from the server.

Example:

```
seqcli alert remove -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to remove |
| `-i`, `--id=VALUE` | The id of a single alert to remove |
| `-o`, `--owner=VALUE` | The id of the user to remove alerts for; by default, shared alerts are removed |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert update`

Update an existing alert.

Example:

```
seqcli alert update --json '{...}'
```

| Option | Description |
| ------ | ----------- |
| `--json=VALUE` | The updated alert in JSON format; this can be produced using `seqcli alert list --json` |
| `--json-stdin` | Read the updated alert as JSON from `STDIN` |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `apikey create`

Create an API key for automation or ingestion.
Expand Down
8 changes: 6 additions & 2 deletions build/Build.Linux.ps1
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
param(
[string] $SeqDockerTag = "latest"
)

Push-Location $PSScriptRoot/../

. ./build/Build.Common.ps1
Expand All@@ -23,8 +27,8 @@ function Execute-Tests
if ($LASTEXITCODE -ne 0) { exit 1 }

cd ./test/SeqCli.EndToEnd/
docker pull datalust/seq:latest
& dotnet run -f $framework -- --docker-server
docker pull datalust/seq:$SeqDockerTag
& dotnet run -f $framework -- --docker-server --docker-tag=$SeqDockerTag
if ($LASTEXITCODE -ne 0)
{
cd ../..
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Support alert create/update/remove/enable/disable in the CLI#475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

KodrAus
merged 10 commits into

from

Jul 24, 2026
 Merged


Support alert create/update/remove/enable/disable in the CLI
#475
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
3b7d061

Initial Alert CLI implementation


amannix-ro Jul 13, 2026
5e1d571

update CLI args for alert creation


amannix-ro Jul 14, 2026
1d1be45

move aliased column parser into a dedicated utility


amannix-ro Jul 14, 2026
ff0573b

use preview container on Linux for now


amannix-ro Jul 14, 2026
a32b028

simplify alias expression parser and container tag passing


amannix-ro Jul 14, 2026
9339d5a

add alert enable/disable commands


amannix-ro Jul 14, 2026
77633b4

cleanup and refactoring based on review


KodrAus Jul 15, 2026
ad19b36

document default notification level


KodrAus Jul 24, 2026
db11f48

Merge branch 'dev' of https://github.com/datalust/seqcli into feat/al…


KodrAus Jul 24, 2026
d68bfdb

use 2026.1 release container


KodrAus Jul 24, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


3 changes: 2 additions & 1 deletion
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -65,6 +65,7 @@ jobs:
 DOTNET_CLI_TELEMETRY_OPTOUT: true
 DOCKER_USER: ${{ secrets.DOCKER_USER }}
 DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
 SEQ_DOCKER_TAG: 2026.1
 shell: pwsh
 run: |
 ./build/Build.Linux.ps1
 ./build/Build.Linux.ps1 -SeqDockerTag $env:SEQ_DOCKER_TAG

144 changes: 144 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -120,6 +120,13 @@ seqcli help apikey

Available commands:

 - `alert`
 - [`alert create`](#alert-create) &mdash; Create an alert.
 - [`alert disable`](#alert-disable) &mdash; Disable one or more alerts.
 - [`alert enable`](#alert-enable) &mdash; Enable one or more alerts.
 - [`alert list`](#alert-list) &mdash; List alerts.
 - [`alert remove`](#alert-remove) &mdash; Remove an alert from the server.
 - [`alert update`](#alert-update) &mdash; Update an existing alert.
 - `apikey`
 - [`apikey create`](#apikey-create) &mdash; Create an API key for automation or ingestion.
 - [`apikey list`](#apikey-list) &mdash; List available API keys.
Expand DownExpand Up@@ -221,6 +228,143 @@ Available commands:
 - [`workspace remove`](#workspace-remove) &mdash; Remove a workspace from the server.
 - [`workspace update`](#workspace-update) &mdash; Update an existing workspace.

### `alert create`

Create an alert.

Example:

```
seqcli alert create -t 'Too many errors' --select "count(*) as errors" --from stream --signal signal-m33302 --where "@Level = 'Error'" --window 5m --having "errors > 10" --notification-level Error --suppression-time 10m
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | A title for the alert |
| `--description=VALUE` | A description for the alert |
| `--from=VALUE` | The data source the alert queries; either `stream` (the default) or `series` |
| `--signal=VALUE` | A signal expression limiting the alert's input, for example `signal-1` or `signal-1,signal-2` |
| `--lateral=VALUE` | A lateral join over a set-valued function applied to the data source, in the form `<setFunctionCall> as <alias>`, for example `unnest(http.server.request.duration.buckets) as bucket`; this argument can be used multiple times |
| `--where=VALUE` | A predicate that selects the events the alert will consider |
| `--select=VALUE` | A measurement the alert condition will test, for example `count(*) as errors`; this argument can be used multiple times |
| `--group-by=VALUE` | An expression to group measurements by, for example `ServiceName` or `ServiceName ci as service`; the `ci` modifier makes the grouping case-insensitive; this argument can be used multiple times |
| `--window=VALUE` | The measurement window over which the alert condition is evaluated, as a duration, for example `1m` or `1h` |
| `--having=VALUE` | The alert condition; a predicate over the grouped measurements, for example `errors > 10` |
| `--notification-level=VALUE` | The level of the notifications raised by the alert, for example `Warning` or `Error` |
| `--suppression-time=VALUE` | A duration for which notifications are suppressed after the alert triggers, for example `10m` or `1h` |
| `--notification-app=VALUE` | The id of an app instance that will be notified when the alert triggers; this argument can be used multiple times |
| `--protected` | Specify that the alert is editable only by administrators |
| `--disabled` | Create the alert in a disabled state; disabled alerts are not processed and do not send notifications |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert disable`

Disable one or more alerts.

Example:

```
seqcli alert disable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to disable |
| `-i`, `--id=VALUE` | The id of a single alert to disable |
| `-o`, `--owner=VALUE` | The id of the user to disable alerts for; by default, shared alerts are disabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert enable`

Enable one or more alerts.

Example:

```
seqcli alert enable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to enable |
| `-i`, `--id=VALUE` | The id of a single alert to enable |
| `-o`, `--owner=VALUE` | The id of the user to enable alerts for; by default, shared alerts are enabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert list`

List alerts.

Example:

```
seqcli alert list
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to list |
| `-i`, `--id=VALUE` | The id of a single alert to list |
| `-o`, `--owner=VALUE` | The id of the user to list alerts for; by default, shared alerts are listed |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |

### `alert remove`

Remove an alert from the server.

Example:

```
seqcli alert remove -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to remove |
| `-i`, `--id=VALUE` | The id of a single alert to remove |
| `-o`, `--owner=VALUE` | The id of the user to remove alerts for; by default, shared alerts are removed |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert update`

Update an existing alert.

Example:

```
seqcli alert update --json '{...}'
```

| Option | Description |
| ------ | ----------- |
| `--json=VALUE` | The updated alert in JSON format; this can be produced using `seqcli alert list --json` |
| `--json-stdin` | Read the updated alert as JSON from `STDIN` |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `apikey create`

Create an API key for automation or ingestion.
Expand Down

8 changes: 6 additions & 2 deletions
build/Build.Linux.ps1

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
param(
 [string] $SeqDockerTag = "latest"
)

Push-Location $PSScriptRoot/../

. ./build/Build.Common.ps1
Expand All@@ -23,8 +27,8 @@ function Execute-Tests
 if ($LASTEXITCODE -ne 0) { exit 1 }

 cd ./test/SeqCli.EndToEnd/
 docker pull datalust/seq:latest
 & dotnet run -f $framework -- --docker-server
 docker pull datalust/seq:$SeqDockerTag
 & dotnet run -f $framework -- --docker-server --docker-tag=$SeqDockerTag
 if ($LASTEXITCODE -ne 0)
 { 
 cd ../..
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Support alert create/update/remove/enable/disable in the CLI#475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

KodrAus
merged 10 commits into

from

Jul 24, 2026
 Merged


Support alert create/update/remove/enable/disable in the CLI
#475
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
3b7d061

Initial Alert CLI implementation


amannix-ro Jul 13, 2026
5e1d571

update CLI args for alert creation


amannix-ro Jul 14, 2026
1d1be45

move aliased column parser into a dedicated utility


amannix-ro Jul 14, 2026
ff0573b

use preview container on Linux for now


amannix-ro Jul 14, 2026
a32b028

simplify alias expression parser and container tag passing


amannix-ro Jul 14, 2026
9339d5a

add alert enable/disable commands


amannix-ro Jul 14, 2026
77633b4

cleanup and refactoring based on review


KodrAus Jul 15, 2026
ad19b36

document default notification level


KodrAus Jul 24, 2026
db11f48

Merge branch 'dev' of https://github.com/datalust/seqcli into feat/al…


KodrAus Jul 24, 2026
d68bfdb

use 2026.1 release container


KodrAus Jul 24, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


3 changes: 2 additions & 1 deletion
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -65,6 +65,7 @@ jobs:
 DOTNET_CLI_TELEMETRY_OPTOUT: true
 DOCKER_USER: ${{ secrets.DOCKER_USER }}
 DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
 SEQ_DOCKER_TAG: 2026.1
 shell: pwsh
 run: |
 ./build/Build.Linux.ps1
 ./build/Build.Linux.ps1 -SeqDockerTag $env:SEQ_DOCKER_TAG

144 changes: 144 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -120,6 +120,13 @@ seqcli help apikey

Available commands:

 - `alert`
 - [`alert create`](#alert-create) &mdash; Create an alert.
 - [`alert disable`](#alert-disable) &mdash; Disable one or more alerts.
 - [`alert enable`](#alert-enable) &mdash; Enable one or more alerts.
 - [`alert list`](#alert-list) &mdash; List alerts.
 - [`alert remove`](#alert-remove) &mdash; Remove an alert from the server.
 - [`alert update`](#alert-update) &mdash; Update an existing alert.
 - `apikey`
 - [`apikey create`](#apikey-create) &mdash; Create an API key for automation or ingestion.
 - [`apikey list`](#apikey-list) &mdash; List available API keys.
Expand DownExpand Up@@ -221,6 +228,143 @@ Available commands:
 - [`workspace remove`](#workspace-remove) &mdash; Remove a workspace from the server.
 - [`workspace update`](#workspace-update) &mdash; Update an existing workspace.

### `alert create`

Create an alert.

Example:

```
seqcli alert create -t 'Too many errors' --select "count(*) as errors" --from stream --signal signal-m33302 --where "@Level = 'Error'" --window 5m --having "errors > 10" --notification-level Error --suppression-time 10m
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | A title for the alert |
| `--description=VALUE` | A description for the alert |
| `--from=VALUE` | The data source the alert queries; either `stream` (the default) or `series` |
| `--signal=VALUE` | A signal expression limiting the alert's input, for example `signal-1` or `signal-1,signal-2` |
| `--lateral=VALUE` | A lateral join over a set-valued function applied to the data source, in the form `<setFunctionCall> as <alias>`, for example `unnest(http.server.request.duration.buckets) as bucket`; this argument can be used multiple times |
| `--where=VALUE` | A predicate that selects the events the alert will consider |
| `--select=VALUE` | A measurement the alert condition will test, for example `count(*) as errors`; this argument can be used multiple times |
| `--group-by=VALUE` | An expression to group measurements by, for example `ServiceName` or `ServiceName ci as service`; the `ci` modifier makes the grouping case-insensitive; this argument can be used multiple times |
| `--window=VALUE` | The measurement window over which the alert condition is evaluated, as a duration, for example `1m` or `1h` |
| `--having=VALUE` | The alert condition; a predicate over the grouped measurements, for example `errors > 10` |
| `--notification-level=VALUE` | The level of the notifications raised by the alert, for example `Warning` or `Error` |
| `--suppression-time=VALUE` | A duration for which notifications are suppressed after the alert triggers, for example `10m` or `1h` |
| `--notification-app=VALUE` | The id of an app instance that will be notified when the alert triggers; this argument can be used multiple times |
| `--protected` | Specify that the alert is editable only by administrators |
| `--disabled` | Create the alert in a disabled state; disabled alerts are not processed and do not send notifications |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert disable`

Disable one or more alerts.

Example:

```
seqcli alert disable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to disable |
| `-i`, `--id=VALUE` | The id of a single alert to disable |
| `-o`, `--owner=VALUE` | The id of the user to disable alerts for; by default, shared alerts are disabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert enable`

Enable one or more alerts.

Example:

```
seqcli alert enable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to enable |
| `-i`, `--id=VALUE` | The id of a single alert to enable |
| `-o`, `--owner=VALUE` | The id of the user to enable alerts for; by default, shared alerts are enabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert list`

List alerts.

Example:

```
seqcli alert list
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to list |
| `-i`, `--id=VALUE` | The id of a single alert to list |
| `-o`, `--owner=VALUE` | The id of the user to list alerts for; by default, shared alerts are listed |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |

### `alert remove`

Remove an alert from the server.

Example:

```
seqcli alert remove -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to remove |
| `-i`, `--id=VALUE` | The id of a single alert to remove |
| `-o`, `--owner=VALUE` | The id of the user to remove alerts for; by default, shared alerts are removed |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert update`

Update an existing alert.

Example:

```
seqcli alert update --json '{...}'
```

| Option | Description |
| ------ | ----------- |
| `--json=VALUE` | The updated alert in JSON format; this can be produced using `seqcli alert list --json` |
| `--json-stdin` | Read the updated alert as JSON from `STDIN` |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `apikey create`

Create an API key for automation or ingestion.
Expand Down

8 changes: 6 additions & 2 deletions
build/Build.Linux.ps1

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
param(
 [string] $SeqDockerTag = "latest"
)

Push-Location $PSScriptRoot/../

. ./build/Build.Common.ps1
Expand All@@ -23,8 +27,8 @@ function Execute-Tests
 if ($LASTEXITCODE -ne 0) { exit 1 }

 cd ./test/SeqCli.EndToEnd/
 docker pull datalust/seq:latest
 & dotnet run -f $framework -- --docker-server
 docker pull datalust/seq:$SeqDockerTag
 & dotnet run -f $framework -- --docker-server --docker-tag=$SeqDockerTag
 if ($LASTEXITCODE -ne 0)
 { 
 cd ../..
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Support alert create/update/remove/enable/disable in the CLI#475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

KodrAus
merged 10 commits into

from

Jul 24, 2026
 Merged


Support alert create/update/remove/enable/disable in the CLI
#475
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
3b7d061

Initial Alert CLI implementation


amannix-ro Jul 13, 2026
5e1d571

update CLI args for alert creation


amannix-ro Jul 14, 2026
1d1be45

move aliased column parser into a dedicated utility


amannix-ro Jul 14, 2026
ff0573b

use preview container on Linux for now


amannix-ro Jul 14, 2026
a32b028

simplify alias expression parser and container tag passing


amannix-ro Jul 14, 2026
9339d5a

add alert enable/disable commands


amannix-ro Jul 14, 2026
77633b4

cleanup and refactoring based on review


KodrAus Jul 15, 2026
ad19b36

document default notification level


KodrAus Jul 24, 2026
db11f48

Merge branch 'dev' of https://github.com/datalust/seqcli into feat/al…


KodrAus Jul 24, 2026
d68bfdb

use 2026.1 release container


KodrAus Jul 24, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


3 changes: 2 additions & 1 deletion
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -65,6 +65,7 @@ jobs:
 DOTNET_CLI_TELEMETRY_OPTOUT: true
 DOCKER_USER: ${{ secrets.DOCKER_USER }}
 DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
 SEQ_DOCKER_TAG: 2026.1
 shell: pwsh
 run: |
 ./build/Build.Linux.ps1
 ./build/Build.Linux.ps1 -SeqDockerTag $env:SEQ_DOCKER_TAG

144 changes: 144 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -120,6 +120,13 @@ seqcli help apikey

Available commands:

 - `alert`
 - [`alert create`](#alert-create) &mdash; Create an alert.
 - [`alert disable`](#alert-disable) &mdash; Disable one or more alerts.
 - [`alert enable`](#alert-enable) &mdash; Enable one or more alerts.
 - [`alert list`](#alert-list) &mdash; List alerts.
 - [`alert remove`](#alert-remove) &mdash; Remove an alert from the server.
 - [`alert update`](#alert-update) &mdash; Update an existing alert.
 - `apikey`
 - [`apikey create`](#apikey-create) &mdash; Create an API key for automation or ingestion.
 - [`apikey list`](#apikey-list) &mdash; List available API keys.
Expand DownExpand Up@@ -221,6 +228,143 @@ Available commands:
 - [`workspace remove`](#workspace-remove) &mdash; Remove a workspace from the server.
 - [`workspace update`](#workspace-update) &mdash; Update an existing workspace.

### `alert create`

Create an alert.

Example:

```
seqcli alert create -t 'Too many errors' --select "count(*) as errors" --from stream --signal signal-m33302 --where "@Level = 'Error'" --window 5m --having "errors > 10" --notification-level Error --suppression-time 10m
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | A title for the alert |
| `--description=VALUE` | A description for the alert |
| `--from=VALUE` | The data source the alert queries; either `stream` (the default) or `series` |
| `--signal=VALUE` | A signal expression limiting the alert's input, for example `signal-1` or `signal-1,signal-2` |
| `--lateral=VALUE` | A lateral join over a set-valued function applied to the data source, in the form `<setFunctionCall> as <alias>`, for example `unnest(http.server.request.duration.buckets) as bucket`; this argument can be used multiple times |
| `--where=VALUE` | A predicate that selects the events the alert will consider |
| `--select=VALUE` | A measurement the alert condition will test, for example `count(*) as errors`; this argument can be used multiple times |
| `--group-by=VALUE` | An expression to group measurements by, for example `ServiceName` or `ServiceName ci as service`; the `ci` modifier makes the grouping case-insensitive; this argument can be used multiple times |
| `--window=VALUE` | The measurement window over which the alert condition is evaluated, as a duration, for example `1m` or `1h` |
| `--having=VALUE` | The alert condition; a predicate over the grouped measurements, for example `errors > 10` |
| `--notification-level=VALUE` | The level of the notifications raised by the alert, for example `Warning` or `Error` |
| `--suppression-time=VALUE` | A duration for which notifications are suppressed after the alert triggers, for example `10m` or `1h` |
| `--notification-app=VALUE` | The id of an app instance that will be notified when the alert triggers; this argument can be used multiple times |
| `--protected` | Specify that the alert is editable only by administrators |
| `--disabled` | Create the alert in a disabled state; disabled alerts are not processed and do not send notifications |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert disable`

Disable one or more alerts.

Example:

```
seqcli alert disable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to disable |
| `-i`, `--id=VALUE` | The id of a single alert to disable |
| `-o`, `--owner=VALUE` | The id of the user to disable alerts for; by default, shared alerts are disabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert enable`

Enable one or more alerts.

Example:

```
seqcli alert enable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to enable |
| `-i`, `--id=VALUE` | The id of a single alert to enable |
| `-o`, `--owner=VALUE` | The id of the user to enable alerts for; by default, shared alerts are enabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert list`

List alerts.

Example:

```
seqcli alert list
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to list |
| `-i`, `--id=VALUE` | The id of a single alert to list |
| `-o`, `--owner=VALUE` | The id of the user to list alerts for; by default, shared alerts are listed |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |

### `alert remove`

Remove an alert from the server.

Example:

```
seqcli alert remove -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to remove |
| `-i`, `--id=VALUE` | The id of a single alert to remove |
| `-o`, `--owner=VALUE` | The id of the user to remove alerts for; by default, shared alerts are removed |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert update`

Update an existing alert.

Example:

```
seqcli alert update --json '{...}'
```

| Option | Description |
| ------ | ----------- |
| `--json=VALUE` | The updated alert in JSON format; this can be produced using `seqcli alert list --json` |
| `--json-stdin` | Read the updated alert as JSON from `STDIN` |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `apikey create`

Create an API key for automation or ingestion.
Expand Down

8 changes: 6 additions & 2 deletions
build/Build.Linux.ps1

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
param(
 [string] $SeqDockerTag = "latest"
)

Push-Location $PSScriptRoot/../

. ./build/Build.Common.ps1
Expand All@@ -23,8 +27,8 @@ function Execute-Tests
 if ($LASTEXITCODE -ne 0) { exit 1 }

 cd ./test/SeqCli.EndToEnd/
 docker pull datalust/seq:latest
 & dotnet run -f $framework -- --docker-server
 docker pull datalust/seq:$SeqDockerTag
 & dotnet run -f $framework -- --docker-server --docker-tag=$SeqDockerTag
 if ($LASTEXITCODE -ne 0)
 { 
 cd ../..
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Support alert create/update/remove/enable/disable in the CLI#475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

KodrAus
merged 10 commits into

from

Jul 24, 2026
 Merged


Support alert create/update/remove/enable/disable in the CLI
#475
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
3b7d061

Initial Alert CLI implementation


amannix-ro Jul 13, 2026
5e1d571

update CLI args for alert creation


amannix-ro Jul 14, 2026
1d1be45

move aliased column parser into a dedicated utility


amannix-ro Jul 14, 2026
ff0573b

use preview container on Linux for now


amannix-ro Jul 14, 2026
a32b028

simplify alias expression parser and container tag passing


amannix-ro Jul 14, 2026
9339d5a

add alert enable/disable commands


amannix-ro Jul 14, 2026
77633b4

cleanup and refactoring based on review


KodrAus Jul 15, 2026
ad19b36

document default notification level


KodrAus Jul 24, 2026
db11f48

Merge branch 'dev' of https://github.com/datalust/seqcli into feat/al…


KodrAus Jul 24, 2026
d68bfdb

use 2026.1 release container


KodrAus Jul 24, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


3 changes: 2 additions & 1 deletion
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -65,6 +65,7 @@ jobs:
 DOTNET_CLI_TELEMETRY_OPTOUT: true
 DOCKER_USER: ${{ secrets.DOCKER_USER }}
 DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
 SEQ_DOCKER_TAG: 2026.1
 shell: pwsh
 run: |
 ./build/Build.Linux.ps1
 ./build/Build.Linux.ps1 -SeqDockerTag $env:SEQ_DOCKER_TAG

144 changes: 144 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -120,6 +120,13 @@ seqcli help apikey

Available commands:

 - `alert`
 - [`alert create`](#alert-create) &mdash; Create an alert.
 - [`alert disable`](#alert-disable) &mdash; Disable one or more alerts.
 - [`alert enable`](#alert-enable) &mdash; Enable one or more alerts.
 - [`alert list`](#alert-list) &mdash; List alerts.
 - [`alert remove`](#alert-remove) &mdash; Remove an alert from the server.
 - [`alert update`](#alert-update) &mdash; Update an existing alert.
 - `apikey`
 - [`apikey create`](#apikey-create) &mdash; Create an API key for automation or ingestion.
 - [`apikey list`](#apikey-list) &mdash; List available API keys.
Expand DownExpand Up@@ -221,6 +228,143 @@ Available commands:
 - [`workspace remove`](#workspace-remove) &mdash; Remove a workspace from the server.
 - [`workspace update`](#workspace-update) &mdash; Update an existing workspace.

### `alert create`

Create an alert.

Example:

```
seqcli alert create -t 'Too many errors' --select "count(*) as errors" --from stream --signal signal-m33302 --where "@Level = 'Error'" --window 5m --having "errors > 10" --notification-level Error --suppression-time 10m
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | A title for the alert |
| `--description=VALUE` | A description for the alert |
| `--from=VALUE` | The data source the alert queries; either `stream` (the default) or `series` |
| `--signal=VALUE` | A signal expression limiting the alert's input, for example `signal-1` or `signal-1,signal-2` |
| `--lateral=VALUE` | A lateral join over a set-valued function applied to the data source, in the form `<setFunctionCall> as <alias>`, for example `unnest(http.server.request.duration.buckets) as bucket`; this argument can be used multiple times |
| `--where=VALUE` | A predicate that selects the events the alert will consider |
| `--select=VALUE` | A measurement the alert condition will test, for example `count(*) as errors`; this argument can be used multiple times |
| `--group-by=VALUE` | An expression to group measurements by, for example `ServiceName` or `ServiceName ci as service`; the `ci` modifier makes the grouping case-insensitive; this argument can be used multiple times |
| `--window=VALUE` | The measurement window over which the alert condition is evaluated, as a duration, for example `1m` or `1h` |
| `--having=VALUE` | The alert condition; a predicate over the grouped measurements, for example `errors > 10` |
| `--notification-level=VALUE` | The level of the notifications raised by the alert, for example `Warning` or `Error` |
| `--suppression-time=VALUE` | A duration for which notifications are suppressed after the alert triggers, for example `10m` or `1h` |
| `--notification-app=VALUE` | The id of an app instance that will be notified when the alert triggers; this argument can be used multiple times |
| `--protected` | Specify that the alert is editable only by administrators |
| `--disabled` | Create the alert in a disabled state; disabled alerts are not processed and do not send notifications |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert disable`

Disable one or more alerts.

Example:

```
seqcli alert disable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to disable |
| `-i`, `--id=VALUE` | The id of a single alert to disable |
| `-o`, `--owner=VALUE` | The id of the user to disable alerts for; by default, shared alerts are disabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert enable`

Enable one or more alerts.

Example:

```
seqcli alert enable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to enable |
| `-i`, `--id=VALUE` | The id of a single alert to enable |
| `-o`, `--owner=VALUE` | The id of the user to enable alerts for; by default, shared alerts are enabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert list`

List alerts.

Example:

```
seqcli alert list
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to list |
| `-i`, `--id=VALUE` | The id of a single alert to list |
| `-o`, `--owner=VALUE` | The id of the user to list alerts for; by default, shared alerts are listed |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |

### `alert remove`

Remove an alert from the server.

Example:

```
seqcli alert remove -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to remove |
| `-i`, `--id=VALUE` | The id of a single alert to remove |
| `-o`, `--owner=VALUE` | The id of the user to remove alerts for; by default, shared alerts are removed |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert update`

Update an existing alert.

Example:

```
seqcli alert update --json '{...}'
```

| Option | Description |
| ------ | ----------- |
| `--json=VALUE` | The updated alert in JSON format; this can be produced using `seqcli alert list --json` |
| `--json-stdin` | Read the updated alert as JSON from `STDIN` |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `apikey create`

Create an API key for automation or ingestion.
Expand Down

8 changes: 6 additions & 2 deletions
build/Build.Linux.ps1

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
param(
 [string] $SeqDockerTag = "latest"
)

Push-Location $PSScriptRoot/../

. ./build/Build.Common.ps1
Expand All@@ -23,8 +27,8 @@ function Execute-Tests
 if ($LASTEXITCODE -ne 0) { exit 1 }

 cd ./test/SeqCli.EndToEnd/
 docker pull datalust/seq:latest
 & dotnet run -f $framework -- --docker-server
 docker pull datalust/seq:$SeqDockerTag
 & dotnet run -f $framework -- --docker-server --docker-tag=$SeqDockerTag
 if ($LASTEXITCODE -ne 0)
 { 
 cd ../..
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Support alert create/update/remove/enable/disable in the CLI#475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

KodrAus
merged 10 commits into

from

Jul 24, 2026
 Merged


Support alert create/update/remove/enable/disable in the CLI
#475
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
3b7d061

Initial Alert CLI implementation


amannix-ro Jul 13, 2026
5e1d571

update CLI args for alert creation


amannix-ro Jul 14, 2026
1d1be45

move aliased column parser into a dedicated utility


amannix-ro Jul 14, 2026
ff0573b

use preview container on Linux for now


amannix-ro Jul 14, 2026
a32b028

simplify alias expression parser and container tag passing


amannix-ro Jul 14, 2026
9339d5a

add alert enable/disable commands


amannix-ro Jul 14, 2026
77633b4

cleanup and refactoring based on review


KodrAus Jul 15, 2026
ad19b36

document default notification level


KodrAus Jul 24, 2026
db11f48

Merge branch 'dev' of https://github.com/datalust/seqcli into feat/al…


KodrAus Jul 24, 2026
d68bfdb

use 2026.1 release container


KodrAus Jul 24, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


3 changes: 2 additions & 1 deletion
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -65,6 +65,7 @@ jobs:
 DOTNET_CLI_TELEMETRY_OPTOUT: true
 DOCKER_USER: ${{ secrets.DOCKER_USER }}
 DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
 SEQ_DOCKER_TAG: 2026.1
 shell: pwsh
 run: |
 ./build/Build.Linux.ps1
 ./build/Build.Linux.ps1 -SeqDockerTag $env:SEQ_DOCKER_TAG

144 changes: 144 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -120,6 +120,13 @@ seqcli help apikey

Available commands:

 - `alert`
 - [`alert create`](#alert-create) &mdash; Create an alert.
 - [`alert disable`](#alert-disable) &mdash; Disable one or more alerts.
 - [`alert enable`](#alert-enable) &mdash; Enable one or more alerts.
 - [`alert list`](#alert-list) &mdash; List alerts.
 - [`alert remove`](#alert-remove) &mdash; Remove an alert from the server.
 - [`alert update`](#alert-update) &mdash; Update an existing alert.
 - `apikey`
 - [`apikey create`](#apikey-create) &mdash; Create an API key for automation or ingestion.
 - [`apikey list`](#apikey-list) &mdash; List available API keys.
Expand DownExpand Up@@ -221,6 +228,143 @@ Available commands:
 - [`workspace remove`](#workspace-remove) &mdash; Remove a workspace from the server.
 - [`workspace update`](#workspace-update) &mdash; Update an existing workspace.

### `alert create`

Create an alert.

Example:

```
seqcli alert create -t 'Too many errors' --select "count(*) as errors" --from stream --signal signal-m33302 --where "@Level = 'Error'" --window 5m --having "errors > 10" --notification-level Error --suppression-time 10m
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | A title for the alert |
| `--description=VALUE` | A description for the alert |
| `--from=VALUE` | The data source the alert queries; either `stream` (the default) or `series` |
| `--signal=VALUE` | A signal expression limiting the alert's input, for example `signal-1` or `signal-1,signal-2` |
| `--lateral=VALUE` | A lateral join over a set-valued function applied to the data source, in the form `<setFunctionCall> as <alias>`, for example `unnest(http.server.request.duration.buckets) as bucket`; this argument can be used multiple times |
| `--where=VALUE` | A predicate that selects the events the alert will consider |
| `--select=VALUE` | A measurement the alert condition will test, for example `count(*) as errors`; this argument can be used multiple times |
| `--group-by=VALUE` | An expression to group measurements by, for example `ServiceName` or `ServiceName ci as service`; the `ci` modifier makes the grouping case-insensitive; this argument can be used multiple times |
| `--window=VALUE` | The measurement window over which the alert condition is evaluated, as a duration, for example `1m` or `1h` |
| `--having=VALUE` | The alert condition; a predicate over the grouped measurements, for example `errors > 10` |
| `--notification-level=VALUE` | The level of the notifications raised by the alert, for example `Warning` or `Error` |
| `--suppression-time=VALUE` | A duration for which notifications are suppressed after the alert triggers, for example `10m` or `1h` |
| `--notification-app=VALUE` | The id of an app instance that will be notified when the alert triggers; this argument can be used multiple times |
| `--protected` | Specify that the alert is editable only by administrators |
| `--disabled` | Create the alert in a disabled state; disabled alerts are not processed and do not send notifications |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert disable`

Disable one or more alerts.

Example:

```
seqcli alert disable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to disable |
| `-i`, `--id=VALUE` | The id of a single alert to disable |
| `-o`, `--owner=VALUE` | The id of the user to disable alerts for; by default, shared alerts are disabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert enable`

Enable one or more alerts.

Example:

```
seqcli alert enable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to enable |
| `-i`, `--id=VALUE` | The id of a single alert to enable |
| `-o`, `--owner=VALUE` | The id of the user to enable alerts for; by default, shared alerts are enabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert list`

List alerts.

Example:

```
seqcli alert list
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to list |
| `-i`, `--id=VALUE` | The id of a single alert to list |
| `-o`, `--owner=VALUE` | The id of the user to list alerts for; by default, shared alerts are listed |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |

### `alert remove`

Remove an alert from the server.

Example:

```
seqcli alert remove -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to remove |
| `-i`, `--id=VALUE` | The id of a single alert to remove |
| `-o`, `--owner=VALUE` | The id of the user to remove alerts for; by default, shared alerts are removed |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert update`

Update an existing alert.

Example:

```
seqcli alert update --json '{...}'
```

| Option | Description |
| ------ | ----------- |
| `--json=VALUE` | The updated alert in JSON format; this can be produced using `seqcli alert list --json` |
| `--json-stdin` | Read the updated alert as JSON from `STDIN` |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `apikey create`

Create an API key for automation or ingestion.
Expand Down

8 changes: 6 additions & 2 deletions
build/Build.Linux.ps1

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
param(
 [string] $SeqDockerTag = "latest"
)

Push-Location $PSScriptRoot/../

. ./build/Build.Common.ps1
Expand All@@ -23,8 +27,8 @@ function Execute-Tests
 if ($LASTEXITCODE -ne 0) { exit 1 }

 cd ./test/SeqCli.EndToEnd/
 docker pull datalust/seq:latest
 & dotnet run -f $framework -- --docker-server
 docker pull datalust/seq:$SeqDockerTag
 & dotnet run -f $framework -- --docker-server --docker-tag=$SeqDockerTag
 if ($LASTEXITCODE -ne 0)
 { 
 cd ../..
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Support alert create/update/remove/enable/disable in the CLI#475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

KodrAus
merged 10 commits into

from

Jul 24, 2026
 Merged


Support alert create/update/remove/enable/disable in the CLI
#475
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
3b7d061

Initial Alert CLI implementation


amannix-ro Jul 13, 2026
5e1d571

update CLI args for alert creation


amannix-ro Jul 14, 2026
1d1be45

move aliased column parser into a dedicated utility


amannix-ro Jul 14, 2026
ff0573b

use preview container on Linux for now


amannix-ro Jul 14, 2026
a32b028

simplify alias expression parser and container tag passing


amannix-ro Jul 14, 2026
9339d5a

add alert enable/disable commands


amannix-ro Jul 14, 2026
77633b4

cleanup and refactoring based on review


KodrAus Jul 15, 2026
ad19b36

document default notification level


KodrAus Jul 24, 2026
db11f48

Merge branch 'dev' of https://github.com/datalust/seqcli into feat/al…


KodrAus Jul 24, 2026
d68bfdb

use 2026.1 release container


KodrAus Jul 24, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


3 changes: 2 additions & 1 deletion
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -65,6 +65,7 @@ jobs:
 DOTNET_CLI_TELEMETRY_OPTOUT: true
 DOCKER_USER: ${{ secrets.DOCKER_USER }}
 DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
 SEQ_DOCKER_TAG: 2026.1
 shell: pwsh
 run: |
 ./build/Build.Linux.ps1
 ./build/Build.Linux.ps1 -SeqDockerTag $env:SEQ_DOCKER_TAG

144 changes: 144 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -120,6 +120,13 @@ seqcli help apikey

Available commands:

 - `alert`
 - [`alert create`](#alert-create) &mdash; Create an alert.
 - [`alert disable`](#alert-disable) &mdash; Disable one or more alerts.
 - [`alert enable`](#alert-enable) &mdash; Enable one or more alerts.
 - [`alert list`](#alert-list) &mdash; List alerts.
 - [`alert remove`](#alert-remove) &mdash; Remove an alert from the server.
 - [`alert update`](#alert-update) &mdash; Update an existing alert.
 - `apikey`
 - [`apikey create`](#apikey-create) &mdash; Create an API key for automation or ingestion.
 - [`apikey list`](#apikey-list) &mdash; List available API keys.
Expand DownExpand Up@@ -221,6 +228,143 @@ Available commands:
 - [`workspace remove`](#workspace-remove) &mdash; Remove a workspace from the server.
 - [`workspace update`](#workspace-update) &mdash; Update an existing workspace.

### `alert create`

Create an alert.

Example:

```
seqcli alert create -t 'Too many errors' --select "count(*) as errors" --from stream --signal signal-m33302 --where "@Level = 'Error'" --window 5m --having "errors > 10" --notification-level Error --suppression-time 10m
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | A title for the alert |
| `--description=VALUE` | A description for the alert |
| `--from=VALUE` | The data source the alert queries; either `stream` (the default) or `series` |
| `--signal=VALUE` | A signal expression limiting the alert's input, for example `signal-1` or `signal-1,signal-2` |
| `--lateral=VALUE` | A lateral join over a set-valued function applied to the data source, in the form `<setFunctionCall> as <alias>`, for example `unnest(http.server.request.duration.buckets) as bucket`; this argument can be used multiple times |
| `--where=VALUE` | A predicate that selects the events the alert will consider |
| `--select=VALUE` | A measurement the alert condition will test, for example `count(*) as errors`; this argument can be used multiple times |
| `--group-by=VALUE` | An expression to group measurements by, for example `ServiceName` or `ServiceName ci as service`; the `ci` modifier makes the grouping case-insensitive; this argument can be used multiple times |
| `--window=VALUE` | The measurement window over which the alert condition is evaluated, as a duration, for example `1m` or `1h` |
| `--having=VALUE` | The alert condition; a predicate over the grouped measurements, for example `errors > 10` |
| `--notification-level=VALUE` | The level of the notifications raised by the alert, for example `Warning` or `Error` |
| `--suppression-time=VALUE` | A duration for which notifications are suppressed after the alert triggers, for example `10m` or `1h` |
| `--notification-app=VALUE` | The id of an app instance that will be notified when the alert triggers; this argument can be used multiple times |
| `--protected` | Specify that the alert is editable only by administrators |
| `--disabled` | Create the alert in a disabled state; disabled alerts are not processed and do not send notifications |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert disable`

Disable one or more alerts.

Example:

```
seqcli alert disable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to disable |
| `-i`, `--id=VALUE` | The id of a single alert to disable |
| `-o`, `--owner=VALUE` | The id of the user to disable alerts for; by default, shared alerts are disabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert enable`

Enable one or more alerts.

Example:

```
seqcli alert enable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to enable |
| `-i`, `--id=VALUE` | The id of a single alert to enable |
| `-o`, `--owner=VALUE` | The id of the user to enable alerts for; by default, shared alerts are enabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert list`

List alerts.

Example:

```
seqcli alert list
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to list |
| `-i`, `--id=VALUE` | The id of a single alert to list |
| `-o`, `--owner=VALUE` | The id of the user to list alerts for; by default, shared alerts are listed |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |

### `alert remove`

Remove an alert from the server.

Example:

```
seqcli alert remove -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to remove |
| `-i`, `--id=VALUE` | The id of a single alert to remove |
| `-o`, `--owner=VALUE` | The id of the user to remove alerts for; by default, shared alerts are removed |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert update`

Update an existing alert.

Example:

```
seqcli alert update --json '{...}'
```

| Option | Description |
| ------ | ----------- |
| `--json=VALUE` | The updated alert in JSON format; this can be produced using `seqcli alert list --json` |
| `--json-stdin` | Read the updated alert as JSON from `STDIN` |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `apikey create`

Create an API key for automation or ingestion.
Expand Down

8 changes: 6 additions & 2 deletions
build/Build.Linux.ps1

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
param(
 [string] $SeqDockerTag = "latest"
)

Push-Location $PSScriptRoot/../

. ./build/Build.Common.ps1
Expand All@@ -23,8 +27,8 @@ function Execute-Tests
 if ($LASTEXITCODE -ne 0) { exit 1 }

 cd ./test/SeqCli.EndToEnd/
 docker pull datalust/seq:latest
 & dotnet run -f $framework -- --docker-server
 docker pull datalust/seq:$SeqDockerTag
 & dotnet run -f $framework -- --docker-server --docker-tag=$SeqDockerTag
 if ($LASTEXITCODE -ne 0)
 { 
 cd ../..
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Support alert create/update/remove/enable/disable in the CLI#475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

KodrAus
merged 10 commits into

from

Jul 24, 2026
 Merged


Support alert create/update/remove/enable/disable in the CLI
#475
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
3b7d061

Initial Alert CLI implementation


amannix-ro Jul 13, 2026
5e1d571

update CLI args for alert creation


amannix-ro Jul 14, 2026
1d1be45

move aliased column parser into a dedicated utility


amannix-ro Jul 14, 2026
ff0573b

use preview container on Linux for now


amannix-ro Jul 14, 2026
a32b028

simplify alias expression parser and container tag passing


amannix-ro Jul 14, 2026
9339d5a

add alert enable/disable commands


amannix-ro Jul 14, 2026
77633b4

cleanup and refactoring based on review


KodrAus Jul 15, 2026
ad19b36

document default notification level


KodrAus Jul 24, 2026
db11f48

Merge branch 'dev' of https://github.com/datalust/seqcli into feat/al…


KodrAus Jul 24, 2026
d68bfdb

use 2026.1 release container


KodrAus Jul 24, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


3 changes: 2 additions & 1 deletion
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -65,6 +65,7 @@ jobs:
 DOTNET_CLI_TELEMETRY_OPTOUT: true
 DOCKER_USER: ${{ secrets.DOCKER_USER }}
 DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
 SEQ_DOCKER_TAG: 2026.1
 shell: pwsh
 run: |
 ./build/Build.Linux.ps1
 ./build/Build.Linux.ps1 -SeqDockerTag $env:SEQ_DOCKER_TAG

144 changes: 144 additions & 0 deletions
README.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -120,6 +120,13 @@ seqcli help apikey

Available commands:

 - `alert`
 - [`alert create`](#alert-create) &mdash; Create an alert.
 - [`alert disable`](#alert-disable) &mdash; Disable one or more alerts.
 - [`alert enable`](#alert-enable) &mdash; Enable one or more alerts.
 - [`alert list`](#alert-list) &mdash; List alerts.
 - [`alert remove`](#alert-remove) &mdash; Remove an alert from the server.
 - [`alert update`](#alert-update) &mdash; Update an existing alert.
 - `apikey`
 - [`apikey create`](#apikey-create) &mdash; Create an API key for automation or ingestion.
 - [`apikey list`](#apikey-list) &mdash; List available API keys.
Expand DownExpand Up@@ -221,6 +228,143 @@ Available commands:
 - [`workspace remove`](#workspace-remove) &mdash; Remove a workspace from the server.
 - [`workspace update`](#workspace-update) &mdash; Update an existing workspace.

### `alert create`

Create an alert.

Example:

```
seqcli alert create -t 'Too many errors' --select "count(*) as errors" --from stream --signal signal-m33302 --where "@Level = 'Error'" --window 5m --having "errors > 10" --notification-level Error --suppression-time 10m
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | A title for the alert |
| `--description=VALUE` | A description for the alert |
| `--from=VALUE` | The data source the alert queries; either `stream` (the default) or `series` |
| `--signal=VALUE` | A signal expression limiting the alert's input, for example `signal-1` or `signal-1,signal-2` |
| `--lateral=VALUE` | A lateral join over a set-valued function applied to the data source, in the form `<setFunctionCall> as <alias>`, for example `unnest(http.server.request.duration.buckets) as bucket`; this argument can be used multiple times |
| `--where=VALUE` | A predicate that selects the events the alert will consider |
| `--select=VALUE` | A measurement the alert condition will test, for example `count(*) as errors`; this argument can be used multiple times |
| `--group-by=VALUE` | An expression to group measurements by, for example `ServiceName` or `ServiceName ci as service`; the `ci` modifier makes the grouping case-insensitive; this argument can be used multiple times |
| `--window=VALUE` | The measurement window over which the alert condition is evaluated, as a duration, for example `1m` or `1h` |
| `--having=VALUE` | The alert condition; a predicate over the grouped measurements, for example `errors > 10` |
| `--notification-level=VALUE` | The level of the notifications raised by the alert, for example `Warning` or `Error` |
| `--suppression-time=VALUE` | A duration for which notifications are suppressed after the alert triggers, for example `10m` or `1h` |
| `--notification-app=VALUE` | The id of an app instance that will be notified when the alert triggers; this argument can be used multiple times |
| `--protected` | Specify that the alert is editable only by administrators |
| `--disabled` | Create the alert in a disabled state; disabled alerts are not processed and do not send notifications |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert disable`

Disable one or more alerts.

Example:

```
seqcli alert disable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to disable |
| `-i`, `--id=VALUE` | The id of a single alert to disable |
| `-o`, `--owner=VALUE` | The id of the user to disable alerts for; by default, shared alerts are disabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert enable`

Enable one or more alerts.

Example:

```
seqcli alert enable -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to enable |
| `-i`, `--id=VALUE` | The id of a single alert to enable |
| `-o`, `--owner=VALUE` | The id of the user to enable alerts for; by default, shared alerts are enabled |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert list`

List alerts.

Example:

```
seqcli alert list
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to list |
| `-i`, `--id=VALUE` | The id of a single alert to list |
| `-o`, `--owner=VALUE` | The id of the user to list alerts for; by default, shared alerts are listed |
| `--json` | Print output in newline-delimited JSON (the default is plain text) |
| `--no-color` | Don't colorize text output |
| `--force-color` | Force redirected output to have ANSI color (unless `--no-color` is also specified) |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |

### `alert remove`

Remove an alert from the server.

Example:

```
seqcli alert remove -t 'Too many errors'
```

| Option | Description |
| ------ | ----------- |
| `-t`, `--title=VALUE` | The title of the alert(s) to remove |
| `-i`, `--id=VALUE` | The id of a single alert to remove |
| `-o`, `--owner=VALUE` | The id of the user to remove alerts for; by default, shared alerts are removed |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `alert update`

Update an existing alert.

Example:

```
seqcli alert update --json '{...}'
```

| Option | Description |
| ------ | ----------- |
| `--json=VALUE` | The updated alert in JSON format; this can be produced using `seqcli alert list --json` |
| `--json-stdin` | Read the updated alert as JSON from `STDIN` |
| `-s`, `--server=VALUE` | The URL of the Seq server; by default the `connection.serverUrl` config value will be used |
| `-a`, `--apikey=VALUE` | The API key to use when connecting to the server; by default the `connection.apiKey` config value will be used |
| `--profile=VALUE` | A connection profile to use; by default the `connection.serverUrl` and `connection.apiKey` config values will be used |
| `--storage=VALUE` | The folder where `SeqCli.json` and other data will be stored; falls back to `SEQCLI_STORAGE_PATH` from the environment, then the `seqcli forwarder` service's configured storage path (Windows only), then the current user's home directory |

### `apikey create`

Create an API key for automation or ingestion.
Expand Down

8 changes: 6 additions & 2 deletions
build/Build.Linux.ps1

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
param(
 [string] $SeqDockerTag = "latest"
)

Push-Location $PSScriptRoot/../

. ./build/Build.Common.ps1
Expand All@@ -23,8 +27,8 @@ function Execute-Tests
 if ($LASTEXITCODE -ne 0) { exit 1 }

 cd ./test/SeqCli.EndToEnd/
 docker pull datalust/seq:latest
 & dotnet run -f $framework -- --docker-server
 docker pull datalust/seq:$SeqDockerTag
 & dotnet run -f $framework -- --docker-server --docker-tag=$SeqDockerTag
 if ($LASTEXITCODE -ne 0)
 { 
 cd ../..
Expand Down
Loading