Compact Log Event Format Tool

The clef command-line tool reads and processes the newline-delimited JSON streams produced by Serilog.Formatting.Compact and other sources.

What does CLEF look like?

CLEF is a very simple, compact JSON event format with standardized fields for timestamps, messages, levels and so-on.

{"@t":"2017-05-09T01:23:45.67890Z","@mt":"Starting up","MachineName":"web-53a889fe"}

Reading CLEF files

The default action, given a CLEF file, will be to pretty-print it in text format to the console.

> clef -i log-20170509.clef
[2017-05-09T01:23:45.67890Z INF] Starting up
[2017-05-09T01:23:45.96950Z INF] Checking for updates to version 123.4
...

The tool also accepts events on STDIN:

> cat log-20170509.clef | clef
...

Filtering

Expressions using the Serilog.Filters.Expressions syntax can be specified to filter the stream:

> clef -i log-20170509.clef --filter="Version > 100"
[2017-05-09T01:23:45.96950Z INF] Checking for updates to version 123.4

Formats

Output will be plain text unless another format is specified.

Write the output in JSON format using --format-json:

> clef -i log-20170509.clef --format-json
{"@t":"2017-05-09T01:23:45.67890Z","@mt":"Starting up"}
...

Control the output text format using --format-template:

> clef -i log-20170509.clef --format-template="{Message}{NewLine}"
Starting up
...

Outputs

Output will be written to STDOUT unless another destination is specified.

Write output to a file with -o:

> clef -i log-20170509.clef -o log-20170509.txt

Send the output to Seq by specifying a server URL and optional API key:

> clef -i log-20170509.clef --out-seq="https://seq.example.com" --out-seq-apikey="1234567890"

Enrichment

Events can be enriched with additional properties by specifying them using the -p switch:

> clef -i log-20170509.clef -p CustomerId=C123 -p Environment=Support [...]