Event type specified via @i through HTTP Api has unexpected value

[bekir-ozturk]

Describe the bug Using my app, I'm sending some log events to the HTTP endpoint of my local Seq server using CLEF format. The body of a sample HTTP request is below:

{"@t":"2023-12-30T14:52:55.9321990Z","@mt":"Some player with id {playerId} has blocked the {mapName} map for {delay} seconds.","@i":"0xAB01A05B","@l":"Critical","playerId":"40302","mapName":"tundra","delay":"5.87"}

Note the part:

"@i":"0xAB01A05B"

When I go query the last ingested event in Seq, I see the following event:

{"@t":"2023-12-30T14:52:55.9321990Z","@mt":"Some player with id {playerId} has blocked the {mapName} map for {delay} seconds.","@m":"Some player with id 40302 has blocked the tundra map for 5.87 seconds.","@i":"28853026","@l":"Critical","delay":"5.87","mapName":"tundra","playerId":"40302"}

Note that the value of the @i property is different:

"@i":"28853026"

I expect the event type to have the same value that I passed in the request body.

To Reproduce Steps to reproduce the behavior:

1. Make an HTTP POST request to /api/events/raw?clef of your local Seq server.

2. Set the request body to

   {"@t":"2023-12-30T14:52:55.9321990Z","@mt":"Some player with id {playerId} has blocked the {mapName} map for {delay} seconds.","@i":"0xAB01A05B","@l":"Critical","playerId":"40302","mapName":"tundra","delay":"5.87"}

3. Go to "http://localhost:5341/#/events?range=5m" on your browser and locate the last ingested event.
4. Note that the Type is 28853026.

Expected behavior Type is expected to be 0xAB01A05B or the decimal equivalent 2869010523.

Screenshots If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

• OS: Microsoft Windows 10 Pro 10.0.19045 Build 19045
• Browser: Firefox
• Seq Version: 2023.4.10219
• Using Docker? No

Additional context Although the event type is different than what I'm sending in the request, it seems to be consistent. When I changed the event type in my app, the type in Seq has also changed, which tells me Seq uses my event type to calculate the new one perhaps?

I has a suspicion that the numbers are the same, but may have been encoded differently. I tried reinterpreting the same value in the opposite endianness, or as an unsigned integer instead of a signed one. However, I haven't been able to come up with the same number that is presented in Seq.

Finally, in the Ingestion with HTTP page, @i is listed as Event id and not Event Type. But it is expected to be a numeric value and the property name @i is used to represent the event type in other places, so I suspect this is an error in the doc page. If this is true, could the doc page be updated to say 'Event Type' instead of 'Event Id'?

Thanks!

[nblumhardt]

Hi Bekir, thanks for the heads-up. The issue is the leading 0x - Seq's expecting just the number, e.g. "@i": "AB01A05B". HTH!

[bekir-ozturk]

Thanks! I tried the decimal version, but not the hex one w/o the 0x. I'll give this a try.

Could the doc be improved to include a single example, perhaps? Or am I one of the very few who use that API?

---

Edit: I had a chance to try this. Hexadecimal value without a leading 0x works. Yay!

[nblumhardt]

Thanks for the suggestion. I've tweaked the docs in the next version, I'll look at adding a more complete example there when I can 👍