serilog / serilog-expressions

An embeddable mini-language for filtering, enriching, and formatting Serilog events, ideal for use with JSON or XML configuration.
Apache License 2.0
193 stars 17 forks source link

Functions/literals for working with `DateTime`, `DateTimeOffset`, and `TimeSpan` #72

Open warrenbuckley opened 2 years ago

warrenbuckley commented 2 years ago

Hi @nblumhardt 👋 Is it possible that Serilog.Expressions works or already supports working with Timestamp and dates?

Such as some shown in the SEQ Cheatsheet @Timestamp >= Now() - 1h to get the last log items in the last hour

Or how would you get logs between a specific range of times ? Look forward to hearing how this could be done or not.

Cheers, Warren 😄

nblumhardt commented 2 years ago

Hi @warrenbuckley 👋

Unlike Seq, this library uses DateTime/DateTimeOffset at runtime (instead of 100-nanosecond ticks), so numeric comparisons like >= don't work with these values.

A quick way to enable these today would be to add a Ticks() function:

Ticks(@t) >= Ticks(Now())

The next problem is the 1h, there's no support for this right now but adding an Hours() function would cover it:

Ticks(@t) >= Ticks(Now()) - Ticks(Hours(1))

All a bit clunky, though. I'm not sure whether DateTime comparisons are applicable enough to the core use case of this library to justify all of the implementation challenges we'd hit trying to plug them in, but worth sketching things out 🤔

warrenbuckley commented 2 years ago

OK thanks for the pointers 😄 For me consuming the library it has its use case to help with filtering/searching logs when using the raw API but for most users consuming this library to filter out logs by including or excluding with dates probably does not make sense.

I may do a draft PR so we can collaborate to at least discuss ideas and approach by writing my own functions Then you can decide if it makes sense to include it or not