Datalust Seq Integration via API

Purpose

This guide explains how to generate an API Key in your self-hosted Datalust Seq server and how to use it in Logsign USO to ingest Seq structured application log events for security analytics and forensic purposes.

Seq is a self-hosted structured log server (there is no Datalust cloud/SaaS offering documented at the time of writing). It exposes its stored events through a REST HTTP API rather than syslog. This API poller is the supported way to bring Seq event data into Logsign USO.

Prerequisites

You need access to a Seq server (self-hosted, e.g. Windows, Docker, Kubernetes, or Azure deployment) with permission to create API Keys. System-wide keys are created from Settings > API Keys and can be granted any permission; personal keys are created from the user menu (your username > API Keys) and only inherit the permissions of the account that created them.

The key used by Logsign only needs to be able to read events, so a key with the Read permission is sufficient. Logsign never writes to or ingests data into Seq, so higher permission levels (Write, Project, Organization, System) are not required.

Step 1: Identify Your Seq Server Address

Seq is self-hosted, so the address is whatever your organization configured when Seq was installed, for example http://seq.yourcompany.local:5341 or https://seq.yourcompany.local if it sits behind a reverse proxy with TLS. Confirm the scheme (http or https), hostname, and port with whoever administers your Seq installation; the default HTTP API port varies by deployment method (commonly 5341 for the standard Windows/Docker install, or 80/443 if placed behind IIS or another reverse proxy). This was not verified against a live Seq instance as part of this integration; confirm the exact port with your Seq administrator before configuring Logsign.

Step 2: Create an API Key in the Seq Console

1. Sign in to your Seq server's web interface.
2. For a system-wide key, go to Settings > API Keys. For a personal key tied to your own account, use (your username) > API Keys instead.
3. Click Add API Key (labelled "Add API key" in some Seq versions).
4. Enter a name that identifies the key later (for example, "Logsign USO integration").
5. Assign the Read permission to the key. Read access is enough for Logsign to query events; do not grant Ingest, Write, Project, Organization, or System unless you have another reason to.
6. Save the key. Seq will display the generated token once; copy it and store it somewhere safe immediately. Afterwards, only a short prefix of the key is shown in the UI (for identification purposes), and the full value cannot be retrieved again. If you lose it, generate a new key.

Step 3: Configure the Integration in Logsign USO

After obtaining your Seq server address and API Key, log in to Logsign USO and add a new Datalust Seq data source. You will be asked for:

Logsign sends the API Key on every request using the X-Seq-ApiKey HTTP header, which is Seq's documented API key authentication mechanism (an alternative documented method is to pass the key in the query string, but Logsign uses the header form). Logsign then periodically queries Seq's events endpoint (GET /api/events/signal) for new events, using each event's Timestamp field as the sync cursor, and normalizes each event into a Logsign record.

Notes and Limits

• Seq is a self-hosted product only. If your organization does not run its own Seq server, this integration does not apply; there is no equivalent Datalust-hosted cloud service to connect to instead.
• The events endpoint accepts a signal query parameter to restrict results to a saved Seq signal (a named filter), but the current Logsign poller does not expose a signal/filter configuration field; it retrieves all events visible to the API Key, unfiltered.
• Event categorization into Logsign's Context/Type/SubType fields currently always defaults to Security / Other / Info for every Seq event, regardless of the event's actual Seq Level (Information, Warning, Error, Fatal, etc.). This is a known limitation in the current poller implementation and has been flagged internally for a future fix; it does not affect whether events are collected, only how they are categorized once ingested.
• Because Seq's free-form Properties array varies entirely by the application that logged the event, there is no single fixed field mapping beyond the standard event fields (Timestamp, Level, Id, MessageTemplate/RenderedMessage, Exception). Each named property is preserved as its own field (suffixed Properties) so it remains searchable in Logsign, but no per-application semantic mapping is applied.
• If your Seq server uses a self-signed or internally-issued TLS certificate, be aware that the current poller does not perform certificate validation on HTTPS connections. Confirm with your security team whether this is acceptable for your environment.
• If polling stops or logs authorization errors, check whether the API Key was deleted or rotated in the Seq console, or whether its permission was reduced below Read. Generate a fresh key with the Read permission and update the data source in Logsign USO.