{
"name": "Advanced Counter",
"description": "Counts different variable values included into each syslog message.",
"context": {
"extractor": "",
"fields": [
{
"field": "IP",
"value": "{MESSAGE|r\/IP=(\\S+)\/}"
}
]
},
"collector": {
"cmds": [
{
"cmd": "INSERT OR IGNORE INTO Vals (Val) VALUES ('{IP|EscSQL}');\r\nUPDATE Vals SET Counter=Counter+1 WHERE Val='{IP|EscSQL}';",
"filter": ""
}
],
"cmd_pre": "CREATE TABLE Vals (Val TEXT PRIMARY KEY, Counter INTEGER DEFAULT 0);",
"cmd_post": "",
"debug_copy": ""
},
"output": {
"body": "\r\n\r\n \r\n \r\n Syslog report: Advanced Counter<\/title>\r\n <style>td { border: 1px solid black; }<\/style> \r\n <\/head>\r\n <body>\r\n <h1>Syslog report: Advanced Counter<\/h1>\r\n <p>{FROM_S|%F %T} - {TO_S|%F %T}<\/p>\r\n <table>\r\n <thead><tr><th>IP<\/th><th>Counter<\/th><\/tr><\/thead>\r\n <tbody>\r\n <tr>\r\n <td>TOTAL<\/td>\r\n <td style=\"text-align: end;\">{{EXECUTE SELECT SUM(Counter) FROM Vals;}}{0}{{END}}<\/td>\r\n <\/tr>\r\n {{EXECUTE SELECT * FROM Vals ORDER BY Counter DESC;}}\r\n <tr>\r\n <td>{0}<\/td>\r\n <td style=\"text-align: end;\">{1}<\/td>\r\n <\/tr>\r\n {{END}}\r\n <\/tbody>\r\n <\/table>\r\n <\/body>\r\n<\/html>",
"filename": "AdvCounter-{GENERATED_S|%Y-%m-%dT%H-%M-%S}.html",
"dir": ""
}
}