Report Template: Simple Counters¶

This syslog report template shows how to count syslog messages with specific keywords.

Report Goal¶

We need to count the messages containing Keyword1, Keyword2, etc. separately.

Report Template¶

Initial step: create a new template.

Initialization (Pre Commands)¶

The initialization (Pre) commands create a table for the counters and set them all to zero:

CREATE TABLE Counters (Name TEXT PRIMARY KEY, Value INTEGER);
INSERT INTO Counters (Name, Value) VALUES
  ('Keyword1', 0),
  ('Keyword2', 0);

Data Collection (Commands)¶

For each keyword, add a counter increment command:

UPDATE Counters SET Value = Value + 1 WHERE Name = 'Keyword1';

The command has to be executed for messages that match the filter:

{MESSAGE} CONTAINS "Keyword1"

Finalization (Post Commands)¶

Finalizing (Post) commands are not required for this example.

Output Filename¶

A report timestamp creates an unique file name:

Counters-{GENERATED_S|%Y-%m-%dT%H-%M-%S}.html

Output Directory¶

Leave the target directory blank. Syslog Watcher will prompt you to enter the output directory at a generation time.

Output HTML¶

Here is a simple HTML that displays the counters:

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title>Syslog report: Counters</title>
  </head>
  <body>
    <h1>Syslog report: Counters</h1>
    <p>{FROM_S|%F %T} - {TO_S|%F %T}</p>
    <ul>
      <li>Keyword1: 
        {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword1';}}
          {0}
        {{END}}
      </li>
      <li>Keyword2: 
        {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword2';}}
          {0}
        {{END}}
      </li>
    </ul>
  </body>
</html>

Results¶

You will end up with something like this: Template editor shows the result report template configuration

Download Template¶

You can download this report example (simple-counters.report.json) and import it into Syslog Watcher Manager.