Report Template: Simple Counters

This syslog report template shows how to count syslog messages with specific keywords.

Report Goal

We need to count the messages containing Keyword1, Keyword2, etc. separately.

Report Template

Initial step: create a new template.

Initialization (Pre Commands)

The initialization (Pre) commands create a table for the counters and set them all to zero:

CREATE TABLE Counters (Name TEXT PRIMARY KEY, Value INTEGER);
INSERT INTO Counters (Name, Value) VALUES
  ('Keyword1', 0),
  ('Keyword2', 0);

Data Collection (Commands)

For each keyword, add a counter increment command:

UPDATE Counters SET Value = Value + 1 WHERE Name = 'Keyword1';

The command has to be executed for messages that match the filter:

{MESSAGE} CONTAINS "Keyword1"

Finalization (Post Commands)

Finalizing (Post) commands are not required for this example.

Output Filename

A report timestamp creates a unique file name:

Counters-{GENERATED_S|%Y-%m-%dT%H-%M-%S}.html

Output Directory

Leave the target directory blank. Syslog Watcher will prompt you to enter the output directory at a generation time.

Output HTML

Here is a simple HTML that displays the counters:

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title>Syslog report: Counters</title>
  </head>
  <body>
    <h1>Syslog report: Counters</h1>
    <p>{FROM_S|%F %T} - {TO_S|%F %T}</p>
    <ul>
      <li>Keyword1:
        {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword1';}}
          {0}
        {{END}}
      </li>
      <li>Keyword2:
        {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword2';}}
          {0}
        {{END}}
      </li>
    </ul>
  </body>
</html>

Results

You will end up with something like this:

Template editor shows the result report template configuration

Download Template

You can download simple-counters.report.json and import it into Syslog Watcher Manager.