Export to Files

Export to Files writes matching syslog messages to text files. Typical uses: a feed for another product that only reads files, a simple extra copy of selected logs, or per-originator drop folders.

The feature reads messages from syslog storage, not from the collector as they arrive. The collector keeps writing to storage even if export is slow, suspended, or failing — storage acts as a large buffer so collection is not blocked by the file exporter.

Syslog Watcher — Export to Files feature

Edit Feature: Export to Files

Common Feature, Data Fields, and Filter settings are described in Managing Features. This page covers the File Exporter section.

File Exporter

Setting Description

Setting	Description
Target folder	Root directory for output. Required. Created files are under this path (plus Subfolders template if set). The Syslog Watcher Server service account must be able to write here.
Subfolders template	Optional. Format string for subdirectory names. Example: `{ORIGINATOR_ID\|EscFNAME}` — one folder per originator, with characters that are illegal in Windows file names replaced.
Filename template	Required. Format string for the file name. Example: `{RECEIVED\|%Y-%m-%d}.txt` (one file per calendar day).
File header	Optional. Literal text written once at the start of each new file. Line endings match the Line endings setting. Existing files on disk are not changed.
Limit file size	When enabled, start a new file when Maximum size (KB) is reached. When off, size is unlimited (rotation is then only from the filename template). See Limit File Size and File Names.
Line endings	Line ending appended after each formatted line (Windows or Unix).
Max open files	Performance tuning: how many files the server keeps open at once. The default is suitable for most cases.
Close idle files after (s)	Performance tuning: close a file that has not been written for this many seconds. The default is suitable for most cases.

Target folder

Root directory for output. Required. Created files are under this path (plus Subfolders template if set). The Syslog Watcher Server service account must be able to write here.

Subfolders template

Optional. Format string for subdirectory names.

Example: {ORIGINATOR_ID|EscFNAME} — one folder per originator, with characters that are illegal in Windows file names replaced.

Filename template

Required. Format string for the file name.

Example: {RECEIVED|%Y-%m-%d}.txt (one file per calendar day).

File header

Optional. Literal text written once at the start of each new file. Line endings match the Line endings setting. Existing files on disk are not changed.

Limit file size

When enabled, start a new file when Maximum size (KB) is reached. When off, size is unlimited (rotation is then only from the filename template). See Limit File Size and File Names.

Line endings

Line ending appended after each formatted line (Windows or Unix).

Max open files

Performance tuning: how many files the server keeps open at once. The default is suitable for most cases.

Close idle files after (s)

Performance tuning: close a file that has not been written for this many seconds. The default is suitable for most cases.

Templates use message fields and date/time modifiers (for example {RECEIVED|%Y-%m-%d}).

Date parts from {RECEIVED} use the storage time zone, not UTC and not the originator’s clock. Use {RECEIVED_UTC} when the path must follow UTC days.

Subfolder and Filename Examples

Paths are under Target folder. Use EscFNAME on any field that can contain characters illegal in Windows names. / or \ in Subfolders template creates nested directories.

One file per day (all originators)

Subfolders:  (none)
Filename:    {RECEIVED|%Y-%m-%d}.txt
Result path: C:\Integrations\SyslogWatcher\2026-08-25.txt

One folder per originator, daily files

Subfolders:  {ORIGINATOR_ID|EscFNAME}
Filename:    {RECEIVED|%Y-%m-%d}.txt
Result path: C:\Integrations\SyslogWatcher\firewall-01\2026-08-25.txt

Year/month folders, one file per day

Subfolders:  {RECEIVED|%Y}/{RECEIVED|%m}
Filename:    {RECEIVED|%d}.txt
Result path: C:\Integrations\SyslogWatcher\2026\08\25.txt

One folder per originator, one file per severity

Subfolders:  {ORIGINATOR_NAME|EscFNAME}
Filename:    {SEVERITY}.txt
Result path: C:\Integrations\SyslogWatcher\Core Firewall\Error.txt

File Contents

Simple mode uses a single Message to text template.

Example: <{PRIORITY}>{RAW_MESSAGE} — the message as received, including the syslog priority prefix.

Click Switch to Advanced Mode to define several File Content Sections. Each section has:

a section filter (blank = all messages that already passed the feature filter)
a Message to text template

Every matching section’s template is applied, in listed order, and each match is written as a separate line. If no section matches, nothing is written for that message.

The usual reason for several sections is originators that do not share one output format. Filter each section by originator and give it the template the downstream reader expects — typical when messages must be reformatted and vendors (or devices) emit different layouts.

Several sections also cover a composite output: optional parts that should appear only under certain conditions. Add a section per part, with a filter for when that part should be written; every matching part is included.

Formatted Files

Each matching section writes one text line, so Message to text can follow whatever line-oriented layout a consumer expects. The examples below are CSV and JSON Lines; any other text format works the same way. Use escape modifiers so commas, quotes, and line breaks in the syslog text do not break the layout.

Example: CSV

Quote text fields and apply EscCSV (doubles embedded quotes). Put column names in File header so each new file starts with a header line:

Filename:        {RECEIVED|%Y-%m-%d}.csv
File header:     "received","originator","severity","message"
Message to text: "{RECEIVED|%Y-%m-%dT%H:%M:%S%Ez}","{ORIGINATOR_ID|EscCSV}","{SEVERITY}","{MESSAGE|EscCSV}"

File header is written only when the file is new (empty). A file that already has content is left as-is. If Limit file size starts a new part, that part also gets the header.

A newline in the message still spans extra physical lines, even inside quotes. The JSON Lines example below stays one physical line per message.

Example: JSON Lines

Apply EscJSON inside JSON string values so quotes and line breaks stay on one line:

Filename:        {RECEIVED|%Y-%m-%d}.jsonl
Message to text: {{"received":"{RECEIVED|%Y-%m-%dT%H:%M:%S%Ez}","originator":"{ORIGINATOR_ID|EscJSON}","severity":"{SEVERITY}","message":"{MESSAGE|EscJSON}"}}

In Message to text, a single { starts a syslog field, not a JSON object. Write a literal brace as {{ or }} so the JSON object’s outer braces are copied to the file.

If originators need different layouts, use File Content Sections as described above.

Limit File Size and File Names

The output path is Target folder + Subfolders template + Filename template. Each template is evaluated per message, then the file is appended.

With Limit file size off, the rendered filename is used as-is. A daily template {RECEIVED|%Y-%m-%d}.txt produces one file per calendar day, for example:

C:\Integrations\SyslogWatcher\2026-08-25.txt

With Limit file size on, the exporter splits that logical file when Maximum size (KB) is reached. It appends a three-digit suffix before the extension: -000, then -001, -002, and so on:

C:\Integrations\SyslogWatcher\2026-08-25-000.txt
C:\Integrations\SyslogWatcher\2026-08-25-001.txt
C:\Integrations\SyslogWatcher\2026-08-25-002.txt

The suffix applies to each distinct path from the templates (for example one sequence per originator folder). After a restart, export continues in the highest existing suffix for that path. Each new part is an empty file, so File header is written at the start of every part (if set).

Notes

If the target folder is on a remote share, the Syslog Watcher Server service account (often Local System) must have share and NTFS write access, or run the service under an account that does.