Managing Features

Create and manage features from Server Features.

On the Server toolbar, click features Features.

Syslog Watcher — Server Features
Server Features

The list is grouped by Active / Inactive. Columns:

Column Description

State

Processing (running), Suspended (idle, ready for resume), or — (inactive).

Name

Feature name.

Type

What this feature does with matching messages (Feature Types).

Description

Optional comment from the feature editor.

Adding a Feature

  1. Click Add Feature…​.

  2. Choose the type.

  3. Edit the common sections and the type-specific exporter (see below).

  4. Click Create.

The new feature is saved suspended. Resume it when collection should start reading storage.

Configuring a Feature

Select a feature and click Configure…​ (or double-click the row).

Without permission to change features, the editor opens as View…​ (Read Only).

Every feature editor has the same three sections at the top, then a type-specific section.

Feature

Setting Description

Name

Required. Shown on the Server Features list and the Server tab.

Description

Optional. Shown in the Server Features list.

Active

Turns the feature on and off.

Active is not the same as Suspended. Turning Active off disables the feature completely and deletes its current state. Suspend only pauses processing; the feature stays idle and ready to resume.

Data Fields (Optional)

Leave this collapsed unless templates or the filter need extra fields from the message body.

Setting Description

Regex for extracting fields

Regular expression with named captures: (?<FIELD_NAME>…​). Captured names become fields such as {FIELD_NAME}.

Fields

Additional named fields whose value is a format string (text plus other fields).

Field Collections

Apply a stored field-collection regex (keyword selector) and expose the result as ACCESS_NAME.FIELD_NAME.

Extracted fields are available to the feature filter and to exporter templates. See Field Extraction for extractor and Fields examples.

Filter

The feature filter selects which syslog messages the exporter sees. It is evaluated after messages are in storage, not on the collector’s incoming path. See Message Filter for the same block on views and reports.

When severity is all severity levels, originators is ALL ORIGINATORS, and the expression is blank, the caption shows [OFF].

Setting Description

Severity level

Inclusive range of syslog severities ((0) Emergency … (7) Debug). Indexed — keep the range narrow.

Originators

ALL ORIGINATORS, <select originators> (a selected set), or Group: followed by an originator group name. Indexed.

Filter expression

Optional complex filter. Blank is shown as ALL MESSAGES (after severity and originators).

The section menu on the caption: Copy, Paste, Export to File…​, Import from File…​ (.filter / .json), Reset Filter.

Narrow by severity and originators first. Those predicates use storage indexes.

Type-specific exporters can add another per-section filter (advanced mode). A message must pass the feature filter and the section filter to use that section.

Deleting a Feature

Select the feature → Delete → confirm.

If the feature will be needed later, turn Active off instead of deleting it.

Suspending a Feature

Select the feature → Suspend.

The feature keeps the last processed timepoint. Resume can continue from there or start at another time.

Resuming a Feature

Resume is a drop-down. The items depend on whether a state file already exists for that feature.

Command What it does

From Suspension Time

Process the backlog written to storage while the feature was suspended.

From Now / From Now (Skip Messages)

Only messages collected after the resume are processed.

From Date/Time…​ / From Date/Time (Reset)…​

Messages from the selected date and time onward are processed, including those already in storage.

Import / Export Configuration

Each feature editor has Import / Export (not the Server Features list):

  • Export to File…​ — write the feature configuration to .feature or .json.

  • Import from File…​ — load a .feature or .json file into the editor.

Export does not require Apply first; it writes what is on screen. After import, review the settings and click Create or Apply.

Import is type-specific: open the editor for the same type as the file.

Exported files can contain ODBC connection strings, host names, and secret references (process passwords, TLS key passwords). Treat them as sensitive. Prefer secret strings in the feature configuration instead of real private values.

Use export/import to:

  • Back up one feature before a risky edit

  • Copy a feature to another Syslog Watcher 7 installation

Related Topics