Report Templates

A report template defines what a report collects and what it writes: SQL commands that fill an in-memory database, and the text or HTML of the output file. See How a Report Is Built for the order in which the parts run.

Templates are saved in syslog storage, so every user of the storage shares them. The installation also includes read-only templates, listed as Installation.

Report Templates Window

In the Messages section of the main toolbar, click Reports Reports → Report templates Manage Report Templates…​

Add a Template

  1. Click Create New, or select a template and click Duplicate to start from a copy.

  2. Fill in the template settings.

  3. Click Create.

Name is required and must be unique in syslog storage. To change an Installation template, duplicate it and edit the copy.

Edit a Template

Select a Syslog Storage template, click Edit…​, change the settings, and click Apply.

Scheduled reports find their template by name when they run. If you rename or delete a template, its scheduled reports end with Error.

Delete a Template

Select a Syslog Storage template, click Delete, and confirm. Installation templates cannot be deleted.

Template Settings

Collecting Data

Initialization (SQL commands)

Runs once, before the first message. Create tables, indexes, and triggers here, and insert starting rows.

These fields are replaced before the SQL runs:

  • {FROM} and {TO} — start and end of the message range, in server time. Without a modifier the format is 2026-10-10T08:00:00; add a date/time modifier after | for another format, for example {FROM|%Y-%m-%d %H:%M:%S}.

  • {SAMPLING_INTERVAL} — a time step that suits the length of the range, as an SQLite date modifier: +1 day (more than 5 days), +01:00:00 (more than 2 hours), +00:01:00 (more than 2 minutes), or +00:00:01.

To compare times in SQL, use them as numbers: {FROM|%Q} and {TO|%Q} here, and {RECEIVED|%Q} in For Each Message. All three are server time in microseconds, rounded down to whole seconds, so you can compare them directly (see %Q).

Example:

CREATE TABLE Counters (Name TEXT PRIMARY KEY, Value INTEGER);
INSERT INTO Counters (Name, Value) VALUES ('Keyword1', 0);

For Each Message

Click Add Commands to add a command. Commands run in list order; use the buttons next to a command to delete it or move it up or down.

Setting Description

SQL Commands

SQL to run for each message that passes Execute for. Can include message fields. Apply EscSQL to values taken from syslog text.

Execute for

Optional filter expression. Blank means all messages that passed the request filter.

{SAMPLED_TIMESTAMP} in the SQL becomes the message’s {RECEIVED} time rounded down to the sampling step (see {SAMPLING_INTERVAL} above), for example 2026-10-10T08:00:00 with a 1-hour step. Use it to count messages per hour or per day.

Finalization (SQL commands)

Runs once, after the last message. Combine and sort the collected rows for output.

These fields are replaced before the SQL runs: {FROM}, {TO}, {SAMPLING_INTERVAL}, {N} (number of messages that passed the request filter), and {BYTES} (total size of those messages).

Output File

Filename template

Name of the report file, for example:

Counters-{GENERATED|%Y-%m-%dT%H-%M-%S}.html

{GENERATED} is the time the report is generated; add a date/time modifier after | as above. Characters that are not allowed in Windows file names are replaced with _.

  • Generate Report Now…​ suggests this name in the save dialog.

  • Scheduled reports save the file under this name in the server’s Output folder; any folder part of the name is ignored.

Report file contents

The text or HTML of the output file. It is filled in after finalization, in this order:

  1. {{INCLUDE file}} is replaced with the contents of that file.

  2. The fields {FROM}, {TO}, {GENERATED}, {N}, {BYTES}, and {SAMPLING_INTERVAL} are replaced.

  3. Each {{EXECUTE ...}} block is replaced with query results.

Because includes come first, an included file can contain fields and {{EXECUTE}} blocks too.

To query the in-memory database:

{{EXECUTE SELECT Name, Value FROM Counters ORDER BY Value DESC;}}
  <tr><td>{0}</td><td>{1}</td></tr>
{{END}}

The text between the query and {{END}} is repeated for each result row. {0}, {1}, … are the columns of the row, counted from 0. The values are escaped automatically; see Escaping in the Report File. If a query fails, that block and all blocks after it are left in the file unprocessed.

To include a file, give its name or a path relative to an include folder:

{{INCLUDE header.html}}

Syslog Watcher looks for the file in the ReportResources folder in the installation directory, then in the Include folders of the Generate Report window or, for scheduled reports, in the server’s Include folders. If the file is not found, the {{INCLUDE}} is removed.

Escaping in the Report File

When an {{EXECUTE}} block prints the values {0}, {1}, …, it escapes them automatically:

  • &, <, >, ", and ' become HTML codes, as with the EscHTML modifier;

  • each \ is doubled, so a value is also safe inside a JavaScript string, for example '{0}' in a chart script.

In the SQL commands, escape values for SQL only, as the Installation templates do:

INSERT INTO Originators (OrigID, OrigName) VALUES ('{ORIGINATOR_ID|EscSQL}', '{ORIGINATOR_NAME|EscSQL}');

Do not add EscHTML there. The value would be escaped twice, and readers would see the codes instead of the characters: <b> is stored as &lt;b&gt;, printed as &amp;lt;b&amp;gt;, and shown in the browser as &lt;b&gt;.

The same escaping applies to text reports, so a text file shows & as &amp; and \ as \\.

Related Topics