Skip to main content
Version: User Guide 6.5

Report Example: Simple Counters

This syslog report template provides an example of how to count syslog messages containing specific keywords.

REPORT GOAL

We need to count the messages containing Keyword1, Keyword2, etc. separately.

The initial step is to create a new template, specifying its name and optional description.

Pre SQL Commands​

The initialization (Pre) commands create a table for the counters and set them all to zero:

CREATE TABLE Counters (Name TEXT PRIMARY KEY, Value INTEGER);

INSERT INTO Counters (Name, Value) VALUES
  ('Keyword1', 0),
  ('Keyword2', 0);

Commands​

For each keyword, add a counter increment command:

UPDATE Counters SET Value = Value + 1 WHERE Name = 'Keyword1';

This command will be executed for all messages that match the filter:

{MESSAGE} CONTAINS "Keyword1"

Post SQL Commands​

All calculations are performed during report generation, so finalizing (Post) commands are not required.

Output Filename​

The report's creation timestamp will create a unique file name:

Counters-{GENERATED_S|%Y-%m-%dT%H-%M-%S}.html

Output Directory​

Leaving the target directory empty will prompt you to enter the output directory each time the report is generated.

Output HTML​

Here is a simple HTML that displays the counters:

<!DOCTYPE html>
<html lang="en">
  <body>
    <ul>
      <li>Keyword1: {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword1';}}{0}{{END}}</li>
      <li>Keyword2: {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword2';}}{0}{{END}}</li>
    </ul>
  </body>
</html>

You can enhance the template by including titles and the time period:

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <title>Syslog report: Counters</title>
  </head>
  <body>
    <h1>Syslog report: Counters</h1>
    <p>{FROM_S|%F %T} - {TO_S|%F %T}</p>
    <ul>
      <li>Keyword1: {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword1';}}{0}{{END}}</li>
      <li>Keyword2: {{EXECUTE SELECT Value FROM Counters WHERE Name='Keyword2';}}{0}{{END}}</li>
    </ul>
  </body>
</html>

Results​

You will end up with something like this: Template editor shows the result report template configuration

Download Template​

You can download this report example (simple-counters.report.json) and import it into Syslog Watcher Manager.