Systems, methods, and apparatus for monitoring flow of data traffic are described. For each of a plurality of transfer units from a data stream (e.g., messages from a message queue), a value of a first field of the transfer unit is mapped to a corresponding counter in random-access memory and the counter is updated. Counter values are periodically copied to a user-accessible region. In one example, message field values are obtained from database log files. In another example, message field values are obtained via an interface called by a database management system.