Aria Operations for Logs : Integration Static Fields for vSphere and Aria Operations Manager

Products

• VMware Aria Suite

Issue/Introduction

This article provides a list of static fields that will be available in VMware Aria Operations for Logs (formerly know as vRealize Log Insight) only when there is an integration with vSphere or VMware Aira Operations Manager.

Environment

VMware Aria Operations for Logs (formerly know as vRealize Log Insight) 

Resolution

vSphere integration is made up of two parts:

1. vCenter Server events, tasks, and alarms
2. ESXi syslog collection

vSphere integration provides metadata capabilities for the vCenter Server side only — since ESXi must abide to the syslog RFC.  When you select the "vCenter Server" checkbox, events ingested through the integration may contain the following static fields:

• vc_details 
• vc_event_type
• vc_username 

vROps integration is made up of three parts:

• Alerts
• Launch in context
• Inventory mapping — this one is always enabled with integration

Inventory mapping provides additional metadata for vSphere events — anything originating from (e.g. ESXi) or on (e.g. VMs) — that are integrated in vROps via the vCenter Server management pack. In short, if you configure the vCenter Server management pack in vROps, you configure events on vSphere components or VMs running on ESXi to point to VMware Aria Operations for Logs , and you integrate VMware Aria Operations for Logs with vROps then you will get the following static fields:

• vmw_cluster 
• vmw_datacenter
• vmw_host
• vmw_object_id
• vmw_vcenter
• vmw_vcenter_id
• vmw_vr_ops_id

Example:

Additional Information

Make sure to confirm whether the VMware Aria Operations and vSphere Integration is done properly to get the additional metadata on VMware Aria Operations for Logs