Extracted fields are missing in ingested events

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In Aria Operations for Logs, in Explore Logs, some of the following extracted fields are missing in ingested events.

• vmw_vcenter
• vmw_datacenter
• vmw_cluster

Environment

Aria Operations for Logs 8.x

Cause

• The vmw_cluster, vmw_datacenter, vmw_host, vmw_object_id, vmw_vcenter, vmw_vcenter_id fields come from the integration with Aria Operations.
• The vmw_vr_ops_appname, vmw_vr_ops_clustername, vmw_vr_ops_clusterrole, vmw_vr_ops_hostname, vmw_vr_ops_logtype, vmw_vr_ops_nodename, vmw_product fields are ingested by the Operations for Logs agent from Aria Operations appliances via the log forwarding feature.

Resolution

• In Aria Operations for Logs, configure the Aria Operations integration.  Once the integration is successful, the missing fields will be ingested and displayed on the events.
• If the Aria Operations integration already exists in Aria Operations for Logs, please follow the steps below to refresh the Aria Operations Integration configuration
  
   Edit the existing Aria Operations integration configuration.
   Temporarily uncheck both "Metric Collection" and "Alert Integration" options.
   Save the configuration to ensure the changes are applied and the integration configuration gets refreshed.
   Re-edit the same integration and Re-check "Metric Collection" and "Alert Integration" options.
   Save the configuration again.

Note:
If the issue persists after refreshing the configuration, please delete and re-add the integration.