Extracted fields are missing in ingested events

Products

• VMware Aria Suite

Issue/Introduction

In Aria Operations for Logs, in Explore Logs, some of the following extracted fields are missing in ingested events.

• vmw_vcenter
• vmw_datacenter
• vmw_cluster

Environment

Aria Operations for Logs 8.x

Cause

• The vmw_cluster, vmw_datacenter, vmw_host, vmw_object_id, vmw_vcenter, vmw_vcenter_id fields come from the integration with Aria Operations.
• The vmw_vr_ops_appname, vmw_vr_ops_clustername, vmw_vr_ops_clusterrole, vmw_vr_ops_hostname, vmw_vr_ops_logtype, vmw_vr_ops_nodename, vmw_product fields are ingested by the Operations for Logs agent from Aria Operations appliances via the log forwarding feature.

Resolution

In Aria Operations for Logs, configure the Aria Operations integration.  Once the integration is successful, the missing fields will be ingested and displayed on the events.

Note:
If the Aria Operations integration already exists in Aria Operations for Logs but the fields are not being ingested, delete and re-add the integration.