Log forwarding not matching logs from text fields due to escape chars being added in query post configuration- Aria operations for logs

Products

• VMware Aria Suite

Issue/Introduction

A Log forwarding destination has been setup, but no logs are getting forward. Issue seems likely due to the escape chars that Aria Operations for Logs add after configuration when checked with "Run in Explorer Log page" feature.

In "Explorer Logs" page log events can be found and matched using the regex.

Environment

Aria operations for logs 8.x

Cause

Log forwarding filter does not take regex as input, however Explore logs page does take regex as input.

Resolution

Do not use Regex in the log forwarding filter. Simply add an asterisk  (*) before and after the string you want to match. 

For example:

To search string <Privilege check failed>  just apply filter "*Privilege check failed*"

You can then see the correct logs being picked in 'Explore logs' page.