Log Forwarding is not sending events when correctly configured.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Log Forwarding is configured correctly but events are not being sent.

• Using the TEST button sends an event to the destination confirming configuration is correct.
• When clicking the 'Run in Explore Logs page' the query returns events as expected.

Environment

Aria Operations for Logs 8.x

Cause

When using Run in Explore Logs page option, Aria Operations for Logs does not use the exact query but formats a regex version of it instead.  The results of the regex version of the query may show results that the Log Forwarding query is not getting.

Resolution

1. From the Explore Logs page, form a query that includes 'contains' and/or 'does not contain' values to more accurately test the Log Forwarding query.
2. When using Log Forwarding matches queries you must include wild cards before, after, or both to capture the proper events.
3. Wild card expressions can be used in both Log Forwarding and Explore Logs but must be written differently.  Example of the same query:
   1. In Log Forwarding:  text matches *text1*
   2. In Explore Logs: text contains text1*