Fields not showing up in filters in Aria Operations for Logs

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VCF Operations

Issue/Introduction

• In Aria Operations for Logs, Configuring Log Forwarding Filters, static fields not showing up as option
  
  
• Log Management > Log Forwarding > New Destination
  
  
  
  
• Also occurs in Explore Logs filters

Environment

Aria Operations for Logs 8.x

Cause

Only standard static fields are available in the forwarding filter because it is run before post processing in Aria Operations for Logs for custom content. This is why the filters are limited to regex expression. More info can be found here: Add a VMware Aria Operations for Logs Log Forwarding Destination

Extracted fields that are custom added, are not available for use in the Log Filter and Log Forwarding Filter. 

Resolution

The field lists in Aria Operations for Logs filters are created dynamically based on logs that have been ingested. 

 

Do a search in the Explore Logs Section

1. Set up the filter for the same field with "Exists" as the condition.
   
   
   • If the field name does not autocomplete, then there are no logs ingested with data in that fieldname.
     
     
     
     
   • You can also check the Manage Fields box, on the right of the Explore Logs screen. If the field you are looking for is not there, then there have not been any logs ingested with data in that fieldname
     
     

 

Additional Information

Add a Log Filter Configuration