Windows Event logs are not collected in Log Management after Fluent Bit configuration

Products

• VCF Operations

Issue/Introduction

• Fluent Bit is installed on Windows and configured to forward event logs, but the logs cannot be found in the Log Management UI.
• Fluent Bit logs reports as follows: 
  [YYYY/MM/DD hh:mm:ss.xxx] [ info] [output:http:http.0] <LOG MANAGEMENT FQDN>:9543, HTTP status=200
{"received":0,"message":"events ingested","status":"ok"}

Environment

VCF 9.1
Log Management

Cause

This issue occurs because the payload sent by Fluent Bit on Windows lacks the 'text' field, which is required for Log Management to collect logs.

Resolution

Add Rename Message text to the FILTER section of fluent-bit.conf and restart Fluent Bit service.

[FILTER]
    Name modify
    Match *
    Rename Message text