{"id":1783,"date":"2024-01-23T15:34:18","date_gmt":"2024-01-23T14:34:18","guid":{"rendered":"https:\/\/thomas-kopton.de\/vblog\/?p=1783"},"modified":"2024-01-23T15:37:58","modified_gmt":"2024-01-23T14:37:58","slug":"aria-operations-for-logs-fields-as-part-of-alert-title-quick-tip","status":"publish","type":"post","link":"https:\/\/thomas-kopton.de\/vblog\/?p=1783","title":{"rendered":"Aria Operations for Logs – Fields as Part of Alert Title – Quick Tip"},"content":{"rendered":"\n

As described in the official VMware Aria Operations for Logs<\/mark> (formerly know as vRealize Log Insight) documentation<\/a>, you can customize alert names by including a field in the format\u00a0${field name}<\/code>. <\/p>\n\n\n\n

For example in the following alert definition which will be triggered by VM migration operations the title will contain the name of the user who started the migration process.<\/p>\n\n\n\n

\"\"<\/a>
Figure 01: Sample alert definition containing a field.<\/em><\/figcaption><\/figure>\n\n\n\n

The following screenshot shows the email I have received after starting a VM migration in vCenter. The ${vmw_user}<\/code> field has been replaced by its value<\/mark>.<\/p>\n\n\n\n

\"\"<\/a>
Figure 02: Alert via email containing the value of the field.<\/em><\/figcaption><\/figure>\n\n\n\n

This kind of adding additional information to the alert title works pretty well in most cases but sometimes you might discover unusual behavior<\/mark> and the configured field name will not be replaced by its actual value.<\/p>\n\n\n\n

The reason for this, at least at the time of writing <\/mark>this post, is the way how Aria Operations for Logs processes the static fields. For example let us create our own static fields using Postman and push them via API as meta data together with the log message. The next picture shows a log message with some fields defined in the POST body. Please not the upper and lower case characters in names<\/mark> of the fields. <\/p>\n\n\n\n

\"\"<\/a>
Figure 03: Sending a log message including static fields via REST API.<\/em><\/figcaption><\/figure>\n\n\n\n

NOTE<\/strong><\/mark>: This is the behavior as for the time of writing this post and using Aria Operations for Logs Version\u00a08.14.1-22806512<\/mark><\/p>\n\n\n\n

The first important fact is that the names of the fields I have defined in the JSON body are all written in lower case<\/mark> after the ingestion in Aria Operations for Logs.<\/p>\n\n\n\n

\"\"<\/a>
Figure 04: Ingested log message and its fields in the log explorer.<\/em><\/figcaption><\/figure>\n\n\n\n

Let’s create an alert based on the myoperation Contains \"poweroff\"<\/code> query. In the following picture you can see that the field in the query definition is also provided containing all lower case letters.<\/p>\n\n\n\n

\"\"<\/a>
Figure 05: Alert definition without any fields in the alert name.<\/em><\/figcaption><\/figure>\n\n\n\n

This alert definition works as expected, the next time my Aria Operations for Logs has received such a log message, the alert has been triggered and I have received this email:<\/p>\n\n\n\n

\"\"<\/a>
Figure 06: Alert received – no issues.<\/em><\/figcaption><\/figure>\n\n\n\n

As I would like to see the VM name right in the alert name, I will add the corresponding myvmname<\/code> field to it:<\/p>\n\n\n\n

\"\"<\/a>
Figure 07: Alert definition with a field in the alert name – all lower case.<\/em><\/em><\/figcaption><\/figure>\n\n\n\n

This time I have received an email and to my surprise, the field was not replaced by the actual value. <\/p>\n\n\n\n

\"\"<\/a>
Figure 08: Alert received – field has not been replaced by its value.<\/em><\/figcaption><\/figure>\n\n\n\n

After few tests I have figured out that Aria Operations for Logs expects the field names in the same lower and upper case writing as they were specified in the originating log message to correctly replace them by their values in the title and btw. also in the description. The following picture shows my final alert definition including the fields myVMname<\/code> in the title and myUsername<\/code> in the description.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Figure 09: Final alert definition including fields in the alert name and alert description.<\/em><\/p>\n\n\n\n

This time the received email shows the values instead of the field names.<\/p>\n\n\n\n

\"\"<\/a>
Figure 10: Alert received – no issues – again.<\/em><\/figcaption><\/figure>\n\n\n\n

I hope it helps you create alerts that provide useful information at first glance.<\/p>\n\n\n\n

Stay<\/mark><\/strong> safe<\/mark><\/strong>.<\/p>\n\n\n\n

Thomas \u2013 https:\/\/twitter.com\/ThomasKopton<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

As described in the official VMware Aria Operations for Logs (formerly know as vRealize Log Insight) documentation, you can customize alert names by including a field in the format\u00a0${field name}. For example in the following alert definition which will be triggered by VM migration operations the title will contain the name of the user who …<\/p>\n","protected":false},"author":1,"featured_media":1809,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[78,22],"tags":[],"class_list":["post-1783","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aria-operations-for-logs","category-vrealize-log-insight"],"yoast_head":"\nAria Operations for Logs - Fields as Part of Alert Title - Quick Tip - TOMsOps<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/thomas-kopton.de\/vblog\/?p=1783\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Aria Operations for Logs - Fields as Part of Alert Title - Quick Tip - TOMsOps\" \/>\n<meta property=\"og:description\" content=\"As described in the official VMware Aria Operations for Logs (formerly know as vRealize Log Insight) documentation, you can customize alert names by including a field in the format\u00a0${field name}. For example in the following alert definition which will be triggered by VM migration operations the title will contain the name of the user who ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/thomas-kopton.de\/vblog\/?p=1783\" \/>\n<meta property=\"og:site_name\" content=\"TOMsOps\" \/>\n<meta property=\"article:published_time\" content=\"2024-01-23T14:34:18+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-01-23T14:37:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2328\" \/>\n\t<meta property=\"og:image:height\" content=\"1222\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Thomas Kopton\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Thomas Kopton\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783#article\",\"isPartOf\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783\"},\"author\":{\"name\":\"Thomas Kopton\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82\"},\"headline\":\"Aria Operations for Logs – Fields as Part of Alert Title – Quick Tip\",\"datePublished\":\"2024-01-23T14:34:18+00:00\",\"dateModified\":\"2024-01-23T14:37:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783\"},\"wordCount\":570,\"commentCount\":0,\"image\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783#primaryimage\"},\"thumbnailUrl\":\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png\",\"articleSection\":[\"Aria Operations for Logs\",\"vRealize Log Insight\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/thomas-kopton.de\/vblog\/?p=1783#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783\",\"url\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783\",\"name\":\"Aria Operations for Logs - Fields as Part of Alert Title - Quick Tip - TOMsOps\",\"isPartOf\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783#primaryimage\"},\"image\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783#primaryimage\"},\"thumbnailUrl\":\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png\",\"datePublished\":\"2024-01-23T14:34:18+00:00\",\"dateModified\":\"2024-01-23T14:37:58+00:00\",\"author\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82\"},\"breadcrumb\":{\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/thomas-kopton.de\/vblog\/?p=1783\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783#primaryimage\",\"url\":\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png\",\"contentUrl\":\"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png\",\"width\":2328,\"height\":1222},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/?p=1783#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/thomas-kopton.de\/vblog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Aria Operations for Logs – Fields as Part of Alert Title – Quick Tip\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#website\",\"url\":\"https:\/\/thomas-kopton.de\/vblog\/\",\"name\":\"TOMsOps\",\"description\":\"Just another VMware Cloud Management Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/thomas-kopton.de\/vblog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82\",\"name\":\"Thomas Kopton\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e746aafbd3733172ceb4d600ba1feda61bc87cd3b70f5a9dfb581907cc7973b1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e746aafbd3733172ceb4d600ba1feda61bc87cd3b70f5a9dfb581907cc7973b1?s=96&d=mm&r=g\",\"caption\":\"Thomas Kopton\"},\"url\":\"https:\/\/thomas-kopton.de\/vblog\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Aria Operations for Logs - Fields as Part of Alert Title - Quick Tip - TOMsOps","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/thomas-kopton.de\/vblog\/?p=1783","og_locale":"en_US","og_type":"article","og_title":"Aria Operations for Logs - Fields as Part of Alert Title - Quick Tip - TOMsOps","og_description":"As described in the official VMware Aria Operations for Logs (formerly know as vRealize Log Insight) documentation, you can customize alert names by including a field in the format\u00a0${field name}. For example in the following alert definition which will be triggered by VM migration operations the title will contain the name of the user who ...","og_url":"https:\/\/thomas-kopton.de\/vblog\/?p=1783","og_site_name":"TOMsOps","article_published_time":"2024-01-23T14:34:18+00:00","article_modified_time":"2024-01-23T14:37:58+00:00","og_image":[{"width":2328,"height":1222,"url":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png","type":"image\/png"}],"author":"Thomas Kopton","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Thomas Kopton","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783#article","isPartOf":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783"},"author":{"name":"Thomas Kopton","@id":"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82"},"headline":"Aria Operations for Logs – Fields as Part of Alert Title – Quick Tip","datePublished":"2024-01-23T14:34:18+00:00","dateModified":"2024-01-23T14:37:58+00:00","mainEntityOfPage":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783"},"wordCount":570,"commentCount":0,"image":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783#primaryimage"},"thumbnailUrl":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png","articleSection":["Aria Operations for Logs","vRealize Log Insight"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/thomas-kopton.de\/vblog\/?p=1783#respond"]}]},{"@type":"WebPage","@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783","url":"https:\/\/thomas-kopton.de\/vblog\/?p=1783","name":"Aria Operations for Logs - Fields as Part of Alert Title - Quick Tip - TOMsOps","isPartOf":{"@id":"https:\/\/thomas-kopton.de\/vblog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783#primaryimage"},"image":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783#primaryimage"},"thumbnailUrl":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png","datePublished":"2024-01-23T14:34:18+00:00","dateModified":"2024-01-23T14:37:58+00:00","author":{"@id":"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82"},"breadcrumb":{"@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/thomas-kopton.de\/vblog\/?p=1783"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783#primaryimage","url":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png","contentUrl":"https:\/\/thomas-kopton.de\/vblog\/wp-content\/uploads\/2024\/01\/image-12.png","width":2328,"height":1222},{"@type":"BreadcrumbList","@id":"https:\/\/thomas-kopton.de\/vblog\/?p=1783#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/thomas-kopton.de\/vblog"},{"@type":"ListItem","position":2,"name":"Aria Operations for Logs – Fields as Part of Alert Title – Quick Tip"}]},{"@type":"WebSite","@id":"https:\/\/thomas-kopton.de\/vblog\/#website","url":"https:\/\/thomas-kopton.de\/vblog\/","name":"TOMsOps","description":"Just another VMware Cloud Management Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/thomas-kopton.de\/vblog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/892d6b96c66b1dd4b75c6e32fdbfea82","name":"Thomas Kopton","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/thomas-kopton.de\/vblog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e746aafbd3733172ceb4d600ba1feda61bc87cd3b70f5a9dfb581907cc7973b1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e746aafbd3733172ceb4d600ba1feda61bc87cd3b70f5a9dfb581907cc7973b1?s=96&d=mm&r=g","caption":"Thomas Kopton"},"url":"https:\/\/thomas-kopton.de\/vblog\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/posts\/1783","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1783"}],"version-history":[{"count":32,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/posts\/1783\/revisions"}],"predecessor-version":[{"id":1825,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/posts\/1783\/revisions\/1825"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=\/wp\/v2\/media\/1809"}],"wp:attachment":[{"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1783"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1783"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thomas-kopton.de\/vblog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}