Managed - Processor definition based on attributes not existing in log

chris_loyen — Thu, 09 Jan 2025 07:20:02 GMT

I'm using the VMware (remote monitoring) extension in Dynatrace Managed, and I want to alert for vCenter alerts (esxi down, ha failover event, certificate status, NOT the appliance itself (cpu, diskspace, ram usage etc)

I haven't found an obvious way to do this, but after analysis of all the logs coming from the vcenter.address I think that all logs I DON'T want have either a host.id or a vm.id attribute.

Is it possible to use processor definitions to create a field based on the non-existence of these fields?
I tried something like this but it doesn't work:

USING(IN host.id:STRING, IN vm.id:STRING)
| FIELDS_ADD(vmcenterevent:IF_THEN(host.id == "" AND vm.id == "", true))

Re: Managed - Processor definition based on attributes not existing in log

AntonPineiro — Thu, 09 Jan 2025 07:49:30 GMT

Hi,

I would create a Log custom attribute in advance. And you can link it in your processing rule definition.

Best regards

topic Managed - Processor definition based on attributes not existing in log in Dynatrace Managed Q&A

Managed - Processor definition based on attributes not existing in log

Re: Managed - Processor definition based on attributes not existing in log