I'm using the VMware (remote monitoring) extension in Dynatrace Managed, and I want to alert for vCenter alerts (esxi down, ha failover event, certificate status, NOT the appliance itself (cpu, diskspace, ram usage etc)
I haven't found an obvious way to do this, but after analysis of all the logs coming from the vcenter.address I think that all logs I DON'T want have either a host.id or a vm.id attribute.
Is it possible to use processor definitions to create a field based on the non-existence of these fields?
I tried something like this but it doesn't work:
USING(IN host.id:STRING, IN vm.id:STRING)
| FIELDS_ADD(vmcenterevent:IF_THEN(host.id == "" AND vm.id == "", true))
