Format of the VMware Aria Operations for Logs Archive Files

VMware Aria Operations for Logs archives data in a specific format.

VMware Aria Operations for Logs stores archive files on an NFS server and organizes them in hierarchical directories based on archiving time. For example,

/backup/2014/08/07/16/bd234b2d-df98-44ae-991a-e0562f10a49/data.blob

where /backup is the NFS location, 2014/08/07/16 is the archiving time, bd234b2d-df98-44ae-991a-e0562f10a49 is the bucket ID of the bucket that stores the log files, and data.blob is the archived data for the bucket.

The archive data data.blob is a compressed file that uses VMware Aria Operations for Logs internal encoding. It contains the original content for all of the messages stored in the bucket, together with the static fields such as timestamp, host name, source, and appname.

You can import archived data to VMware Aria Operations for Logs, export archive data to a raw text file, and extract message content from archive data. See Export a Log Insight Archive to a Raw Text File or JSON and Import a VMware Aria Operations for Logs Archive.