vRealize Log Insight supports event forwarding to other clusters and standalone instances. Use log forwarding between SDDC regions to have access to all logs if a disaster occurs in a region.

You forward syslog data in vRealize Log Insight by using the Ingestion API or a native syslog implementation. While forwarding events, the vRealize Log Insight instance still ingests, stores, and archives events locally.

The vRealize Log Insight Ingestion API uses TCP communication. In contrast to syslog, the forwarding module supports the following features for the Ingestion API:

  • Forwarding to other vRealize Log Insight instances

  • Support for both structured and unstructured data, that is, multi-line messages

  • Metadata in the form of tags

  • Client-side compression

  • Configurable disk-backed queue to save events until the server acknowledges the ingestion