Shims are used to map varying webhook formats.

vRealize Log Insight sends a webhook in its own proprietary format and third-party solutions expect incoming webhooks to be in their proprietary format. This means either the third-party solution needs to have native support for the vRealize Log Insight format or a shim between vRealize Log Insight and the third-party solution is needed which translates vRealize Log Insight format to third-party format.

The following figures show a user alert query and the webhook that is generated for it. You can use this information to better understand the mapping required for supporting shims.

Figure 1. User-defined Alert Query

Figure 2. Webhook Output for the User Alert Aggregation Query

{  
   "AlertType":1,
   "AlertName":"ESXi Vpxa Alert",
   "SearchPeriod":300000,
   "HitCount":0.0,
   "HitOperator":2,
   "messages":[  
      {  
         "text":"2016-06-24T15:42:42.055Z esx01 Vpxa: [4845FB90 verbose 'VpxaHalCnxHostagent' opID=WFU-dcfc2d3a] [WaitForUpdatesDone] Starting next WaitForUpdates() call to hostd",
         "timestamp":1451940578545,
         "fields":[  
            { 
               "name":"hostname",
               "content":"esx01"
            },
            { 
               "name":"appname",
               "content":"vpxa"
            }
         ]
      },
      {  
         "text":"2016-06-24T15:42:42.055Z esx02 Vpxa: [4845FB90 verbose 'vpxavpxaInvtVm' opID=WFU-dcfc2d3a] [VpxaInvtVmChangeListener] Guest DiskInfo Changed",
         "timestamp":1451940561008,
         "fields":[  
            { 
               "name":"hostname",
               "content":"esx02"
            },
            { 
               "name":"appname",
               "content":"vpxa"
            }
         ]
      }
   ],
   "HasMoreResults":false,
   "Url":"https://10.11.12.13/s/8pgzq6",
   "EditUrl":"https://10.11.12.13/s/56monr",
   "Info":"This is an alert for all the 'ESXi Vpxa' messages",
   "NumHits":2
}