You can configure parsers for both FileLog and WinLog collectors.
Prerequisites
For the
vRealize Log Insight Linux Agent:
- Log in as root or use sudo to run console commands.
- Log in to the Linux machine on which you installed the Log Insight Linux Agent, open a console and run pgrep liagent to verify that the Log Insight Linux Agent is installed and running.
For the
vRealize Log Insight Windows Agent:
- Log in to the Windows machine on which you installed the Log Insight Windows Agent and start the Services manager to verify that the vRealize Log Insightt service is installed.
Procedure
- Navigate to the folder containing the liagent.ini file.
| Operating System |
Path |
| Linux |
/var/lib/loginsight-agent/ |
| Windows |
%ProgramData%\VMware\Log Insight Agent |
- Open the liagent.ini file in any text editor.
- To configure a specific parser, define a parser section. [parser|myparser]
Where myparser is an arbitrary name of the parser which can be referred from log sources. Parser section should refer to any built in (or any other defined) parser and configure that parser’s mandatory options and non-required options if needed.
For example,
base_parser=csv shows that
myparser parser is derived from built-in parser
csv. It expects that input logs consist of two fields which are separated with a semicolon.
[parser|myparser]
base_parser=csv
fields=field_name1,field_name2
delimiter=“;”
- After defining myparser, refer to it from log sources winlog or filelog.
[filelog|some_csv_logs]
directory=D:\Logs
include=*.txt;*.txt.*
parser=myparser
The logs collected from
some_csv_logs sources, for example from the
D:\Logs directory, are parsed by
myparser and extracted events appear on the server as
field_name1 and
field_name2 respectively.
Note: The static logs in the
D:\Logs directory are not get pulled into
vRealize Log Insight by the agent. However, new files that are created in the
D:\Logs directory are available in
vRealize Log Insight.
- Save and close the liagent.ini file.
