3 Preprocessing examples

Overview

This section presents examples of using preprocessing steps to accomplish some practical tasks.

Regular expression

These examples use regular expressions in the preprocessing steps.

Filtering VMware event log records

Using regular expressions to filter unnecessary events from the VMware event log.

1. On a working VMware Hypervisor host, check that the event log item vmware.eventlog[<url>,<mode>,<severity>] is present and working properly. Note that the event log item could already be present on the hypervisor if the Template VM VMware template has been linked during the host creation.

2. On the VMware Hypervisor host, create a dependent item of 'Log' type and set the event log item as its master.

In the "Preprocessing" tab of the dependent item, select the "Matches regular expression" validation option and fill pattern, for example:

".* logged in .*" - filters all logging events in the event log
       "\bUser\s+\K\S+" -  filter only lines with usernames from the event log

Another approach that allows using matching groups and output control is to select "Regular expression" option in the "Preprocessing" tab and fill parameters, for example:

pattern: ".*logged in.*", output: "\0" - filters all logging events in the event log
       pattern "User (.*?)(?=\ )", output: "\1" - filter only usernames from the event log