content pack validator vs extracted fields

[fred82]

Hello,

The content pack I am working on for the VMware 2015 makes no use of the extracted fields; each query consists of averagely 10 exact strings w/o needing of regex. Therefore I don't use extracted fields at all. Attached please find the image of a such query.

Therefore I am asking for a feature request for the validator to relax the requirement of having at least 1 extracted field for a dashboard so that I can submit to the Market place to allow our customers to download this content pack. Otherwise, we will have to distribute this pack from our company website which would result in some visibility issue for both Dell & VMware for the customers of both companies.

[admin]

Hi,

The content pack validator does not block you from submitting a content pack with no extracted fields. However not having extracted fields will limit you from creating queries with aggregation; and not aggregating will slow down the performance of your queries quite significantly and reflect poorly on Log Insight; hence the requirement of extracted fields. The details of creating and using extracted fields is listed in the document Creating_content_packs_in_vrealize_logInsight_2_5.pdf in the documents section of this communities site (also attached).

Please submit your content pack for review and I'll take a look and get back to you. Hope this helps.

Thanks,

-Yogita.

[fred82]

Thx for the reply.

I know of how to use extracted fields and also looked at other network infrastructure vendors' content packs (cisco NX and arista).

In my case, the ratio of query and events are 1:7 in average. it is cumbersome to make an EF to present those 7 events.

I will submit to the pack and get your feedback.

[admin]

Ok, yeah, sorry about the duplicate information, its hard to tell from the question if you are a novice user of Log Insight or an experienced one. Do submit the content pack and I'd be happy to review.