Skip to content

Feature: VCenter Additional Fields To Parse (1613)#2563

Open
vg-svitla wants to merge 1 commit into
developfrom
feature/vcenter_additional_fields_to_parse
Open

Feature: VCenter Additional Fields To Parse (1613)#2563
vg-svitla wants to merge 1 commit into
developfrom
feature/vcenter_additional_fields_to_parse

Conversation

@vg-svitla

@vg-svitla vg-svitla commented May 28, 2026

Copy link
Copy Markdown
Contributor

Relates to 1613

Summary by Sourcery

Update VMware vCenter log parsing to capture additional hostname data and add coverage for task events with domain information.

Enhancements:

  • Adjust VMware vCenter generic event pattern to capture hostnames more flexibly for specific event type 7.1 logs.

Tests:

  • Add a test case for task events that include domain information to validate the updated parsing behavior.

@vg-svitla vg-svitla requested review from a team and squioc May 28, 2026 08:21
@sourcery-ai

sourcery-ai Bot commented May 28, 2026

Copy link
Copy Markdown
Contributor
Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adjusts the vCenter log parsing pattern for a specific event type to capture hostname more generically and adds a new test fixture for task events with a domain-qualified host.

Flow diagram for updated vCenter OTHERS_EVENTS_TYPE_7_1 log parsing

flowchart LR
  A[VCenter_log_line OTHERS_EVENTS_TYPE_7_1] --> B[Apply_grok_pattern OTHERS_EVENTS_TYPE_7_1]
  B --> C[Extract_event_code]
  B --> D[Extract_log_level]
  B --> E[Extract_username]
  B --> F[Extract_hostname_as_DATA]
  B --> G[Extract_reason]
  C --> H[Parsed_event_object]
  D --> H
  E --> H
  F --> H
  G --> H
  H --> I[Test_fixture_task_event_with_domain.json]
Loading

File-Level Changes

Change Details Files
Relax and generalize the hostname capture in the OTHERS_EVENTS_TYPE_7_1 Grok pattern for vCenter events.
  • Replaces HOSTNAME:hostname with a generic DATA:hostname capture group within the OTHERS_EVENTS_TYPE_7_1 Grok expression to allow domain-qualified or otherwise non-standard host strings
  • Keeps the rest of the OTHERS_EVENTS_TYPE_7_1 pattern unchanged to preserve existing field mappings and event structure
VMWare/vmware-vcenter/ingest/parser.yml
Introduce a new JSON test fixture for task events involving domain-qualified hostnames.
  • Adds a new test file for task event logs that include a domain in the host field to validate the updated parsing pattern
  • Ensures the new fixture exercises the modified OTHERS_EVENTS_TYPE_7_1 pattern behavior
VMWare/vmware-vcenter/tests/test_task_event_with_domain.json

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@github-actions

Copy link
Copy Markdown

Smart descriptions generated from the latest tests at 2026-05-28 08:22:08:

Test File Smart Description
VMWare/vmware-vcenter/tests/command_line.json /usr/lib/vmware-observability/scripts/createDBRole.sh executed in / as root
VMWare/vmware-vcenter/tests/command_line_without_header.json /usr/lib/vmware-observability/scripts/createDBRole.sh executed in / as root
VMWare/vmware-vcenter/tests/connections_logs.json Connected to test.example.org
VMWare/vmware-vcenter/tests/fault_logs.json VMOMI activation LRO failed
VMWare/vmware-vcenter/tests/fault_logs2.json [VpxLRO] -- ERROR lro-1926720284 -- SessionManager -- vim.SessionManager.login
VMWare/vmware-vcenter/tests/has_permissions_1.json Permission check for user user1(domain example.com)
VMWare/vmware-vcenter/tests/has_permissions_2.json Permission check for user user1(domain example.com)
VMWare/vmware-vcenter/tests/http_logs_1.json 1.2.3.4 requested /sdk
VMWare/vmware-vcenter/tests/http_logs_2.json 1.2.3.4 requested /lookupservice/sdk
VMWare/vmware-vcenter/tests/http_logs_3.json GET request to /stats?https://example.com/
VMWare/vmware-vcenter/tests/http_logs_4.json 1.2.3.4 requested /api/search?https://example.com/
VMWare/vmware-vcenter/tests/ldap.json Requesting LDAP connection
VMWare/vmware-vcenter/tests/login_failure.json User user1 failed to log from 1.2.3.4
VMWare/vmware-vcenter/tests/login_success.json User USER01 successfully logs from 1.2.3.4
VMWare/vmware-vcenter/tests/other_events_type_7_partial.json User logged event: Source: Veeam Backup
VMWare/vmware-vcenter/tests/other_tests_example1_type_7.json Task VMware vSphere Update Manager Check Notification on Datacenters in datacenter completed successfully
VMWare/vmware-vcenter/tests/other_tests_example2_type_7.json Hardware Sensor Status: Processor Green, Memory Green, Fan Green, Voltage Green, Temperature Green, Power Green, System Board Green, Battery Green, Storage Green, Other Green
VMWare/vmware-vcenter/tests/other_tests_example3_type_7.json User testuser failed to log from 1.2.3.4
VMWare/vmware-vcenter/tests/other_tests_example4_type_7.json User JOHNDOE successfully logs from 1.2.3.4
VMWare/vmware-vcenter/tests/others_events.json FINISH lro--1111111111
VMWare/vmware-vcenter/tests/others_events_test2.json BEGIN lro--1111111111 -- ServiceInstance -- vim.ServiceInstance.retrieveContent -- 47f5e298-9aee-4e21-b69b-abc3efd9cd4e(54b2ae59-1b21-4de8-bab0-0d9a415debce)
VMWare/vmware-vcenter/tests/others_events_type2.json Calling bulkUpdate with datastore=ds:///vmfs/volumes/1111111-22222222/ fullSync=false changed size: 0 tidyVClock=0 serverLastVClock=-1
VMWare/vmware-vcenter/tests/others_events_type3.json GC (Allocation Failure)
VMWare/vmware-vcenter/tests/others_events_type5.json PI-client-connection-monitor c.v.v.a.vapi.runtime.thread.ApacheBioHttpClientBuilderAspect vAPI-client-connection-monitor thread started...
VMWare/vmware-vcenter/tests/others_events_type9.json Reconfigured EXAMPLE on 1.2.3.4 in HOSTNAME
VMWare/vmware-vcenter/tests/others_events_type_10_with_originator.json Create Snapshot: Snapshot de VM 10/02/2026 16:28:55, memory=false, quiescent=false state=5
VMWare/vmware-vcenter/tests/others_tests_example1_type_6.json A ticket for root on 5.6.7.8 has been acquired
VMWare/vmware-vcenter/tests/others_tests_example2_type_6.json A ticket for john.doe on 5.6.7.8 has been acquired
VMWare/vmware-vcenter/tests/others_tests_example3_type3.json WeakReference, 0 refs, 0.0000061 secs
VMWare/vmware-vcenter/tests/others_tests_example4_type3.json FinalReference, 150 refs, 0.0004388 secs
VMWare/vmware-vcenter/tests/others_tests_example5_type3.json PhantomReference, 0 refs, 0 refs, 0.0000065 secs
VMWare/vmware-vcenter/tests/others_tests_example6_type3.json JNI Weak Reference, 0.0000149 secs
VMWare/vmware-vcenter/tests/others_tests_example_type3.json SoftReference, 0 refs, 0.0000457 secs
VMWare/vmware-vcenter/tests/session_count.json Session count for user USERNAME is 3
VMWare/vmware-vcenter/tests/session_logs_type1.json Cannot login user1@5.6.7.8
VMWare/vmware-vcenter/tests/session_logs_type2.json User example.com\user1@10.79.48.3 logged in as VMware vim-java 1.0
VMWare/vmware-vcenter/tests/session_logs_type2_3.json User example.com\JOHNDOE@127.0.0.1 logged in as VMware vim-java 1.0
VMWare/vmware-vcenter/tests/session_logs_type2bis.json User root@127.0.0.1 logged in as pyvmomi
VMWare/vmware-vcenter/tests/session_logs_type3.json User root@127.0.0.1 logged out
VMWare/vmware-vcenter/tests/session_logs_type3_with_spaced_hostname.json User root@127.0.0.1 logged out
VMWare/vmware-vcenter/tests/session_logs_type3_wo_hostname.json User user1.com\user1@127.0.0.1 logged out
VMWare/vmware-vcenter/tests/session_logs_type4.json SSH session was opened for root@1.2.3.4.
VMWare/vmware-vcenter/tests/session_logs_type5.json SSH session was closed for root@1.2.3.4.
VMWare/vmware-vcenter/tests/session_logs_type6.json already logged on
VMWare/vmware-vcenter/tests/session_logs_type7.json User testuser failed to log from 1.2.3.4
VMWare/vmware-vcenter/tests/session_logs_type8.json User example.com\user1@127.0.0.1 logged in as VMware vim-java 1.0
VMWare/vmware-vcenter/tests/session_logs_type9.json User test successfully logs from 1.2.3.4
VMWare/vmware-vcenter/tests/session_logs_type_1_2.json User EXAMPLE\user1@1.2.3.4 logged in as JAAA-WS RI 2.3.0 svn-revision#3528ea595bd29309f69172d231bbce272d21999c
VMWare/vmware-vcenter/tests/test_correct_username_1.json SSH session was closed for 'root@192.0.2.1'.
VMWare/vmware-vcenter/tests/test_correct_username_2.json SSH session was closed for 'test@1.2.3.4'.
VMWare/vmware-vcenter/tests/test_envoy_http_extended.json 192.0.2.123 requested /sdk
VMWare/vmware-vcenter/tests/test_properly_escaped_json.json User administrator successfully logs from 1.2.3.4
VMWare/vmware-vcenter/tests/test_reconfigured_event.json Configuration changed on example.com
VMWare/vmware-vcenter/tests/test_task_event_with_domain.json Task: Create virtual machine snapshot
VMWare/vmware-vcenter/tests/test_tomcat_access_log.json 127.0.0.1 requested /eam/sdk
VMWare/vmware-vcenter/tests/test_vidm_http_crypto.json 127.0.0.1 requested /crypto/health/ready
VMWare/vmware-vcenter/tests/test_vmcad_auth_success.json VMCACheckAccessKrb: SUCCESS Authenticated user vcenter01.example.test@vsphere.local
VMWare/vmware-vcenter/tests/test_vpxd_originator_pmem.json PMem stats error: host [vim.HostSystem:host-18864,esxi02.example.test] has no valid stats
VMWare/vmware-vcenter/tests/test_vpxd_originator_userinfo.json GetUserInfoInternal(VSPHERE.LOCAL\svc-12345678-abcd-1234-abcd-123456789012, false) res: VSPHERE.LOCAL\svc-12345678-abcd-1234-abcd-123456789012
VMWare/vmware-vcenter/tests/test_vpxd_originator_vmmo.json For VM [vim.VirtualMachine:vm-12345,02 - VM001 (TEST)], LB overhead limit (150) is less than overhead (151).Use the larger value for the admission check.
VMWare/vmware-vcenter/tests/test_vsan_syslog.json Cannot sync datastore ds:///vmfs/volumes/00000000-00000000-0000-000000000000/, without all records

@github-actions

Copy link
Copy Markdown

🤖 Copilot Automated Review

Changed Intake Formats

The following intake formats were modified:

  • 'VMWare/vmware-vcenter'

Changed File Types

  • .yml files: 1

🔒 Security Scan - Sensitive Information Check

⚠️ IMPORTANT: This is a public repository. All test data must be anonymized.

No test files in this PR

📋 Contribution Checklist

Please ensure your PR meets the following requirements:

  • No sensitive information in test files (emails, passwords, API keys, real IPs, PII)
  • Test data is properly anonymized (use example.com, TEST-NET IPs, fake credentials)
  • Code is linted with Prettier
  • Parser test coverage is at least 75%
  • Logo files included for new modules/formats
  • README.md files present and updated
  • Smart-descriptions provided for new formats

🔍 Next Steps

GitHub Copilot can help you with:

  • Security review: Tag @copilot to scan for additional sensitive data
  • Anonymization help: Ask Copilot to suggest anonymized replacements
  • Code review: Request specific review feedback
  • Test suggestions: Ask Copilot to suggest additional test cases

For more details, see the Contribution Guidelines.

@github-actions

Copy link
Copy Markdown

⚠️ Intake Format Checks Failed

Format Errors

  • VMWare/vmware-vcenter
    • Anonymization Error - code: anonymization_missing - file: VMWare/vmware-vcenter/tests/session_logs_type3_wo_hostname.json - data type: Domain - value: user1.com - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: VMWare/vmware-vcenter/tests/session_logs_type3_wo_hostname.json - data type: Domain - value: user1.com - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: VMWare/vmware-vcenter/tests/test_task_event_with_domain.json - data type: Domain - value: host1 - example - reason: Not in accepted anonymized domain patterns

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • In OTHERS_EVENTS_TYPE_7_1, switching from %{HOSTNAME:hostname}? to %{DATA:hostname} removes the optional quantifier and significantly broadens the match; verify that events with missing/empty hostname are not expected and that this looser pattern won't accidentally consume content from later fields.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- In `OTHERS_EVENTS_TYPE_7_1`, switching from `%{HOSTNAME:hostname}?` to `%{DATA:hostname}` removes the optional quantifier and significantly broadens the match; verify that events with missing/empty hostname are not expected and that this looser pattern won't accidentally consume content from later fields.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant