feat(VMware-filter): enhance VMware log parsing capabilities

Author: JocLRojas

filters/vmware/vmware-esxi.yml

@@ -1,4 +1,4 @@
-# VMWare-ESXi, version 3.0.0
+# VMWare-ESXi, version 3.0.1
 # 
 # Based on docs and real logs provided
 # Support VMWare-ESXi log
@@ -48,6 +48,33 @@ pipeline:
               pattern: '\[{{.data}}\]:'
             - fieldName: log.message
               pattern: '{{.greedy}}'
+
+      - grok:
+          patterns:
+            - fieldName: log.priority
+              pattern: '\<{{.data}}\>'
+            - fieldName: log.deviceTime
+              pattern: '{{.year}}-{{.monthNumber}}-{{.monthDay}}T{{.time}}Z'
+            - fieldName: origin.hostname
+              pattern: '{{.hostname}}'
+            - fieldName: log.process
+              pattern: '{{.hostname}}'
+            - fieldName: log.pid
+              pattern: '\[{{.data}}\]:'
+            - fieldName: log.originIdComponent
+              pattern: '\[{{.data}}\]'
+            - fieldName: log.message
+              pattern: '{{.greedy}}'
+
+      - grok:
+          patterns:
+            - fieldName: log.moduleIdentifier
+              pattern: '\[{{.data}}\@'
+            - fieldName: log.irrelevant
+              pattern: '{{.data}}\='
+            - fieldName: log.subModuleIdentifier
+              pattern: '{{.word}}\]'
+          source: log.originIdComponent
 
       # Removing unused caracters
       - trim:
@@ -61,6 +88,12 @@ pipeline:
           fields:
             - log.pid
             - log.eventInfo
+            - log.moduleIdentifier
+      - trim:
+          function: prefix
+          substring: '-'
+          fields:
+            - log.message
       - trim:
           function: suffix
           substring: '>'
@@ -78,8 +111,20 @@ pipeline:
           fields:
             - log.pid
             - log.eventInfo
+            - log.subModuleIdentifier
+      - trim:
+          function: suffix
+          substring: '-'
+          fields:
+            - log.message
+      - trim:
+          function: suffix
+          substring: '@'
+          fields:
+            - log.moduleIdentifier
 
       # Removing unused fields
       - delete:
           fields:
-            - log.processName
+            - log.processName
+            - log.irrelevant