You can configure a vRealize Log Insight server to forward incoming events to a syslog or Ingestion API target in addition to storing and indexing events.

Prerequisites

Verify that you are logged in to the vRealize Log Insight Web user interface as a user with the Edit Admin permission. The URL format is https://log-insight-host, where log-insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.

Procedure
1

Click the configuration drop-down menu icon and select Administration.

2

Under Management, click Event Forwarding.

3

Click New Destination and provide the required information .

Option

Description

Name

A unique name for the new destination.

Host

The IP address or fully qualified domain name.

Note

Entering Master, nodes, and ILB IPs/Hostnames, are restricted when you configure forwarding destinations. You should avoid creating network loops. Some issue with functionality can occur. For example, reporting duplicate events.

Protocol

Ingestion API or syslog. The default value is Ingestion API.

4

(Optional) Add tags.

Tags let you add fields with predefined values to events for easier querying.

Note

Tags are only available when using Ingestion API.

5

(Optional) To restrict which events are forwarded, click Add Filter.

If you do not select a filter, all events are forwarded.

6

(Optional) Click Show Advanced Settings to modify the following forwarding options.

Option

Description

Port

The port to which events are sent on the remote destination. The default value is set based on the protocol specified. Do not change unless the remote destination listens on a different port.

Disk Cache

The amount of local disk space to reserve for buffering events that you configure to be forwarded. Buffering is used when the remote destination is unavailable or unable to process the events being sent to it. If the local buffer becomes full and the remote destination is still unavailable, then the oldest local events are dropped and not forwarded to the remote destination even when the remote destination is back online. The default value is 200 MB.

Worker Count

The number of simultaneous outgoing connections to use. Set a higher worker count for higher network latency to the forwarded destination and for higher number of forwarded events per second. The default value is 2.
7

To verify your configuration, click Test.

8

Click Save.

What to do next

You can edit or clone an event forwarding destination.