Any Log Insight user can create a content pack for private or public usage.

Content packs are immutable or read-only plug-ins to vRealize Log Insight, that provide predefined knowledge about specific types of events, such as log messages. The goal of a content pack is to provide knowledge about a specific set of events in a format that is easily understandable by administrators, engineers, monitoring teams, and executives.

Content packs give information about the health status of a product or application. In addition, a content pack helps you understand how a product or an application works.

You can save the information from a content pack by using either the Dashboards or Interactive Analytics pages in vRealize Log Insight. The information in a content pack includes:

Queries - usually a content pack contains at least three queries and three chart widgets for each dashboard, which means more than nine queries in total

Fields - a content pack should have at least twenty extracted fields


Alerts - each content pack contains at least five alerts

Dashboards - there are at least three dashboards in each content pack

Dashboard filters - see Searching and Filtering Log Events

Visualizations - see Using the Interactive Analytics Chart to Analyze Logs

By default, vRealize Log Insight ships with the VMware - vSphere content pack. You can import additional content packs if needed.