[format/vmw_log] Add support for new vmw log format.

sureshsundriyal · tstack · commit e644f9eb008e · 2025-06-18T09:50:13.000-07:00
* Quotes around stuff like `opID` and `sub`.
* No brackets around process/thread id.
* Space between process name and process id.
diff --git a/src/formats/vmw_log.json b/src/formats/vmw_log.json
@@ -5,6 +5,9 @@
         "description": "One of the log formats used in VMware's ESXi and vCenter software.",
         "url": "https://kb.vmware.com/kb/2004201",
         "regex": {
+            "9.0+": {
+                "pattern": "^(?<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}(?:Z|[-+]\\d{2}:\\d{2})) (?<level>\\w+)(?:\\(\\d+\\)+)? (?<prc>[\\w\\-]+)\\s?\\[?(?<tid>\\w+)\\]?:? (?:\\w+ -\\[\\d+\\] )?\\[(?<src>[a-zA-Z][\\w:]*(?:@\\d+)?)(?:\\s+sub=\\\"?(?<sub>.*?(?!\\w+=))\\\"?)?(?:\\s+item=\\\"?(?<item>[\\w\\.\\-@/:]+)\\\"?)?(?: req=\\\"?(?<req>[^ \\]]+)\\\"?)?(?: opI(?:D|d)=\\\"?(?<opid>(?:req=)?[\\w@ \\-\\.:]+?(?!\\w+=))\\\"?)?(?: sid=\\\"?(?<sid>[^ \\]]+)\\\"?)?(?: user=\\\"(?<user>[^ \\]<]+(?:<[^>]+>)?\\\"?))?(?: update=\\\"?(?<vpxa_update>\\d+)\\\"?)?(?:\\s+reason=\\\"?(?<reason>[^\\]]+)\\\"?)?\\]\\s+(?:\\[(?<file>[^ ]+)\\s+(?<line>\\d+)\\]\\s+)?(?<body>.*)$"
+            },
             "6.0+": {
                 "pattern": "^(?:\\[#\\d+\\] )?(?<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}(?:Z|[-+]\\d{2}:\\d{2})) (?<level>\\w+)(?:\\(\\d+\\)+)? (?<prc>[\\w\\-]+)\\[(?<tid>\\w+)\\]:? (?:\\w+ -\\[\\d+\\] )?\\[(?<src>[a-zA-Z][\\w:]*(?:@\\d+)?)(?:\\s+sub=(?<sub>.*?(?!\\w+=)))?(?:\\s+item=(?<item>[\\w\\.\\-@/:]+))?(?: req=(?<req>[^ \\]]+))?(?: opI(?:D|d)=(?<opid>(?:req=)?[\\w@ \\-\\.:]+?(?!\\w+=)))?(?: sid=(?<sid>[^ \\]]+))?(?: user=(?<user>[^ \\]<]+(?:<[^>]+>)?))?(?: update=(?<vpxa_update>\\d+))?(?:\\s+reason=(?<reason>[^\\]]+))?\\]\\s+(?:\\[(?<file>[^ ]+)\\s+(?<line>\\d+)\\]\\s+)?(?<body>.*)$"
             },
@@ -355,6 +358,9 @@
             },
             {
                 "line": "2023-10-28 02:56:46,013 INFO imageService[139745105131968] [imageService 1092] Image service is initialized"
+            },
+            {
+                "line": "2025-06-04T17:06:21.349Z INFO vpxd 20973 [Originator@4413 sub=\"ServiceAccount\" opID=\"SvcAcctInit-5a91f2fc\"] Service account accessor initialized; user: vpxd-svc-acct-90beeaa8-b1b3-46f4-8200-641edac5cacf@VSPHERE.LOCAL, passwordStatus: Ok"
             }
         ]
     }

Original file line number	Diff line number	Diff line change
`@@ -5,6 +5,9 @@`
`5`	`5`	`"description": "One of the log formats used in VMware's ESXi and vCenter software.",`
`6`	`6`	`"url": "https://kb.vmware.com/kb/2004201",`
`7`	`7`	`"regex": {`
	`8`	`+ "9.0+": {`
	`9`	+ "pattern": "^(?<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}(?:Z\|[-+]\\d{2}:\\d{2})) (?<level>\\w+)(?:\\(\\d+\\)+)? (?<prc>[\\w\\-]+)\\s?\\[?(?<tid>\\w+)\\]?:? (?:\\w+ -\\[\\d+\\] )?\\[(?<src>[a-zA-Z][\\w:](?:@\\d+)?)(?:\\s+sub=\\\"?(?<sub>.?(?!\\w+=))\\\"?)?(?:\\s+item=\\\"?(?<item>[\\w\\.\\-@/:]+)\\\"?)?(?: req=\\\"?(?<req>[^ \\]]+)\\\"?)?(?: opI(?:D\|d)=\\\"?(?<opid>(?:req=)?[\\w@ \\-\\.:]+?(?!\\w+=))\\\"?)?(?: sid=\\\"?(?<sid>[^ \\]]+)\\\"?)?(?: user=\\\"(?<user>[^ \\]<]+(?:<[^>]+>)?\\\"?))?(?: update=\\\"?(?<vpxa_update>\\d+)\\\"?)?(?:\\s+reason=\\\"?(?<reason>[^\\]]+)\\\"?)?\\]\\s+(?:\\[(?<file>[^ ]+)\\s+(?<line>\\d+)\\]\\s+)?(?<body>.*)$"
	`10`	`+ },`
`8`	`11`	`"6.0+": {`
`9`	`12`	"pattern": "^(?:\\[#\\d+\\] )?(?<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}(?:Z\|[-+]\\d{2}:\\d{2})) (?<level>\\w+)(?:\\(\\d+\\)+)? (?<prc>[\\w\\-]+)\\[(?<tid>\\w+)\\]:? (?:\\w+ -\\[\\d+\\] )?\\[(?<src>[a-zA-Z][\\w:](?:@\\d+)?)(?:\\s+sub=(?<sub>.?(?!\\w+=)))?(?:\\s+item=(?<item>[\\w\\.\\-@/:]+))?(?: req=(?<req>[^ \\]]+))?(?: opI(?:D\|d)=(?<opid>(?:req=)?[\\w@ \\-\\.:]+?(?!\\w+=)))?(?: sid=(?<sid>[^ \\]]+))?(?: user=(?<user>[^ \\]<]+(?:<[^>]+>)?))?(?: update=(?<vpxa_update>\\d+))?(?:\\s+reason=(?<reason>[^\\]]+))?\\]\\s+(?:\\[(?<file>[^ ]+)\\s+(?<line>\\d+)\\]\\s+)?(?<body>.*)$"
`10`	`13`	`},`
`@@ -355,6 +358,9 @@`
`355`	`358`	`},`
`356`	`359`	`{`
`357`	`360`	`"line": "2023-10-28 02:56:46,013 INFO imageService[139745105131968] [imageService 1092] Image service is initialized"`
	`361`	`+ },`
	`362`	`+ {`
	`363`	`+ "line": "2025-06-04T17:06:21.349Z INFO vpxd 20973 [Originator@4413 sub=\"ServiceAccount\" opID=\"SvcAcctInit-5a91f2fc\"] Service account accessor initialized; user: vpxd-svc-acct-90beeaa8-b1b3-46f4-8200-641edac5cacf@VSPHERE.LOCAL, passwordStatus: Ok"`
`358`	`364`	`}`
`359`	`365`	`]`
`360`	`366`	`}`