2 of 2 people found this helpful
The events collected depends upon the metadata event_source and events_to_collect value. If you write a pattern including this then the system will also collect events of the named type.
So for example if you add a pattern with
event_source := 'vCenter';
events_to_collect := 'vim.event.VmCloneEvent';
on event := ExternalEvent created where type := 'vim.event.VmCloneEvent';
will mean the system tries to capture VmCloneEvent events from vCenters. Be aware that vCenter can create a lot of events so be careful about the events you want. Additionally you may not be able to access the system specified in the event. It may not actually yet be available from the vCenter. For example just because you get a vmCreateEvent does not mean the VM has actually booted and is available.