elastic / elastic/integrations
[vmware vsphere]: Collect VM Tags and Categories from the vSphere CIS Tagging API
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
VMware vSphere [vsphere]
### Dataset Name
_No response_
### Integration Version
1.23.1
### Agent Version
9.1.5
### OS Version and Architecture
Ubuntu 20.04
### User Goal
I want Elastic Agent’s VMware vSphere integration to collect VMware Tags and Categories from vCenter using the modern CIS Tagging API. Many environments rely on vSphere Tags for operational metadata such as backup policies (“Do Not Backup”), environment classification (Prod/Dev/QA), ownership, compliance flags, and automation workflows. Having these tags ingested into Elastic would allow us to filter, group, enrich, and alert on vSphere metrics and logs based on the same metadata we use inside vCenter.
### Existing Features
The current vSphere integration only collects legacy Custom Attributes (exposed as vsphere.virtualmachine.custom_fields). It does not collect modern vSphere Tags or Categories, which are stored and managed through a different API (com.vmware.cis.tagging). Because of this, the integration cannot ingest the metadata that most VMware environments actually use today. As a result, we cannot correlate VM metrics with operational metadata, cannot build dashboards based on tag-driven policies, and cannot align Elastic with our existing automation and backup workflows.
### What did you see?
When collecting data from vCenter using the Elastic vSphere integration, I see that virtual machine documents include basic metadata (name, UUID, power state, resource usage) and the legacy vsphere.virtualmachine.custom_fields field. However, this field is always empty because our environment uses VMware Tags and Categories, not legacy Custom Attributes. No vSphere Tags appear anywhere in the ingested data, even though they are present in vCenter and used extensively for operational metadata.
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.