elastic / elastic/integrations

[vmware vsphere]: Collect VM Tags and Categories from the vSphere CIS Tagging API

Open
#17,557 0 comments 0 reactions 0 assignees View on GitHub
Integration:vsphere needs:triage Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

VMware vSphere [vsphere]

### Dataset Name

_No response_

### Integration Version

1.23.1

### Agent Version

9.1.5

### OS Version and Architecture

Ubuntu 20.04

### User Goal

I want Elastic Agent’s VMware vSphere integration to collect VMware Tags and Categories from vCenter using the modern CIS Tagging API. Many environments rely on vSphere Tags for operational metadata such as backup policies (“Do Not Backup”), environment classification (Prod/Dev/QA), ownership, compliance flags, and automation workflows. Having these tags ingested into Elastic would allow us to filter, group, enrich, and alert on vSphere metrics and logs based on the same metadata we use inside vCenter.

### Existing Features

The current vSphere integration only collects legacy Custom Attributes (exposed as vsphere.virtualmachine.custom_fields). It does not collect modern vSphere Tags or Categories, which are stored and managed through a different API (com.vmware.cis.tagging). Because of this, the integration cannot ingest the metadata that most VMware environments actually use today. As a result, we cannot correlate VM metrics with operational metadata, cannot build dashboards based on tag-driven policies, and cannot align Elastic with our existing automation and backup workflows.

### What did you see?

When collecting data from vCenter using the Elastic vSphere integration, I see that virtual machine documents include basic metadata (name, UUID, power state, resource usage) and the legacy vsphere.virtualmachine.custom_fields field. However, this field is always empty because our environment uses VMware Tags and Categories, not legacy Custom Attributes. No vSphere Tags appear anywhere in the ingested data, even though they are present in vCenter and used extensively for operational metadata.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.