✄𐘗
text code block:
✄𐘗FROM logs-vsphere.log-*
| WHERE data_stream.dataset == "vsphere.log" AND event.module == "vsphere" and host.ip is not null
| EVAL Esql.message_lower = TO_LOWER(message)
| EVAL
    Esql.ssh_enabled = CASE(
      Esql.message_lower LIKE "*ssh access has been enabled*" OR Esql.message_lower LIKE "*hostsvc/enable_ssh*",
      1, 0
    ),
    Esql.exec_installed_only_disabled = CASE(
      Esql.message_lower LIKE "*execinstalledonly*" AND (
        Esql.message_lower LIKE "*false*" OR Esql.message_lower LIKE "* -i 0*" OR Esql.message_lower LIKE "* -v 0*"
      ),
      1, 0
    ),
    Esql.vib_force_install = CASE(
      Esql.message_lower LIKE "*vib install*" AND (
        Esql.message_lower LIKE "* -f *" OR Esql.message_lower LIKE "* -f"
        OR Esql.message_lower LIKE "* --force *" OR Esql.message_lower LIKE "* --force"
      ),
      1, 0
    )
| WHERE Esql.ssh_enabled == 1 OR Esql.exec_installed_only_disabled == 1 OR Esql.vib_force_install == 1
| STATS
    Esql.ssh_enabled_count = SUM(Esql.ssh_enabled),
    Esql.exec_installed_only_disabled_count = SUM(Esql.exec_installed_only_disabled),
    Esql.vib_force_install_count = SUM(Esql.vib_force_install),
    Esql.message_values = VALUES(message),
    Esql.log_file_path_values = VALUES(vsphere.log.file.path),
    Esql.first_seen = MIN(@timestamp),
    Esql.last_seen = MAX(@timestamp)
  BY host.ip
| WHERE Esql.ssh_enabled_count > 0
    AND Esql.exec_installed_only_disabled_count > 0
    AND Esql.vib_force_install_count > 0
| KEEP host.ip, Esql.ssh_enabled_count, Esql.exec_installed_only_disabled_count, Esql.vib_force_install_count,
    Esql.message_values, Esql.log_file_path_values, Esql.first_seen, Esql.last_seen