Versions involved are vRLI 4.5 and vROps 6.6. The vRLI agent is installed on a VM which is being monitored by vROps. Integrations are configured between the two products. One can view the logs of the VM from within vROps successfully. The logs sent by the vRLI agent to vRLI have the correct vROps ID embedded. But when configuring an alert based on a query for this VM that goes to vROps, it never associates the alert inside vROps with the correct object, always with the fallback object. The query was tested with both the "hostname" field or "vmw_vr_ops_id" field, and neither was successful. The alert is configured to fire when less than X events received in Y time. What are some troubleshooting steps to follow in these cases?
Edited to show fields involved in query and alert.