Collect logs for the Acquia App

Cloud syslog configuration requires a token that is automatically generated when you configure a cloud syslog source. The token allows Sumo to distinguish your log messages from those of other customers. The token is tied to the source, but not to any specific user. 

Include the token as the Structured ID in every syslog message that is sent to Sumo Logic. The token is removed by Sumo Logic during ingestion and is not included with your syslog message in search results.

The token is deleted if you delete the source. To change a token, use the Regenerate Token option as described in the following procedure.

To configure a cloud syslog source, do the following:

1. In Sumo Logic select Manage Data > Collection > Collection.
2. On the Collection page, click Add Source next to a Hosted Collector.  See Set up a Hosted Collector for information on adding Hosted Collectors.
3. Select Cloud Syslog.
4. Enter a Name to display for this source in Sumo. Description is optional.
5. (Optional) For Source Host and Source Category, enter any string to tag the output collected from this source. (Category metadata is stored in a searchable field called _sourceCategory.)
6. Fields. Click the +Add Field link to add custom log metadata Fields.
   • Define the fields you want to associate, each field needs a name (key) and value. 
     •  A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema.
     •  An orange triangle with an exclamation point is shown when the field doesn't exist, or is disabled, in the Fields table schema. In this case, an option to automatically add or enable the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema or is disabled it is ignored, known as dropped.
7. Set any of the following under Advanced:

• Enable Timestamp Parsing. This option is selected by default. If it's deselected, no timestamp information is parsed.
• Time Zone. There are two options for Time Zone. You can use the time zone present in your log files, and then choose an option in case time zone information is missing from a log message. Or, you can have Sumo Logic completely disregard any time zone information present in logs by forcing a time zone. It's important to have the proper time zone set, no matter which option you choose. If the time zone of logs can't be determined, Sumo Logic assigns the UTC time zone; if the rest of your logs are from another time zone your search results will be affected.
• Timestamp Format. By default, Sumo will automatically detect the timestamp format of your logs. However, you can manually specify a timestamp format for a source. See Timestamps, Time Zones, and Time Ranges, and Date Formats.

8. Create any Processing Rules you'd like for the new source.
9. Click Save.
   The token information is displayed in a read-only dialog box, shown below.
   
    
10. Click Copy to copy the information for use in the syslog client. The information is copied in the following format:
    
    Token: 9HFxoa6+lXBmvSM9koPjGzvTaxXDQvJ4POE/WCURPAo+w4H7PmZm8H3mSEKxPl0Q@41123, Host: syslog.collection.YOUR_DEPLOYMENT.sumologic.com, TCP TLS Port: 6514
    
    The number 41123 in the token is the Sumo Private Enterprise Number (PEN). There are two options for including the token. You can include it in the structured data field or in the message body. 
    
    In the following example, the token is in the structured data field. 
    
    <165>1 2015-01-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [YOUR_TOKEN] msg
    
    In the following example, the token is in the message body.
    
    <165>1 2015-01-11T22:14:15.003Z mymachine.example.com evntslog - ID47 - YOUR_TOKEN msg
11. After configuring the source, you can perform these token operations from the Collectors and Sources page:

• Click Show Token to display the token for a cloud syslog source at any time. 
  
• Click Regenerate Token if you need to generate a new token.