Skip to main content
Sumo Logic

Ingest Budgets

Ingest budgets control the capacity of daily ingestion volume sent to Sumo Logic from Collectors. Collectors can be assigned to an ingest budget that defines a daily capacity limit. When an ingest budget's capacity is reached you can have the Collectors assigned to it stop ingesting data to control costs.

Ingest budgets automatically reset their capacity utilization tracking every 24 hours based on the time and time zone you specify. For example, you can schedule an ingest budget to refresh every day at 02:00 in the America/Los_Angeles time zone. You can manually reset an ingest budget at any time.

When an ingest budget's capacity has reached 100% its assigned Collectors will stop sending data and the event is audited. When an ingest budget triggers Collectors assigned to it to stop sending data, the data is not automatically recovered or ingested later once the capacity tracking is reset. To track and schedule alerts on ingest budget capacity-usage and resets see audit ingest budgets.

Rules

  • A Collector can be assigned to one ingest budget.
  • Installed Collectors must be version 19.227-14 or higher.
  • There is a limit of 20 ingest budgets.
  • Use the IANA time zone database.
  • Specify the time in HH:MM format.
  • Ingest budgets requires the Manage Budgets role capability. Enabling this will automatically enable the Manage Collectors capability. The Manage Collectors capability on its own permits the re-assignment of budgets to different Collectors, but not creating or deleting them.

Set up an ingest budget

  1. Use the Ingest Budget Management API to create a new ingest budget. This API supports viewing, creating, updating, and deleting ingest budgets. To use the API view the API's documentation by clicking one of the following links based on your organization's deployment.

    Sumo Logic has several deployments that are assigned depending on the geographic location and the date an account is created. See how to determine which endpoint to use if you are unsure.

    Select the documentation link for your deployment:

  2. Now that you have created an ingest budget you can assign a Collector to it. See assign Collector to ingest budget for details.

Audit ingest budgets

The Audit Index logs events when an ingest budget has exceeded or reached 85 percent of its set capacity limit. When the utilized capacity is below 85 percent no audit logs are available.

Example audit log when an ingest budget is approaching or exceeding capacity, where:

  • budget_name is the name of the ingest budget.
  • budget_value is the ingest budget's value.
  • Usage status is either Approaching (≥ 85%) or Exceeded (≥ 100%) its set capacity limit.
Budget budget_name with field value budget_value consumed 6330.00% of capacity since last reset at 2018-09-17T13:38:53.663 -0700.
Capacity: 200 bytes
Usage: 12660 bytes
Usage status: Exceeded
Action: drop_data
Next reset: 2018-09-18T13:35:00.000 -0700

Example audit log when an ingest budget is reset, where budget_name is the name of the ingest budget and budget_value is the ingest budget's value:

Budget budget_name with field value budget_value consumed 0.00% of capacity and is reset at 2018-09-18T00:03:34.574 -0700.
Capacity: 1000 bytes
Usage: 0 bytes
Next reset: 2018-09-19T00:00:00.000 -0700
Audit Index queries

You can schedule the following searches to get alerts when needed, see scheduled searches for details.

Search for both audit logs:

_index=sumologic_audit _sourceName=VOLUME_QUOTA _sourceCategory=account_management "Budget" "reset"

Search for only reset logs:

_index=sumologic_audit _sourceName=VOLUME_QUOTA _sourceCategory=account_management "Budget" "is reset"

Search for only capacity usage logs:

_index=sumologic_audit _sourceName=VOLUME_QUOTA _sourceCategory=account_management "Budget" "last reset"