Skip to main content
Sumo Logic

About Data Forwarding

Sumo Logic supports the following types of Data Forwarding:

  • From Sumo Logic to Amazon S3
  • From an Installed Collector

Data Forwarding from the Sumo Logic Service

If you have the Administrator role, you can configure Sumo Logic to forward data to a third-party destination. We currently support Data Forwarding to AWS S3. If you have a need for additional destinations, please create a request in our Ideas portal

Messages are buffered during data ingest for approximately 5 minutes, or until 100MB of data is received.  The messages are then added to a CSV, compressed with .gzip, and forwarded to the target destination. For AWS S3 destinations, Each CSV file is stored as a new file in the S3 bucket, even if the file only contains updates.

Different Data Forwarding configurations can be defined for each data partition.  For each data partition, you can specify which Data Forwarding Destination to use, and specify a specific naming pattern.

See Grant Access for Data Forwarding from Sumo Logic to S3 for instructions on granting access for Data Forwarding to Amazon S3, and Configure Data Forwarding from Sumo Logic to S3 for instructions on setting up forwarding to an S3 bucket.

Data Forwarding from an Installed Collector 

You can set up non-Sumo Logic destinations so that data from specified Sources is forwarded to them at the same time it is sent to Sumo Logic. In this way, the data is made available immediately to all the systems that need to consume it.

Sumo Logic supports forwarding data using the following protocols:

  • Syslog (TCP and UDP)
  • Hitachi Data Systems HTTP REST API

You can set up Data Forwarding when you first configure Sources or at a later time. If you apply rules at a later time, keep in mind that they are not applied retroactively.

Two tasks are required to set up Data Forwarding:

  1. Configure the Data Forwarding Destinations. These configurations are reusable across multiple Sources.
  2. Configure a processing rule for each Source to use a predefined Data Forwarding Destination. You must configure each Source separately, even if you are forwarding data from multiple Sources to the same destination.

As soon as you save the rules, Sumo Logic begins to apply them as new data is collected.

Use the Sumo Logic Web Application to set up the Data Forwarding Destinations, and then use the Web Application, the Collector Management API, or local Source configuration files to configure the processing rules to use one of the defined Data Forwarding Destinations.

For more information, see the following topics: