Skip to main content
Sumo Logic

AWS Metadata (Tag) Source for Metrics

The Sumo Logic AWS Metadata Source automatically collects tags for all of your EC2 instances running on AWS, and merges them with all of the metrics that you send to Sumo Logic that come from EC2 instances, or apps running on EC2 instances.  You can then use these merged key-value pairs when you run a metric query, and view all of the merged tags as columns in the Legend section of the metric query tab. For information about assigning tags to EC2 instances, see Tagging Your Amazon EC2 Resources in AWS help.

When you run a metric query, the tags associated with the queried metric will appear as columns in the Legend section of the metric query tab.

These tags are automatically applied to your metrics ingested from other metrics sources, except for an HTTP source. Metrics ingested from an HTTP source need to have the tags InstanceID and Region added. You can add them in the header with X-Sumo-Dimensions or X-Sumo-Metadata as well as to the metric itself. For reference see Other Supported HTTP Headers.

Only one AWS Metadata Source is required to collect tags from multiple hosts.

Set up an AWS metadata source

To set up an AWS Metadata Source for metrics:

  1. Grant permission for Sumo Logic to describe EC2 instances. We recommend the following custom policy.
   "Version": "2012-10-17",
   "Statement": [
           "Action": [
           "Effect": "Allow",
           "Resource": "*"
  1. In Sumo Logic select Manage Data > Collection > Collection
  2. Next to a Hosted Collector, click Add Source.
  3. Select AWS Metadata.
  4. Configure the following:
  • Name. Enter a name to display for the new Source.
  • Description. Optional description.
  • Regions. Select one or more Amazon regions.
  • Tag Filters.  Leave this field blank to collect all tags configured for the EC2 instance. To collect a subset of tags, follow the instructions in Define EC2 tag filters
  • Access Key ID. Enter the AWS Access Key ID number granted to Sumo Logic.
  • Secret Access Key. Enter the AWS Secret Access Key granted to Sumo Logic.
  1. Click Save.

Define EC2 tag filters 

Define your filter to match against your tag. For instance, in a key value pair define the filter to match against the key, not the value. If you do not define tag filters, all tags configured for your EC2 instances will be collected.

If you want to collect a subset of tags, you can enter a comma-separated list of one or more of the following types of filters:

  • One or more specific tag names, for example, “Cluster, Deployment, Name”
  • A wildcard filter, for example, “dev-*”
  • An exclusion (blacklist) filter, which begins with an exclamation mark, for example, ”!master-container” or “!prod-*”

 For example, assume that the tags configured for your EC2 instances are:

  • Cluster
  • Deployment
  • DeployStatus
  • Name

The table below shows the results of several example tag filters 

This tag filter value Results in collection of these tags
!DeployStatus Cluster
!Dep* Cluster
Deploy*, !DeployStatus, Cluster  Cluster