Skip to main content
Sumo Logic

Custom Data Filters

You can specify keywords or metadata fields that you want to associate with all searches and dashboards in an application by using custom data filters, which you configure during the application installation, under Data Source Mapping.

Here are some examples.

  • To associate an application with log messages from the collector "US-West", enter a custom data filter of 
    "_collector=US-West".
  • To associate an application with log messages that use any source category that starts with "Prod", enter a custom data filter with a wildcard, such as 
    "_sourceCategory=Prod*".
  • To associate an application with log messages that include the keyword "dev-us" , enter a custom data filter of
    "dev-us".
  • You can also enter logical expressions with keywords and metadata tags. (All logical expressions should be surrounded by parenthesis.) For example, to associate an application with log messages from all hosts that begin with "stage-EMEA" and are from sources that begin with the word "Apache", enter a custom data filter of
    (_sourceHost=stage-EMEA* AND _source=Apache*).