Skip to main content
Sumo Logic

Amazon CloudFront Source

Amazon CloudFront is a content delivery network (CDN) that allows an easy way for companies to distribute content to end-users with low latency and high data transfer speeds. When logging is configured, CloudFront creates log files that contain detailed information about every user request that it receives. Add an Amazon CloudFront Source to upload these messages to Sumo Logic.

To configure an Amazon CloudFront Source:

  1. Grant Sumo Logic access to an Amazon S3 bucket.
  2. Enable CloudFront logging.
  3. Confirm that logs are being delivered to the Amazon S3 bucket.
  4. Add the AWS Source for CloudFront. See below for detailed steps. 
  5. Optional: Install the Sumo Logic App for Amazon CloudFront.

AWS Source

These configuration instructions apply to log collection from all AWS Source types. Select the correct Source type your specific Source in Step 3. For instructions on collecting CloudWatch metrics from Amazon, see Amazon CloudWatch Source for Metrics.

  1. In Sumo Logic select Manage Data > Collection > Collection (Manage > Collection in the classic UI). 
  2. On the Collectors page, click Add Source next to a Hosted Collector.
  3. Select your AWS Source type. 
  4. Enter a name to display for the new Source. Description is optional.
  5. For Bucket Name, enter the exact name of your organization's S3 bucket. 
    Be sure to double-check the name as it appears in AWS, for example:

    S3_Bucket_name.png
  1. For Path Expression, enter the string that matches the S3 objects you'd like to collect. A wildcard (*) can be used in this string. (Do NOT use a leading forward slash. See About Amazon Path Expressions for details). Remember that recursive path expressions use a single wild card.
  2. Collection should begin. Select a collection start time from the menu, or select All Time to collect all logs. 
  1. For Source Category, enter any string to tag the output collected from this Source. (Category metadata is stored in a searchable field called _sourceCategory.)
  2. For Key ID, enter the AWS Access Key ID number granted to Sumo Logic. (See Granting access to an S3 bucket for more information.)
  3. For Secret Key, enter the AWS Secret Access Key Sumo Logic should use to access the S3 bucket. (See Granting access to an S3 bucket for more information.)
  4. For Scan Interval, use the default of 5 minutes. Alternately, enter the frequency Sumo Logic will scan your S3 bucket for new data. To learn more about Scan Interval considerations, see About setting the S3 Scan Interval.
  5. If you need the Advanced options for timestamp and time zone you can set:
    • Enable Timestamp Parsing. This option is selected by default. If it's deselected, no timestamp information is parsed at all.
    • Time Zone. There are two options for Time Zone. You can use the time zone present in your log files, and then choose an option in case time zone information is missing from a log message. Or, you can have Sumo Logic completely disregard any time zone information present in logs by forcing a time zone. It's very important to have the proper time zone set, no matter which option you choose. If the time zone of logs can't be determined, Sumo Logic assigns logs UTC; if the rest of your logs are from another time zone your search results will be affected.
    • Timestamp Format. By default, Sumo Logic will automatically detect the timestamp format of your logs. However, you can manually specify a timestamp format for a Source. See Timestamps, Time Zones, Time Ranges, and Date Formats for more information.
  6. Enable Multiline Processing. Multiline processing is enabled by default. Use this option when you're working with multiline messages. 
    • Infer Boundaries. Infer boundaries is enabled by default. Use this option when you want Sumo Logic to automatically attempt to determine which lines belong to the same message. This may not be accurate for all log types. If you deselect the Infer Boundaries option, you will need to enter a regular expression in the Boundary Regex field to use for detecting the entire first line of multi-line messages.
    • Boundary Regex. You can specify the boundary between messages using a regular expression, when the infer boundaries option does not work. Enter a regular expression for the full first line of every multiline message in your log files.
      For example, if your CloudFront log message is of this format -
      2017-06-13    22:02:13    SYD1 ..............
       You could use this Boundary Regex -
      ^\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.*
      
      For more details, see Define Boundary Regex.
  7. Create any Processing Rules you'd like for the AWS Source.
  8. When you are finished configuring the Source click Save.