Skip to main content
Sumo Logic

Local Configuration File Management

With local configuration file management, you configure sources for a collector in one or more JSON files.

After you switch over to Local Configuration File Management, you can no longer manage sources through the Sumo web app or the Collector Management API. In the Sumo web application, the Add Source option is disabled on the Manage Data > Collection > Collection (Manage > Collection in the classic UI) page.

Benefits of local configuration file management

If you’re an experienced admin, local configuration file management is a quick way to set up or edit sources across your deployment.

  • You don’t need to log in to the Sumo web app or use API calls. Instead, you edit the configuration file(s), and they are picked up by Sources almost immediately.
  • If you have a large scale deployment, it can be impractical to add or edit sources one at time. Using local configuration management allows you to manage sources more easily.
  • You can use deployment tools so that established policies for deployments are not interrupted.

Options for specifying sources in local configuration file(s) 

There are two ways to implement local configuration file management:

  • Specify all sources in a single JSON file. 
  • Use multiple JSON files to specify your sources, and put all of those files in a single folder. You can put each source definition in own file, or define multiple sources per file, if you like. 

Each JSON file must have a .json extension, for example:

source1.json

For example JSON configurations, see Use JSON to Configure Sources. The topic includes a table of common parameters that apply to all Source types and links to the topics that describe the parameters for specific Source types.

The configuration files remain on the collector, and are checked nearly constantly for any changes.

Define one source in a JSON file

 This is an example of a JSON file that defines a single source.

{
  "api.version":"v1",
  "source":{
     "sourceType":"LocalFile",
     "name":"Example1",
     "pathExpression":"/var/logs/maillog",
     "blacklist":[
        "/var/log/*log1.log"
     ]
  }
}

Define multiple sources in a JSON file

When you define multiple sources in a JSON file, you can define each source in a sources JSON array.

{
  "api.version":"v1",
  "sources":[
     {
        "sourceType":"LocalFile",
        "name":"Example1",
        "pathExpression":"/var/logs/maillog",
        "blacklist":["/var/log/*log1.log"]
     },{
        "sourceType":"LocalFile",
        "name":"Example2",
        "pathExpression":"/var/logs/syslog",
        "Blacklist":["/var/log/*log1.log"]
     }
  ]
}

To set up new Collectors and Sources see Local Configuration File Management for New Collectors and Sources

To convert existing Sources from Cloud Management to Local Configuration File Management see Local Configuration File Management for Existing Collectors and Sources.

Configure the location of JSON file or folder

When using local file configuration, you specify the location of the JSON file, or the folder that contains multiple JSON files, in the collector’s config/user.properties file. There are two properties for pointing to your configuration file or folder:

  • syncSources. Use syncSources to specify either the path to a folder of JSON files that define sources for a collector, or the path to JSON file that defines all of the sources for a collector. If you use syncSources, the source definitions you point to will be continuously monitored and synchronized with the collector's configuration. 
  • On *nix, to point to a JSON file that defines sources for a collector:
  • syncSources=/path/to/sources.json
  • On *nix, to point to a folder that contains JSON files that define sources for a collector:
  • syncSources=/path/to/sources-folder
  • On Windows (note the escaped backslashes), to point to a folder that contains JSON files that define sources for a collector:
  • syncSources=C:\\path\\to\\sources-folder\\
  • sources. Use sources to specify the path to a file that defines all of the sources for a collector. You can’t use sources to point to a folder of JSON files. If you use sources, the JSON file it points to will not be synchronized with the collector's configuration.
  • sources=/path/to/sources.json