Skip to main content
Sumo Logic

Local Configuration File Management

With Local Configuration File Management, all configuration is done through a configuration file. You cannot use the API or the Web Application to modify the configuration. In the Web Application, the Add Source option is disabled on the Manage > Collection > Collection (Manage > Collection in the classic UI) page.

There are two ways to implement Local Configuration File Management: a Single JSON File or a Single Source Folder.

Single JSON File

  • Create a single JSON file with the configuration information for all the Sources.  For example JSON configurations, see Use JSON to Configure Sources.  The topic includes a table of common parameters that apply to all Source types and links to the topics that describe the parameters for specific Source types.
  • Configure the syncSources parameter to point to the single JSON file.
  • The configuration file remains on the Collector, and is checked nearly constantly for any changes.

When creating a single JSON files for all sources, the JSON file should define a "sources" JSON array containing the source definitions. For example, an individual local source file could be defined as:

{
   "api.version":"v1",
   "sources":[
      {
         "sourceType":"LocalFile",
         "name":"Example1",
         "pathExpression":"/var/logs/maillog",
         "blacklist":["/var/log/*log1.log"]
      },{
         "sourceType":"LocalFile",
         "name":"Example2",
         "pathExpression":"/var/logs/syslog",
         "blacklist":[]
      }
   ]
}

Single Source Folder 

  • Create individual JSON files, one for each Source, and then combine them in a single Source folder. For example JSON configurations, see Use JSON to Configure Sources.  The topic includes a table of common parameters that apply to all Source types and links to the topics that describe the parameters for specific Source types.
  • Configure the syncSources parameter to point to the Source folder.
  • The configuration files remain on the Collector, and are checked nearly constantly for any changes.

When creating a folder of individual JSON files per source, each JSON file should define a "source" object instead of the "sources" JSON array.  

Additionally, each JSON file must have .json extension, for example:

source1.json

{
   "api.version":"v1",
   "source":{
      "sourceType":"LocalFile",
      "name":"Example1",
      "pathExpression":"/var/logs/maillog",
      "blacklist":[
         "/var/log/*log1.log"
      ]
   }
}


To set up new Collectors and Sources see Local Configuration File Management for New Collectors and Sources

To convert existing Sources from Cloud Management to Local Configuration File Management see Local Configuration File Management for Existing Collectors and Sources.

Why should I choose Local Configuration File Management?

If you’re an experienced Admin, local configuration file management is a quick way to set up or edit Sources across your Deployment.

  • You don’t need to log in to the Sumo Logic Web Application or use API calls. Instead, you can make changes to the configuration file, and they are picked up by Sources almost immediately.
  • If you have a large scale deployment, it can be impractical to add or edit Sources at one time. Using local configuration management allows you to manage both more easily.
  • You can use deployment tools so that established policies for deployments are not interrupted.

Before you Begin

  • Test your config file. Errors in the JSON can cause problems, including deleting Sources. Before deploying the config file to production Collectors, it’s a good idea to verify the process on a test machine.
  • Understand that your ongoing management options are different. After you switch over to Local Configuration File Management, you can no longer manage Sources through the Web Application and the Collector Management API.
  • Check the version of Collector software installed. This management option is available on vi19.108 and later.