Skip to main content
Sumo Logic

Local Configuration File Management for New Collectors and Sources

With Local Configuration File Management, you cannot use the API or the Web Application. In the Web Application, the Add Source option is disabled on the Manage > Collection page.

Step 1. Determine the Sources you’ll need

Depending on the data you’re planning to upload to Sumo Logic, there are several Sources you can configure. For details, see Sources.

Step 2. Build the Source JSON configuration file

The JSON configuration file allows you to define Sources for collection. For JSON configuration details, see Use JSON to Configure Sources

Existing Source Configuration

If you already have a Collector with sources configured, you can follow Step 1 from Local Configuration File Management for Existing Collectors and Sources to create a Source Configuration file.

New Source Configuration

For a single JSON file, the JSON file should define a "sources" JSON array containing the source definitions. For example, an individual local file source would be defined as:

{
   "api.version":"v1",
   "sources":[
      {
         "sourceType":"LocalFile",
         "name":"Example1",
         "pathExpression":"/var/logs/maillog",
         "blacklist":["/var/log/*log1.log"]
      },{
         "sourceType":"LocalFile",
         "name":"Example2",
         "pathExpression":"/var/logs/syslog",
         "blacklist":[]
      }
   ]
}

For a single Source Folder, each JSON file should define a source object instead of the sources JSON array.  For example, an individual local file source can be defined as:

{
   "api.version":"v1",
   "source":{
      "sourceType":"LocalFile",
      "name":"Example1",
      "pathExpression":"/var/logs/maillog",
      "blacklist":[
         "/var/log/*log1.log"
      ]
   }
}

Step 3. Install Collector with syncSources parameter

When installing the Collector, specify the syncSources parameter using your installation method from Step 2. Choose an Installation Method.

Parameter Type Description
syncSources String Sets the JSON file describing sources to configure on registration, which will be continuously monitored and synchronized with the Collector's configuration.

For example, for command-line installation using the Installer using Access Id and Access Key with SyncSources and Collector Name

sudo ./SumoCollector.sh -q -Vsumo.accessid=<accessId> -Vsumo.accesskey=<accessKey>

-VsyncSources=<filepath> -Vcollector.name=<name>

For legacy Collectors (versions prior to 19.137), make sure to add the syncSources parameter to the sumo.conf  file before starting the Collector for the first time.

Making changes to the configuration files

Single JSON File

When a Collector is registered with the syncSources parameter, you can edit the sources.json file at any time to modify Source attributes or to add new Sources. When you delete Sources from the file, the Sources are deleted from the Collector.

Single Source Folder

When a Collector is registered with the syncSources parameter, you can edit any of the JSON configuration to modify Source attributes. To add a new source, add a new JSON configuration file. When you delete a JSON configuration file, the Source is deleted from the Collector.

After you finalize changes to a JSON configuration file, test the changes by deploying it to a Collector on a host that is NOT in production. After the file is validated, deploy it to each host with Collector Sources that need to be modified by overwriting the existing JSON configuration file. Collectors continually watch the JSON configuration files for any changes and immediately process any changes.