Skip to main content

Choosing a Sumo Logic Collector and Source

To send your data to Sumo Logic, you have a few options. We have two types of installed agents and offer a collector fully hosted by us.


You cannot delete the individual log lines once they are ingested and stored in the service. Hosted services are designed to protect logs from being changed because they are supposed to be immutable. However, data sets for a specific time range within a data partition can be deleted. If you need surgical removal of log lines from view, you can use the keyword searches as Role Filters.

An administrator can set up a role filter, but other administrators in the your environment with the appropriate rights can reverse it. Alternatively, the Sumo Logic engineering team can implement a role filter that is invisible and unchangeable by any users, including admins.

Sumo Logic Collectors

OpenTelemetry Distribution (Installed Agent)

Distribution of OpenTelemetry is the next-generation agent for data collection.

The Sumo Logic Distribution for OpenTelemetry Collector is built with the opentelemetry-collector-builder and provides a single unified agent to send Logs, Metrics, Traces, and Metadata to Sumo Logic.

Refer to Sumo Logic Distribution for OpenTelemetry Collector documentation for more information.

It's supported on Linux, macOS, Windows, and Kubernetes environments and can use any of the following Sources:

  • Local File
  • Host/Process Metrics
  • Windows Log Event
  • HTTP Traces
  • Syslog
  • HTTP with OTLP formats
  • And more than 60 ways to collector logs, metrics and traces.

For full details on limitations, what's supported, and what's different see our comparison documentation.

Installed Collectors (Installed Agent)

Installed Collectors are lightweight and efficient. You can choose to install a small number of Collectors to minimize maintenance or to keep your topology simple. Alternatively, you can choose to install many Collectors on many machines to distribute the bandwidth impact across your network rather than having it centralized.

Installed Collectors are deployed in your environment, on a local machine, a machine in your organization, or even an Amazon Machine Image (AMI). Installed Collectors require a software download and installation. Upgrades to Collector software are released regularly by Sumo Logic.

Consider having an Installed Collector on a dedicated machine when:

Consider having more than one Installed Collector if:

  • You expect the Collector to ingest from at least 500 separate files.
  • Your hardware has memory or CPU limitations.
  • You expect combined logging traffic for one Collector to be higher than 15,000 events per second.
  • Your network clusters or regions are geographically separated.
  • You prefer to install many Collectors, for example, one per machine to collect local files.

To help design your deployment see how Installed Collectors work and Best Practices: Local and Centralized Data Collection.

For details on system requirements, see Installed Collector requirements.

Compare Installed Collectors and OpenTelemetry Collectors​

The Installed Collector and OpenTelemetry Collector are two popular collectors used for collecting metrics, traces, and logs from various sources. While both collectors have their own unique features and advantages, there are some key differences between them.

Installed Collector. The Installed Collector is a standalone agent that runs on Linux, MacOS, Kubernetes, and Windows platforms. It supports a wide range of sources, including Local File, Syslog, Host/Process Metrics, Streaming Metrics, Transaction Tracing, and many more. It also provides support for remote management and configuration, Ingest Budgets, Collector Management API, and CPU targets.

OpenTelemetry Collector. The OpenTelemetry Collector is a single-agent management solution that runs on Linux, MacOS, Kubernetes, and Windows platforms. It supports sources such as Local File, Syslog, Host/Process Metrics, Streaming Metrics, and Transaction Tracing. However, it does not provide support for remote management or configuration, Ingest Budgets, Collector Management API, or CPU targets.

When to Choose Installed Collector vs. OpenTelemetry Collector

The following table shows the comparison between the Installed Collector and OpenTelemetry Collector based on their supported platforms and sources, and their ideal use cases.

Collector TypeSupported PlatformsSupported SourcesIdeal Use Cases
Installed CollectorLinux, MacOS, Kubernetes, Windows
  • Local/Remote File
  • Syslog
  • Host/Process Metrics
  • Transaction Tracing
  • Windows Log Event
  • Windows Active Directory Source
  • Windows Performance Counters Receiver
  • Script Sources/Actions
  • Docker Stats / Logs
  • Remote management for collection configuration
  • Ingest Budgets
  • Collector Management API (CRUD operations)
OpenTelemetry CollectorLinux, MacOS, Kubernetes, Windows
  • Local File
  • Syslog
  • Host/Process Metrics
  • OTLP(OpenTelemtry Protocol) Receiver
  • Transaction Tracing
  • Windows Log Event Receiver
  • Windows Performance Counters Receiver
  • Docker Stats / Logs
  • Kafka
  • MongoDB
  • Journald
  • Kubernetes
  • And more than 60 additional way to collect logs, metrics and traces
  • Unify collection to Single software for logs, metrics and traces
  • Scale issues with FluentD on Kubernetes Collection
  • Custom data filtering and transform capabilities
  • Using Chef, Puppet, Ansible to manage collectors

Hosted Collectors

Hosted Collectors reside in the Cloud allowing for seamless collection from Amazon Web Services, Google, Microsoft, and many other Cloud services.

Unlike Installed Collectors, Hosted Collectors do not require installation or activation, nor do Hosted Collectors have physical requirements since they're hosted by Sumo Logic in AWS.

Because there are no performance issues to consider, you can configure as many Sources as you'd like, up to 1,000, for a single Hosted Collector. Consider setting up more than one Hosted Collector if you'd like to tag different data types with different metadata.

See how to configure a Hosted Collector and all of the available Sources supported on Hosted Collectors.

Logging levels

The more sensitive the logging level settings are for your applications and devices, the more logs will be sent to the Sumo Logic Cloud. In order to maximize the value of your log collection and analysis, set the logging level as high as you can without negatively impacting the CPU utilization of the machine where the Collector is running. The more searchable data you collect, the more information you have for forensic analysis and troubleshooting.

If you have additional questions, a Sumo Logic sales representative can help determine specific recommendations for your installation.

Compare Installed and Hosted Collectors

Depending on the method you'd like to collect logs, and the types of logs you'd like to collect, Sumo Logic has two types of Collectors you can choose from. Learn how to choose your collector that's right for your environment through our video, "Choosing Your Collector Type".

The following table shows the major differences between them.

Installed CollectorHosted Collector
  • Installed on a system within your deployment locally or remotely.
  • Sources collect data available in your deployment.
  • Easy to troubleshoot based on Collector logs.
  • Supports using Local Configuration File Management so you can use JSON files to configure Sources.
  • Hosted by Sumo Logic. Agentless: no software to install or activate on a system in your deployment.
  • Hosts Sources to collect seamlessly from AWS, Google, and Microsoft products.
  • Can receive logs and metrics uploaded via a URL.

Sumo Logic Sources


Sources are the environments that Sumo Logic Collectors connect to collect data from your site. Each Source is configured to collect files in a specific way, depending on the type of Collector you're using.

When registering a Collector, you also have the option of configuring the Collector using a Source JSON file.


The maximum number of Sources allowed on a Collector is 1,000.

Allowlisting Sources that collect from AWS 

If you're configuring a Source that collects from Amazon Web Services (AWS), you may need to allowlist AWS IP addresses. AWS makes current IP address ranges available in JSON format. Amazon advises that this file changes several times a week.

In particular, you'll need to allowlist the IP address associated with your Sumo Logic endpoint.  For example, if your deployment is in the U.S., you'll need to allowlist the us-east region IP addresses.  See Sumo Logic Endpoints and Firewall Security for information on determining your endpoint.

For details on how the file is updated, its use, its syntax, and to download the JSON file, refer to the AWS documentation

Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.