Sumo Collection Source

Sumo Logic enables you to seamlessly gather and analyze valuable insights from diverse sources. By leveraging its robust API capabilities, you can efficiently extract, transform, and load data into your analytics pipeline. This streamlined process allows you to harness the power of real-time data analysis, improving decision-making, troubleshooting, and overall operational efficiency within your organization.

Data collected

Polling Interval	Data
12 hours	Collector API
5 minutes	Source API

Setup

Vendor configuration

The Sumo Collection source requires you to provide the Deployment, Access ID, and Access Key to access the data.

Deployment

Identify your Deployment region based on your Base URL. The deployment region can be selected from the list below.

Region	URL
AU	`https://api.au.sumologic.com/`
CA	`https://api.ca.sumologic.com/`
DE	`https://api.de.sumologic.com/`
EU	`https://api.eu.sumologic.com/`
FED	`https://api.fed.sumologic.com/`
IN	`https://api.in.sumologic.com/`
JP	`https://api.jp.sumologic.com/`
KR	`https://api.kr.sumologic.com/`
US1	`https://api.sumologic.com/`
US2	`https://api.us2.sumologic.com/`

Access ID and Access Key

To generate the Access ID and Access Key, refer to Create an access key.

Source configuration

When you create a Sumo Collection Source, you add it to a Hosted Collector. Before creating the Source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see Configure a Hosted Collector and Source.

To configure a Sumo Collection Source:

Classic UI. In the main Sumo Logic menu, select Manage Data > Collection > Collection.
New UI. In the Sumo Logic top menu select Configuration, and then under Data Collection select Collection. You can also click the Go To... menu at the top of the screen and select Collection.
On the Collection page, click Add Source next to a Hosted Collector.
Search for and select Sumo Collection.
Enter a Name for the Source. The description is optional.
(Optional) For Source Category, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called _sourceCategory.
(Optional) Fields. Click the +Add button to define the fields you want to associate. Each field needs a name (key) and value.
- A green circle with a check mark is shown when the field exists in the Fields table schema.
- An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo Logic that does not exist in the Fields schema is ignored, known as dropped.
Deployment. Select the deployment region from the dropdown. For example, AU.
Access ID. Enter the Access ID collected from the vendor configuration. For example, sug2lhtaa1g6xk.
Access Key. Enter the Access Key collected from the vendor configuration. For example, 00xxxxxx-xxx2-9316-7xx42xxx1x41.
(Optional) Collector Type. Select the type of collector: Installed and/or Hosted.
Collector API Interval. Set how often the source needs to check for new collector data. The polling interval is set for 12 hours by default. You can adjust it based on your needs.
(Optional) Collect Source Details. Check the box to collect the source details.
1. Source API Interval. Set how often the source needs to check for new source data. The polling interval is set for 5 minutes by default. You can adjust it based on your needs.
(Optional) Processing Rules for Logs. Configure any desired filters, such as allowlist, denylist, hash, or mask, as described in Create a Processing Rule.
When you are finished configuring the Source, click Save.

JSON schema

Sources can be configured using UTF-8 encoded JSON files with the Collector Management API. See Use JSON to Configure Sources for details.

Parameter	Type	Value	Required	Description
schemaRef	JSON Object	`{“type”: “Sumo Collection”}`	Yes	Define the specific schema type.
sourceType	String	`"Universal"`	Yes	Type of source.
config	JSON Object	Configuration object	Yes	Source type specific values.

Configuration Object

Parameter	Type	Required	Default	Description	Example
name	String	Yes	`null`	Type a desired name of the source. The name must be unique per Collector. This value is assigned to the metadata field `_source`.	`"mySource"`
description	String	No	`null`	Type a description of the source.	`"Testing source"`
category	String	No	`null`	Type a category of the source. This value is assigned to the metadata field `_sourceCategory`. See best practices for details.	`"mySource/test"`
fields	JSON Object	No	`null`	JSON map of key-value fields (metadata) to apply to the collector or source. Use the boolean field `_siemForward` to enable forwarding to SIEM.	`{"_siemForward": false, "fieldA": "valueA"}`
deployment	String	Yes	`null`	The Sumo Logic base URL of your region.	`https://api.au.sumologic.com/`
accessId	String	Yes	`null`	The access ID of your Sumo Logic account.	`sug2lhtaa1g6xk`
accessKey	String	Yes	`null`	The access key of your Sumo Logic account.	`00xxxxxx-xxx2-9316-7xx42xxx1x41`
collectorType	String	No	`null`	The type of collectors.	`Installed`
pollingIntervalCollectorHour	Integer	Yes	`12`	Time interval (in hours) after which the source will check for new data from the collector API. Default: 12 Min: 1 Max: 24
collectSources	Boolean	Yes	`False`	Collects the source details when enabled.
pollingIntervalSourceMin	Integer	Yes	`5`	Time interval (in minutes) after which the source will check for new data from the source API. Default: 5 Min: 1 Max: 60
filters	Array	No	`null`	An array of key-value pairs to filter the data. For key-value pairs, the length is set to 256 characters and the API accepts a maximum length of 1024 characters for the filter.

JSON example

{
	"api.version": "v1",
	"source": {
		"config": {
                	"name": "Sumologic Collection",
                    "deployment": "https://api.sumologic.com/api/",
                    "accessId": "sug2Ihtaa1g6xk",
                    "accessKey": "00xxxxxx-xxxx-xxx2-9316-7xx42xxx1x41",
                    "collectorType": [
                                        "installed",
                                        "dead",
                                        "hosted",
                                        "alive"
                                    ],
                    "collectSources": true,
                    "pollingIntervalCollectorHour": "12",
                    "pollingIntervalSourceMin": "5"

},
		            "schemaRef": {
            		            "type": "Sumo Collection"
        	                     },
        	        "sourceType": "Universal"
}}

Download example

Terraform example

resource "sumologic_cloud_to_cloud_source" "sumo-collection-source" {
  collector_id = sumologic_collector.collector.id
  schema_ref = {
    type = "Sumo Collection"
  }
  config = jsonencode({
                        "name": "Sumologic Collection",
                        "deployment": "https://api.sumologic.com/api/",
                        "accessId": "sug2Ihtaa1g6xk",
                        "accessKey": "00xxxxxx-xxxx-xxx2-9316-7xx42xxx1x41",
                        "collectorType": [
                                            "installed",
                                            "dead",
                                            "hosted",
                                            "alive"
                                        ],
                        "collectSources": true,
                        "pollingIntervalCollectorHour": "12",
                        "pollingIntervalSourceMin": "5"
                    })
}
resource "sumologic_collector" "collector" {
  name        = "my-collector"
  description = "Just testing this"
}

Download example

FAQ

info

Click here for more information about Cloud-to-Cloud sources.

Data collected​

Setup​

Vendor configuration​

Deployment​

Access ID and Access Key​

Source configuration​

JSON schema​

Configuration Object​

JSON example​

Terraform example​

FAQ​