Use Observability Pipelines’ Sumo Logic Hosted Collector source to receive logs sent to your Sumo Logic Hosted Collector. Select and set up this source when you set up a pipeline.

Prerequisites

To use Observability Pipelines’ Sumo Logic source, you have applications sending data to Sumo Logic in the expected format.

To use Observability Pipelines’ Sumo Logic destination, you have a Hosted Sumo Logic Collector with a HTTP Logs source, and the following information available:

• The bind address that your Observability Pipelines Worker will listen on to receive logs. For example, 0.0.0.0:80.
• The URL of the Sumo Logic HTTP Logs Source that the Worker will send processed logs to. This URL is provided by Sumo Logic once you configure your hosted collector and set up an HTTP Logs and Metrics source.

See Configure HTTP Logs Source on Sumo Logic for more information.

Set up the source in the pipeline UI

Select and set up this source when you set up a pipeline. The information below is for the source settings in the pipeline UI.

Optionally, in the Decoding dropdown menu, select whether your input format is raw Bytes, JSON, Graylog Extended Log Format (Gelf), or Syslog. If no decoding is selected, the decoding defaults to JSON.

Enviar logs al worker de Observability Pipelines a través de la fuente HTTP de Sumo Logic

Después de instalar el worker de Observability Pipelines y desplegar la configuración, el worker expone tres endpoints HTTP que utilizan la API de la fuente HTTP de Sumo Logic.

Para enviar logs a tu fuente HTTP de Sumo Logic, debes apuntar tus logs existentes ascendentes al worker:

curl -v -X POST -T [local_file_name] http://<OPW_HOST>/receiver/v1/http/<UNIQUE_HTTP_COLLECTOR_CODE>

<OPW_HOST> es la IP/URL del host (o balanceador de carga) asociado con el worker de Observability Pipelines. Para instalaciones de CloudFormation, el resultado LoadBalancerDNS de CloudFormation tiene la URL correcta a utilizar. Para instalaciones de Kubernetes, puede utilizarse el registro DNS interno del servicio del worker de Observability Pipelines. Por ejemplo: opw-observability-pipelines-worker.default.svc.cluster.local.

<UNIQUE_HTTP_COLLECTOR_CODE> es la cadena que sigue a la última barra inclinada (/) en la URL de carga de la fuente HTTP que proporcionaste en el paso Instalar el worker de Observability Pipelines.

En este punto, tus logs deberían dirigirse al worker, ser procesados por el pipeline y ser enviados al destino configurado.