Sumo Logic

SIEM Platform

Synopsis

The Sumo Logic target forwards events to a Sumo Logic Cloud SIEM HTTP Source collector over HTTPS. It handles batching and delivery — the event payload is expected to already be a complete JSON document in Sumo Logic's schema when it reaches the target.

Schema

- name: <string>
  description: <string>
  type: sumologic
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    url: <string>
    batch_size: <integer>
    timeout: <integer>
    field_format: <string>
    debug:
      status: <boolean>
      dont_send_logs: <boolean>

Configuration

The following fields are used to define the target:

Field	Required	Default	Description
name	Y		Target name
description	N	-	Optional description
type	Y		Must be sumologic
pipelines	N	-	Optional post-processor pipelines
status	N	true	Enable/disable the target

Connection

Field	Required	Default	Description
url	Y	-	Sumo Logic HTTP Source collector URL. The collector token is embedded in the URL, e.g. `https://<endpoint>.collection.sumologic.com/receiver/v1/http/<UNIQUE_CODE>`. There is no separate auth header

Batch Configuration

Field	Required	Default	Description
batch_size	N	1000	Maximum events per POST, serialized as newline-delimited JSON
timeout	N	30	HTTP client timeout, in seconds

Processing

Field	Required	Default	Description
field_format	N	-	Optional target-side normalization format applied before delivery. Typically left empty, since the payload already arrives in Sumo Logic's JSON schema from upstream processing. See applicable Normalization section

Scheduling

See Scheduling and Pool Behavior for interval and cron fields shared by all targets.

Debug Options

Field	Required	Default	Description
debug.status	N	false	Enable debug logging
debug.dont_send_logs	N	false	Process logs but don't send to target (testing)

Details

This target is transport-only: it does not render Sumo Logic's log schema itself. It expects each event to already be a complete JSON document when it reaches the target, buffers events in memory, and delivers them as one HTTP POST — newline-delimited JSON, one document per line — once batch_size is reached or during finalization.

Endpoint and Authentication

The url is the Sumo Logic HTTP Source collector URL; the collector access token is embedded directly in the URL path, so no separate authentication header is sent. Configuration validation rejects a target with no url.

Batching and Retry

Events buffer until batch_size is reached, then POST as a single request. A failed POST does not retry the batch internally: the buffer is cleared unconditionally after Finalize, and delivery failure is surfaced to the sender pool, which handles redelivery through the JetStream layer. Retaining the batch locally in addition to that redelivery would duplicate events at the destination. Error responses include up to the first 1 MB of the response body for troubleshooting.

note

The target does not render Sumo Logic's JSON schema — it only batches and delivers the payload it receives. Format the event as Sumo Logic-compatible JSON before it reaches this target.

Examples

Basic Configuration

Sending JSON events to a Sumo Logic HTTP Source collector...

targets: - name: sumologic type: sumologic properties: url: "https://endpoint1.collection.sumologic.com/receiver/v1/http/UNIQUE_CODE"

Secret-Based URL

Keeping the collector URL, which embeds the access token, out of the config file...

targets: - name: sumologic-secure type: sumologic properties: url: "${SUMOLOGIC_HTTP_SOURCE_URL}" batch_size: 500 timeout: 45

High-Volume Configuration

Increasing the batch size for high-volume ingestion...

targets: - name: sumologic-high-volume type: sumologic properties: url: "${SUMOLOGIC_HTTP_SOURCE_URL}" batch_size: 5000 timeout: 30