Sumologic Cloudwatch Logs Lambda SourceHost and SourceName mapping

Comments

1 comment

  • Official comment
    Avatar
    Graham

    Hey Zachary,

    I reposting my team member Duc's reply from github so the community can see the answer:

    Source Name in the case of Sumo local files points to the exact file path, when the Sumo local file source (https://help.sumologic.com/Send-Data/Sources/01Sources-for-Installed-Collectors/Local-File-Source) uses a wildcard syntax. Source Host is the (source) hostname/ip and usually populated automatically by the Sumo collector, and overwritten by users explicitly when that value is not accurate (e.g "localhost")
    For Amazon contexts, I think the mapping is not 1 to 1 here. For example, logstream can point to a specific Network interface for VPC flow logs, in that case Source Name is the right match. LogGroup is trickier, by Amazon's definition, I personally think Source Category is a better match than Source Host. Of course, metadata can overlap or be duplicated, depending on your case. Feel free to modify the function, I do think it will need to be customized to the CWLogs it is collecting (e.g VPC Flowlogs will be different from diagnostic logs, etc.).

    Thanks!

    Comment actions Permalink

Please sign in to leave a comment.