Comments

4 comments

  • Avatar
    Clint Davis

    We are using this to pull in "IIS" logs from our web apps. I've noticed that sometimes the lines come in as one message (example below). It seems to almost always happen when a new log file is created on the hour. The collector has infer line breaks enabled just like our other collectors on our physical machines importing IIS logs. I'm not sure if I have something misconfigured on the sumo side or this is just how it's going to be processing blob files.

     

    #Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
    2018-09-06 13:01:34 sitename GET /api/resources/health/8/0 X-ARR-LOG-ID=4e10ddfd-7f3e-4651-a39c-96703899adca 80 - 24.107.161.140 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/69.0.3497.81+Safari/537.36 - http://w2.www.edu/results?search=health host.net 200 0 0 1594 1015 814
    2018-09-06 13:01:34 sitename GET /api/documents/health/3/8/0 X-ARR-LOG-ID=7975b6ce-136e-4281-ad92-30b32476788b 80 - 24.107.161.140 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/69.0.3497.81+Safari/537.36 - http://w2.www.edu/results?search=health host.net 200 0 0 3910 1021 937
    2018-09-06 13:01:36 sitename GET /api/documents/health/2/8/0 X-ARR-LOG-ID=67f33aed-04e1-4049-ade2-e96ead3311dc 80 - 24.107.161.140 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/69.0.3497.81+Safari/537.36 - http://w2.www.edu/results?search=health host.net 200 0 0 2225 1021 2314
    2018-09-06 13:01:36 sitename GET /api/documents/health/4/8/0 X-ARR-LOG-ID=a3d7702d-def4-4258-9409-d191f1e37f8b 80 - 24.107.161.140 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/69.0.3497.81+Safari/537.36 - http://w2.www.edu/results?search=health host.net 200 0 0 2657 1021 2314
  • Avatar
    Apps SumoLabs

    Can you define Boundary Regex at Hosted collector setting and see if it works ?

     

    .*\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}.*

     

    http://sumologic.link/a729f5dbd9eb

     

  • Avatar
    Clint Davis

    That seemed to fix my issue! Thanks!

  • Avatar
    Apps SumoLabs

    Yayyyy

     

    Best,

    Ankit 

    Sumo Logic App Team

Please sign in to leave a comment.