Setting up Sumo Logic Log Delivery

RTLD may automatically deliver compressed log data to Sumo Logic by submitting HTTPS POST requests to it. Sumo Logic will collect these requests as they are pushed from the CDN. Each request contains a compressed JSON document that describes one or more log entries.

Learn more: RTLD CDN | RTLD Rate Limiting | RTLD WAF

The format for log data delivered to Sumo Logic is JSON Lines. This log format does not provide information that uniquely identifies a set of log data. As a result, there is no way to check for gaps in sequence numbers when attempting to identify missing log data.

To create a log delivery profile

  1. Set up Sumo Logic to listen for CDN log data in JSON format.

    1. Log in to Sumo Logic.
    2. Click Setup Wizard.

    3. Click Set Up Streaming Data.

    4. Click Your Custom App.

    5. Click HTTP Source.

    6. In the Source Category option, type the name of the tag that will be applied to CDN log data. This tag may be used to search for CDN log data within Sumo Logic.

    7. Click Continue. An HTTP Source for CDN log data will be created.
    8. Copy the URL associated with this HTTP Source.
  2. Navigate to the Real-Time Log Delivery CDN | Rate Limiting | WAF page. From the main menu, navigate to More and then find Real-Time Log Delivery under Analytics. Select either CDN, WAF, or RL.

  3. Click Add Profile.
  4. From the Log Delivery Method option, select Sumo Logic.
  5. In the Sumo Logic URL option, paste the URL associated with the HTTP Source created in step 1.
  6. From the Downsample the Logs option, determine whether all or downsampledReduces the amount of log data that will be delivered. For example, you may choose to only deliver 1% of your log data. log data will be delivered.

    • All Log Data: Verify that the Downsample the Logs option is disabled.
    • Downsampled Log Data: Downsample logs to 0.1%, 1%, 25%, 50%, or 75% of total log data by enabling the Downsample the Logs option and then selecting the desired rate from the Downsampling Rate option.

      Use this capability to reduce the amount of data that needs to be processed or stored by Sumo Logic.
      RTLD CDN Only: Downsampling log data also reduces usage charges for this service.

  7. Log delivery setup varies according to whether you are delivering log data for CDN traffic, threats identified by WAF, or rate limited requests.

  8. Set the Log Delivery Enabled option to the "on" position.

  9. Click Save.
More Information