Grok Deprecation Notice

On April 23, 2026, Sumo Logic deprecates the Grok parsing service. Sumo Logic parsers and Cloud-to-Cloud (C2C) integrations are the supported methods for ingesting data into Cloud SIEM. If your instance uses Grok for parsing, you must migrate before that date or those sources will stop creating records, signals, and insights in Cloud SIEM.

Migrate to a C2C integration

C2C integrations are the preferred option. They automatically tag messages with the mapping hints Cloud SIEM requires, and most have a Forward to SIEM option in the configuration UI.

See Cloud-to-Cloud Integration Framework Sources for the full list of available integrations.

Migrate to a Sumo Logic parser

If no C2C integration exists for your data source, use a Sumo Logic Source with a parser.

1. Find a parser. Go to Data Management > Logs > Parsers in the Sumo Logic UI. If the parser doesn't fully meet your needs, create a local configuration. If none exists, file a support ticket.
2. Configure the source to forward logs. Click the SIEM Processing checkbox on an HTTP source, or assign _siemforward=true as a field on any other source type.
3. Set the parser path. Assign _parser as a field on the source, with the full path as its value, for example: _parser=/Parsers/System/AWS/AWS Network Firewall. To get a parser's path, open Data Management > Logs > Parsers, click the three-dot menu for the parser, and select Copy Path.

Additional references

• Cloud SIEM Ingestion Best Practices
• Ingestion Sources for Cloud SIEM
• Cloud-to-Cloud Integration Framework Sources
• Troubleshoot Parsers