# Sumo Logic — Technical Documentation Index > This file is the comprehensive Sumo Logic technical documentation index for LLM ingestion. It covers product documentation, API references, data collection infrastructure, support, and the service portal. For the marketing website index, see https://www.sumologic.com/llms.txt. Canonical site: https://www.sumologic.com Short index: https://www.sumologic.com/llms.txt AI instructions: https://www.sumologic.com/ai-instructions Last updated: June 2026 --- ## Product Documentation (docs.sumologic.com / /help/docs/) The Sumo Logic product documentation covers all platform capabilities, from data collection through search, dashboards, alerting, integrations, security, and administration. ### Getting Started - [Documentation Home](https://www.sumologic.com/help/): Sumo Logic Docs root - [Welcome to Sumo Logic](https://www.sumologic.com/help/docs/get-started/): Overview of the platform, concepts, and navigation - [Quickstart](https://www.sumologic.com/help/docs/get-started/quickstart/): Get up and running with Sumo Logic in minutes — first collector, first search - [Onboarding](https://www.sumologic.com/help/docs/get-started/onboarding/): Guided onboarding workflow for new accounts - [Tour the Sumo Logic UI](https://www.sumologic.com/help/docs/get-started/sumo-logic-ui/): Navigation guide for the current UI - [Tour the Classic UI](https://www.sumologic.com/help/docs/get-started/sumo-logic-ui-classic/): Legacy UI navigation reference ### Send Data (Collectors & Sources) - [Send Data Overview](https://www.sumologic.com/help/docs/send-data/): All methods for getting data into Sumo Logic — collectors, sources, and APIs - [Hosted Collectors](https://www.sumologic.com/help/docs/send-data/hosted-collectors/): Cloud-hosted collectors for SaaS and cloud sources - [Best Practices for Data Collection](https://www.sumologic.com/help/docs/send-data/best-practices/): Architecture and configuration recommendations - [Use JSON to Configure Sources](https://www.sumologic.com/help/docs/send-data/use-json-configure-sources/): Programmatic source configuration - [Open Source Projects](https://www.sumologic.com/help/docs/send-data/collect-from-other-data-sources/sumo-logic-open-source-projects/): Sumo Logic open-source collectors and tools on GitHub ### Log Search - [Log Search Overview](https://www.sumologic.com/help/docs/search/): Sumo Logic's core log search — real-time and historical - [Search Query Language](https://www.sumologic.com/help/docs/search/search-query-language/): Complete reference for operators, keywords, and syntax - [Mobot (AI Search Assistant)](https://www.sumologic.com/help/docs/search/mobot/): AI-powered log analysis partner — natural language querying and assisted investigations - [Built-in Metadata](https://www.sumologic.com/help/docs/search/get-started-with-search/search-basics/built-in-metadata/): System-generated fields available in every search - [Optimize Search with Partitions](https://www.sumologic.com/help/docs/search/optimize-search-partitions/): Scoping searches for speed and cost efficiency ### Dashboards - [Dashboards Overview](https://www.sumologic.com/help/docs/dashboards/): Build and manage operational and security dashboards - [Filter with Template Variables](https://www.sumologic.com/help/docs/dashboards/filter-template-variables/): Dynamic dashboard filtering - [Set Time Ranges](https://www.sumologic.com/help/docs/dashboards/set-custom-time-ranges/): Custom and relative time range configuration - [Explore View](https://www.sumologic.com/help/docs/dashboards/explore-view/): Monitoring dashboards organized by hierarchy ### Alerts & Monitors - [Alerts Overview](https://www.sumologic.com/help/docs/alerts/): Monitors, scheduled searches, and alerting infrastructure - [Monitors](https://www.sumologic.com/help/docs/alerts/monitors/): Real-time alerting on logs and metrics - [Create a Monitor](https://www.sumologic.com/help/docs/alerts/monitors/create-monitor/): Step-by-step monitor configuration - [Webhook Connections](https://www.sumologic.com/help/docs/alerts/webhook-connections/): Deliver alerts to PagerDuty, Slack, Jira, ServiceNow, and more - [Set Up Webhooks](https://www.sumologic.com/help/docs/alerts/webhook-connections/set-up-webhook-connections/): Webhook configuration guide ### Metrics - [Metrics Overview](https://www.sumologic.com/help/docs/metrics/): Time-series metrics ingestion, query, and visualization - [Introduction to Metrics](https://www.sumologic.com/help/docs/metrics/introduction/): Core concepts — metric types, dimensions, retention - [Kubernetes Metrics](https://www.sumologic.com/help/docs/metrics/kubernetes-metrics/): Auto-collected Kubernetes infrastructure metrics - [Metric Query Best Practices](https://www.sumologic.com/help/docs/metrics/metrics-queries/metric-query-best-practices/): Performance and accuracy guidance - [Metrics Rules Editor](https://www.sumologic.com/help/docs/metrics/metric-rules-editor/): Tag-based metric routing and transformation ### Application Performance Monitoring (APM) & Tracing - [APM Overview](https://www.sumologic.com/help/docs/apm/): Full distributed tracing and application performance monitoring - [Traces](https://www.sumologic.com/help/docs/apm/traces/): Distributed trace collection and analysis - [View and Investigate Traces](https://www.sumologic.com/help/docs/apm/traces/view-and-investigate-traces/): Trace waterfall and span analysis - [Getting Started with Transaction Tracing](https://www.sumologic.com/help/docs/apm/traces/get-started-transaction-tracing/): Instrument apps with OpenTelemetry or auto-instrumentation - [Services List and Map](https://www.sumologic.com/help/docs/apm/services-list-map/): Service dependency map and latency heatmaps ### Observability - [Observability Overview](https://www.sumologic.com/help/docs/observability/): Full-stack observability across logs, metrics, and traces - [AWS Observability Solution](https://www.sumologic.com/help/docs/observability/aws/): Pre-built AWS monitoring with automatic discovery - [Deploy AWS Observability with Terraform](https://www.sumologic.com/help/docs/observability/aws/deploy-use-aws-observability/deploy-with-terraform/): Infrastructure-as-code deployment - [Application Components Solution](https://www.sumologic.com/help/docs/observability/application-components/): Observability for web servers, databases, and middleware ### Security - [Security Solutions Overview](https://www.sumologic.com/help/docs/security/): All security capabilities in one place - [Threat Intelligence](https://www.sumologic.com/help/docs/security/threat-intelligence/): Built-in threat intel feeds and IOC matching - [Logs for Security](https://www.sumologic.com/help/docs/security/additional-security-features/): Security-specific log collection and analysis - [Cloud Infrastructure Security for AWS](https://www.sumologic.com/help/docs/security/additional-security-features/cloud-infrastructure-security/cloud-infrastructure-security-for-aws/): AWS security posture and misconfiguration detection ### Cloud SIEM (CSE) - [Cloud SIEM Overview](https://www.sumologic.com/help/docs/cse/): Cloud SIEM Enterprise — detection, triage, and investigation - [Cloud SIEM Ingestion](https://www.sumologic.com/help/docs/cse/ingestion/): Normalize and map data sources to the CSE schema - [Rules Syntax](https://www.sumologic.com/help/docs/cse/rules/cse-rules-syntax/): CSE detection rule language reference - [Parsing Language Reference](https://www.sumologic.com/help/docs/cse/schema/parsing-language-reference-guide/): Log parser syntax for normalizing third-party sources - [Standard Match Lists](https://www.sumologic.com/help/docs/cse/match-lists-suppressed-lists/standard-match-lists/): Built-in allow/deny lists and entity tagging ### Cloud SOAR - [Cloud SOAR Overview](https://www.sumologic.com/help/docs/cloud-soar/): Security orchestration, automation, and response - [Incident Management and Triage](https://www.sumologic.com/help/docs/cloud-soar/incidents-triage/): Incident lifecycle, assignment, and escalation - [Automation](https://www.sumologic.com/help/docs/cloud-soar/automation/): Playbook engine and automated response workflows - [Settings](https://www.sumologic.com/help/docs/cloud-soar/settings/): Cloud SOAR configuration and administration ### Apps & Integrations - [Apps and Integrations Overview](https://www.sumologic.com/help/docs/integrations/): 300+ pre-built apps organized by vendor - [Amazon and AWS](https://www.sumologic.com/help/docs/integrations/amazon-aws/): CloudTrail, GuardDuty, S3, EC2, Lambda, VPC Flow Logs, and more - [Microsoft and Azure](https://www.sumologic.com/help/docs/integrations/microsoft-azure/): Azure Monitor, Sentinel integration, Microsoft 365, and Active Directory - [Google](https://www.sumologic.com/help/docs/integrations/google/): Google Cloud Logging, Google Workspace - [SaaS and Cloud Apps](https://www.sumologic.com/help/docs/integrations/saas-cloud/): Salesforce, Okta, Box, Dropbox, Zoom, and more - [Security and Threat Detection](https://www.sumologic.com/help/docs/integrations/security-threat-detection/): CrowdStrike, Carbon Black, Palo Alto, Cisco, Juniper, and more - [Web Servers — Apache](https://www.sumologic.com/help/docs/integrations/web-servers/apache/): Apache access and error log analysis - [Database Servers](https://www.sumologic.com/help/docs/integrations/databases/): MySQL, PostgreSQL, MongoDB, Redis, and more - [Webhooks](https://www.sumologic.com/help/docs/integrations/webhooks/): Ingest data via HTTP webhooks ### Platform Services - [Platform Services Overview](https://www.sumologic.com/help/docs/platform-services/): Automation, data forwarding, and platform-level capabilities - [Automation Service](https://www.sumologic.com/help/docs/platform-services/automation-service/): SOAR automation engine — playbooks, integrations, and App Central - [App Central](https://www.sumologic.com/help/docs/platform-services/automation-service/app-central/): Marketplace of pre-built playbooks and automation integrations - [Playbooks in App Central](https://www.sumologic.com/help/docs/platform-services/automation-service/playbooks-in-app-central/): Out-of-the-box security and IT response playbooks - [Automation Integrations](https://www.sumologic.com/help/docs/platform-services/automation-service/automation-service-integrations/): Available integrations for the automation engine - [Automation Bridge](https://www.sumologic.com/help/docs/platform-services/automation-service/automation-service-bridge/): Bridge connector for on-premises automation targets ### Account Management - [Manage Account Overview](https://www.sumologic.com/help/docs/manage/): Users, roles, security, data management, and billing - [Fields](https://www.sumologic.com/help/docs/manage/fields/): Manage extracted fields for enrichment and search - [Field Extractions](https://www.sumologic.com/help/docs/manage/field-extractions/): Field Extraction Rules (FERs) — auto-parse fields at ingest - [Role Capabilities](https://www.sumologic.com/help/docs/manage/users-roles/roles/role-capabilities/): Full list of RBAC permissions - [Access Keys](https://www.sumologic.com/help/docs/manage/security/access-keys/): API authentication key management ### APIs (Documentation) - [Sumo Logic APIs Overview](https://www.sumologic.com/help/docs/api/): All Sumo Logic REST API documentation - [API Authentication, Endpoints & Security](https://www.sumologic.com/help/docs/api/about-apis/getting-started/): Access keys, base URLs, and authentication patterns - [Search Job APIs](https://www.sumologic.com/help/docs/api/search-job/): Programmatic log search via REST - [Use Terraform with Sumo Logic](https://www.sumologic.com/help/docs/api/about-apis/terraform-with-sumo-logic/): Official Sumo Logic Terraform provider - [Metrics APIs (Legacy)](https://www.sumologic.com/help/docs/api/metrics/): Legacy metrics query API reference ### Release Notes - [Release Notes](https://www.sumologic.com/help/docs/release-notes/): Aggregate release notes across platform, collectors, CSE, CSOAR, and developer APIs --- ## API Reference (Interactive — by Region) The Sumo Logic Management API is available at `api..sumologic.com/docs/`. It covers account management, collectors, sources, searches, monitors, dashboards, users, roles, RBAC, SIEM, and SOAR. OpenAPI/Swagger UI is available at each endpoint. ### Primary API Endpoints | Region | API Docs | CSE API | CSOAR API | |---|---|---|---| | US1 (default) | https://api.sumologic.com/docs/ | https://api.sumologic.com/docs/sec/ | https://api.sumologic.com/docs/csoar/ | | US2 | https://api.us2.sumologic.com/docs/ | https://api.us2.sumologic.com/docs/sec/ | https://api.us2.sumologic.com/docs/csoar/ | | EU (Dublin) | https://api.eu.sumologic.com/docs/ | https://api.eu.sumologic.com/docs/sec/ | https://api.eu.sumologic.com/docs/csoar/ | | DE (Frankfurt) | https://api.de.sumologic.com/docs/ | https://api.de.sumologic.com/docs/sec/ | https://api.de.sumologic.com/docs/csoar/ | | AU (Sydney) | https://api.au.sumologic.com/docs/ | https://api.au.sumologic.com/docs/sec/ | https://api.au.sumologic.com/docs/csoar/ | | CA (Montreal) | https://api.ca.sumologic.com/docs/ | https://api.ca.sumologic.com/docs/sec/ | https://api.ca.sumologic.com/docs/csoar/ | | JP (Tokyo) | https://api.jp.sumologic.com/docs/ | https://api.jp.sumologic.com/docs/sec/ | https://api.jp.sumologic.com/docs/csoar/ | | KR (Seoul) | https://api.kr.sumologic.com/docs/ | https://api.kr.sumologic.com/docs/sec/ | https://api.kr.sumologic.com/docs/csoar/ | | CH (Zurich) | https://api.ch.sumologic.com/docs/ | https://api.ch.sumologic.com/docs/sec/ | https://api.ch.sumologic.com/docs/csoar/ | | FED (US Federal) | https://api.fed.sumologic.com/docs/ | https://api.fed.sumologic.com/docs/sec/ | https://api.fed.sumologic.com/docs/csoar/ | API base URL pattern: `https://api..sumologic.com/api/v1/` Authentication: HTTP Basic Auth using Access ID and Access Key (generated in Administration > Security > Access Keys) --- ## Audit Event Log Definitions Sumo Logic records all account-level events to the Audit Index. Event definitions for each service region are documented at: | Region | Audit Docs | CSOAR Audit | CSE Audit | |---|---|---|---| | US1 | https://service.sumologic.com/audit/docs/ | https://service.sumologic.com/audit/docs/csoar/ | https://service.sumologic.com/audit/docs/sec/ | | EU (Dublin) | https://service.eu.sumologic.com/audit/docs/ | https://service.eu.sumologic.com/audit/docs/csoar/ | — | | DE (Frankfurt) | https://service.de.sumologic.com/audit/docs/ | https://service.de.sumologic.com/audit/docs/csoar/ | — | | AU (Sydney) | https://service.au.sumologic.com/audit/docs/ | https://service.au.sumologic.com/audit/docs/csoar/ | — | | CA (Montreal) | https://service.ca.sumologic.com/audit/docs/ | https://service.ca.sumologic.com/audit/docs/csoar/ | — | | JP (Tokyo) | https://service.jp.sumologic.com/audit/docs/ | https://service.jp.sumologic.com/audit/docs/csoar/ | https://service.jp.sumologic.com/audit/docs/sec/ | | FED (US Federal) | https://service.fed.sumologic.com/audit/docs/ | https://service.fed.sumologic.com/audit/docs/csoar/ | — | --- ## Service Portal (Application UI) The Sumo Logic application is accessed at `service..sumologic.com/ui/`. Authentication is required. | Region | Service URL | |---|---| | US1 (default) | https://service.sumologic.com/ui/ | | US2 | https://service.us2.sumologic.com/ui/ | | EU (Dublin) | https://service.eu.sumologic.com/ui/ | | DE (Frankfurt) | https://service.de.sumologic.com/ui/ | | AU (Sydney) | https://service.au.sumologic.com/ui/ | | CA (Montreal) | https://service.ca.sumologic.com/ui/ | | JP (Tokyo) | https://service.jp.sumologic.com/ui/ | | KR (Seoul) | https://service.kr.sumologic.com/ui/ | | CH (Zurich) | https://service.ch.sumologic.com/ui/ | | FED (US Federal) | https://service.fed.sumologic.com/ui/ | --- ## Data Collection Endpoints (Collectors & HTTP Sources) ### Installed Collector Registration Endpoints Installed collectors register with region-specific endpoints at `collectors..sumologic.com`: - US1: https://collectors.sumologic.com/ - US2: https://collectors.us2.sumologic.com/ - US2 (static): https://collectors.static.us2.sumologic.com/ - AU (Sydney): https://collectors.au.sumologic.com/ - DE (Frankfurt): https://collectors.de.sumologic.com/ - EU (Dublin): https://collectors.eu.sumologic.com/ - JP (Tokyo): https://collectors.jp.sumologic.com/ - CA (Montreal): https://collectors.ca.sumologic.com/ - FED (US Federal): https://collectors.fed.sumologic.com/ ### HTTP Source Ingest Endpoints Data sent to Sumo Logic HTTP Sources uses collection endpoints. Endpoint format: `https://endpoint.collection..sumologic.com/receiver/v1/http/` Available endpoints include: - US1: https://endpoint1.collection.sumologic.com/ — https://endpoint3.collection.sumologic.com/ - US2: https://endpoint1.collection.us2.sumologic.com/ — https://endpoint3.collection.us2.sumologic.com/ - US2 (static): https://endpoint1.collection.static.us2.sumologic.com/ — https://endpoint3.collection.static.us2.sumologic.com/ - EU (Dublin): https://endpoint1.collection.eu.sumologic.com/ HTTP ingest documentation: https://www.sumologic.com/help/docs/send-data/hosted-collectors/ --- ## Support Portal The Sumo Logic Support Portal provides knowledge base articles, case management, and community forums. - [Support Home](https://support.sumologic.com/support/s/): Main entry point for support tickets and knowledge base - [Topic Catalog](https://support.sumologic.com/support/s/topiccatalog): All support topics by category - [Contact Support](https://support.sumologic.com/support/s/contactsupport): File a support ticket ### Support Topics (by Category) - [Getting Started](https://support.sumologic.com/support/s/topic/0TO6Q000000gTC6WAM/getting-started): Onboarding and initial setup - [Using Sumo Logic](https://support.sumologic.com/support/s/topic/0TO6Q000000gT4aWAE/using-sumo-logic): Search, dashboards, and alerts - [Managing Sumo Logic](https://support.sumologic.com/support/s/topic/0TO6Q000000gT4kWAE/managing-sumo-logic): Administration and account management - [APIs](https://support.sumologic.com/support/s/topic/0TO6Q000000gTC8WAM/apis): API usage and troubleshooting - [Collectors](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCOWA2/collectors): Installed and hosted collector issues - [Sources](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCLWA2/sources): Source configuration and troubleshooting - [Security](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCKWA2/security): Security feature support - [Applications](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCGWA2/applications): App and integration support - [Account Management and Billing](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCFWA2/account-management-and-billing): Subscription, credits, and billing - [Field Extraction Rules](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCIWA2/field-extraction-rules): FER configuration help - [Managing Users and Roles](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCJWA2/managing-users-and-roles): RBAC and access management - [Content Management](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCHWA2/content-management): Dashboards, searches, and saved content - [Scheduled Views / Partitions](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCMWA2/scheduled-viewspartitions): Data tiering and query optimization - [Data Forwarding](https://support.sumologic.com/support/s/topic/0TO6Q000000gTCNWA2/data-forwarding): Forwarding data to S3, Splunk, Syslog, and more - [Product News & Announcements](https://support.sumologic.com/support/s/topic/0TO6Q000000gTC5WAM/product-news-announcements): Release notes and product updates --- > Canonical: https://www.sumologic.com/llms-full.txt > Short index: https://www.sumologic.com/llms.txt > Last updated: June 2026