You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/amazon-bedrock.md
+29-29Lines changed: 29 additions & 29 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -285,7 +285,7 @@ Sumo Logic supports collecting metrics using two source types:
285
285
***Source Category**. Enter `aws/observability/cloudtrail/logs`.
286
286
***Fields**. Add an **account** field and assign it a value that is a friendly name/alias to your AWS account from which you are collecting logs. Logs can be queried via the “account field”.
287
287
***Access Key ID and Secret Access Key**. Enter your Amazon [Access Key ID and Secret Access Key](http://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSGettingStartedGuide/AWSCredentials.html). Learn how to use Role-based access to AWS [here](/docs/send-data/hosted-collectors/amazon-aws/aws-sources).
288
-
***Log File Discovery** > **Scan Interval**. Use the default of 5 minutes. Alternately, enter the frequency. Sumo Logic will scan your S3 bucket for new data. Learn how to configure **Log File Discovery**[here](/docs/send-data/hosted-collectors/amazon-aws/aws-sources).
288
+
***Log File Discovery** > **Scan Interval**. Use the default of 5 minutes. Alternatively, enter the frequency. Sumo Logic will scan your S3 bucket for new data. Learn how to configure **Log File Discovery**[here](/docs/send-data/hosted-collectors/amazon-aws/aws-sources).
289
289
***Enable Timestamp Parsing**. Select the **Extract timestamp information from log file entries** check box.
290
290
***Time Zone**. Select **Ignore time zone from the log file and instead use**, and select **UTC** from the dropdown.
291
291
***Timestamp Format.** Select **Automatically detect the format**.
@@ -308,16 +308,16 @@ Sumo Logic supports several methods for collecting logs from Amazon CloudWatch.
308
308
-**AWS Kinesis Firehose for Logs**. Configure an [AWS Kinesis Firehose for Logs](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source/#create-an-aws-kinesis-firehose-for-logssource) (Recommended); or
309
309
-**Lambda Log Forwarder**. Configure a collection of Amazon CloudWatch Logs using our AWS Lambda function using a Sumo Logic provided CloudFormation template, as described in [Amazon CloudWatch Logs](/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs/) or configure collection without using CloudFormation, see [Collect Amazon CloudWatch Logs using a Lambda Function](/docs/send-data/collect-from-other-data-sources/amazon-cloudwatch-logs/collect-with-lambda-function/).<br/>
310
310
311
-
- While configuring the CloudWatch log source, following fields can be added in the source:
311
+
- While configuring the CloudWatch log source, the following fields can be added to the source:
312
312
- Add an **account** field and assign it a value which is a friendly name/alias to your AWS account from which you are collecting logs. Logs can be queried via the **account** field.
313
313
- Add a **region** field and assign it the value of the respective AWS region where the **Bedrock** exists.
314
-
- Add an **accountId** field and assign it the value of the respective AWS account id which is being used.
314
+
- Add an **accountId** field and assign it the value of the respective AWS account ID that is being used.
1.[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**. <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**.
320
+
1.[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Data Management**, and then under **Logs** select **Fields**. You can also click the **Go To...** menu at the top of the screen and select **Fields**. <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Fields**.
321
321
1. Search for the `modelId` field.
322
322
1. If not present, create it. Learn how to create and manage fields [here](/docs/manage/fields#manage-fields).
Enter a parse expression to create an “account” field that maps to the alias you set for each subaccount. For example, if you used the `“dev”` alias for an AWS account with ID `"956882123456"` and the `“prod”` alias for an AWS account with ID `"567680881046"`, your parse expression would look like:
372
+
Enter a parse expression to create an “account” field that maps to the alias you set for each sub-account. For example, if you used the `“dev”` alias for an AWS account with ID `"956882123456"` and the `“prod”` alias for an AWS account with ID `"567680881046"`, your parse expression would look like:
373
373
374
374
```sql
375
375
| json "recipientAccountId"
376
-
// Manually map your aws account id with the AWS account alias you setup earlier for individual child account
376
+
// Manually map your AWS account id with the AWS account alias you set up earlier for the individual child account
377
377
| "" as account
378
378
| if (recipientAccountId = "956882123456", "dev", account) as account
379
379
| if (recipientAccountId = "567680881046", "prod", account) as account
@@ -402,24 +402,24 @@ We highly recommend you view these dashboards in the [AWS Observability view](/d
402
402
403
403
### Overview
404
404
405
-
The **Amazon Bedrock - Overview** dashboard provides a overall heath of Bedrock service based logs and metrics.
405
+
The **Amazon Bedrock - Overview** dashboard provides an overall health of the Bedrock service based on logs and metrics.
406
406
407
407
Use this dashboard to:
408
408
* Monitor locations of successful and failed Amazon Bedrock user activity events.
409
409
* Monitor all read-only and non-read-only events.
410
-
* Monitor most active users working on Bedrock infrastructure and various events invoked on Bedrock service.
410
+
* Monitor the most active users working on the Bedrock infrastructure and various events invoked on the Bedrock service.
The **Amazon Bedrock - CloudTrail Audit Overview** dashboard provides a record of actions taken by a user, role, or an AWS service in Amazon Bedrock. CloudTrail captures all API calls for Amazon Bedrock as events.
416
+
The **Amazon Bedrock - CloudTrail Audit Overview** dashboard provides a record of actions taken by a user, role, or AWS service in Amazon Bedrock. CloudTrail captures all API calls for Amazon Bedrock as events.
417
417
418
418
Use this dashboard to:
419
419
* Monitor Amazon Bedrock-related audit logs using CloudTrail Events.
420
420
* Monitor locations of successful and failed Amazon Bedrock user activity events.
421
421
* Monitor all read-only and non-read-only events.
422
-
* Monitor most active users working on Bedrock infrastructure and various events invoked on Bedrock service.
422
+
* Monitor the most active users working on the Bedrock infrastructure and various events invoked on the Bedrock service.
| `Amazon Bedrock - Delete Action Detected` | This alert is triggered when a Delete API call to the Amazon Bedrock environment is detected. | Count > 0 | Count < = 0 |
459
+
| `Amazon Bedrock - High Model Invocation Latency` | This alert is triggered when the average time to receive a response from a Bedrock model exceeds a configurable threshold in milliseconds. High latency can directly impact the user experience of your applications. | Count > 5000 | Count < = 5000 |
460
+
| `Amazon Bedrock - High Number of Access Denied Errors` | This alert is triggered when there is a spike in AccessDeniedException errors in CloudTrail for the Bedrock service. This could indicate misconfigured IAM policies or a potential security threat. | Count > 5 | Count < = 5 |
461
+
| `Amazon Bedrock - Model Invocation Server Error Detection` | This alert is triggered when the number of server-side errors from model invocations increases more than a configurable value (Default 5). This can indicate issues with the service, your input data, or permissions. | Count > 5 | Count < = 5 |
462
+
448
463
## Upgrade/Downgrade the Amazon Bedrock app (Optional)
449
464
450
465
import AppUpdate from '../../reuse/apps/app-update.md';
@@ -456,18 +471,3 @@ import AppUpdate from '../../reuse/apps/app-update.md';
456
471
import AppUninstall from '../../reuse/apps/app-uninstall.md';
457
472
458
473
<AppUninstall/>
459
-
460
-
## Create monitors for Amazon Bedrock app
461
-
462
-
import CreateMonitors from '../../reuse/apps/create-monitors.md';
| `Amazon Bedrock - Delete Action Detected` | This alert triggers when a Delete API call to the Amazon Bedrock environment is detected. | Count > 0 | Count < = 0 |
471
-
| `Amazon Bedrock - High Model Invocation Latency` | This alert triggers when the average time to receive a response from a Bedrock model exceeds a configurable threshold in milliseconds. High latency can directly impact the user experience of your applications. | Count > 5000 | Count < = 5000 |
472
-
| `Amazon Bedrock - High Number of Access Denied Errors` | This alert fires when there is a spike in AccessDeniedException errors in CloudTrail for the Bedrock service. This could indicate misconfigured IAM policies or a potential security threat. | Count > 5 | Count < = 5 |
473
-
| `Amazon Bedrock - Model Invocation Server Error Detection` | This alert triggers if the number of server-side errors from model invocations increases more than configurable value (Default 5). This can indicate issues with the service, your input data, or permissions. | Count > 5 | Count < = 5 |
0 commit comments