Skip to content

Commit dcc999c

Browse files
committed
Finish send-data
1 parent 98e3b3c commit dcc999c

24 files changed

+90
-205
lines changed

docs/send-data/installed-collectors/sources/define-boundary-regex-multiline-messages.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,15 @@ title: Define Boundary Regex for Multiline Messages
44
description: By default, Sumo Logic Sources have multiline processing enabled, which is useful when logs contain messages that span multiple lines separated by line breaks, such as a stack trace.
55
---
66

7-
7+
import useBaseUrl from '@docusaurus/useBaseUrl';
88

99
For details on how the Collector processes multiline logs see [Collecting MultilineLogs](/docs/send-data/reference-information/collect-multiline-logs.md)
1010

1111
By default, Sumo Logic Sources have multiline processing enabled, which is useful when logs contain messages that span multiple lines separated by line breaks, such as a stack trace. This way, the Source can detect when a log message spans multiple lines and then indexes this message as a single message.
1212

1313
If you want your Source to treat each log line as a separate message, you can deselect this option, **Detect messages spanning multiple lines**
1414

15-
![img](/img/send-data/multiline.png)
15+
<img src={useBaseUrl('img/send-data/multiline.png')} alt="Checkbox for Detect messages spanning multiple lines" style={{border: '1px solid gray'}} width="600" />
1616

1717
Multi-line processing gives you two primary options:
1818

docs/send-data/installed-collectors/sources/docker-sources.md

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,7 @@ There are alternative methods for collecting Docker logs and metrics. See [Dock
3333

3434
1. [**New UI**](/docs/get-started/sumo-logic-ui). In the Sumo Logic main menu select **Data Management**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**.
3535
1. Navigate to the collector you installed on the Docker host, and select **Add > Add Source**.
36-
1. Select **Docker Logs**. The Docker Logs page appears.
37-
38-
![docker logs source.png](/img/send-data/docker-logs-source.png)
39-
36+
1. Select **Docker Logs**. The Docker Logs page appears.<br/><img src={useBaseUrl('img/send-data/docker-logs-source.png')} alt="Docker logs source" style={{border: '1px solid gray'}} width="600" />
4037
1. Configure the source fields:
4138

4239
* **Name**. (Required).
@@ -91,7 +88,7 @@ There are alternative methods for collecting Docker logs and metrics. See [Dock
9188
:::note
9289
To collect metrics for the Docker ULM App, select **Metrics** as the Content Type.
9390
:::
94-
![docker-stats.png](/img/send-data/docker-stats.png)
91+
<img src={useBaseUrl('img/send-data/docker-stats.png')} alt="Docker stats" style={{border: '1px solid gray'}} width="600" />
9592
1. Configure the source fields:
9693

9794
* **Name.** (Required)

docs/send-data/installed-collectors/sources/host-metrics-source.md

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ title: Host Metrics Source
44
description: An installed Sumo Logic Collector can collect host metrics from a local host.
55
---
66

7-
7+
import useBaseUrl from '@docusaurus/useBaseUrl';
88

99
An installed Sumo Logic Collector can collect host metrics pertaining to the local host. The metrics are ingested and become available for metrics visualization. The host metrics are gathered by the open-source [SIGAR library](https://github.com/hyperic/sigar)
1010

@@ -36,13 +36,8 @@ A host metric source running on an Installed Collector on an Amazon EC2 instance
3636
## Manually Configure a Host Metrics Source
3737

3838
1. [**New UI**](/docs/get-started/sumo-logic-ui). In the Sumo Logic main menu select **Data Management**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**.<br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**.
39-
1. Find the name of the installed collector to which you'd like to add a source. Click **Add** and then choose **Add Source**.
40-
41-
![add-source2.png](/img/send-data/add-source2.png)
42-
43-
1. Select **Host Metrics** as the source type.
44-
45-
![InstalledCollector.png](/img/send-data/host-metrics-icon.png)
39+
1. Find the name of the installed collector to which you'd like to add a source. Click **Add** and then choose **Add Source**.<br/><img src={useBaseUrl('img/send-data/add-source2.png')} alt="Add Source button" style={{border: '1px solid gray'}} width="800" />
40+
1. Select **Host Metrics** as the source type.<br/><img src={useBaseUrl('img/send-data/host-metrics-icon.png')} alt="Host Metrics tile" style={{border: '1px solid gray'}} width="600" />
4641
1. Set the following:
4742

4843
* **Name**. Enter the name you'd like to display for the new Source. Description is optional. Source name metadata is stored in a searchable field called `_sourceCategory`.
@@ -51,11 +46,8 @@ A host metric source running on an Installed Collector on an Amazon EC2 instance
5146
* **Fields**. Click the **+Add Field** link to add custom metric metadata. Define the fields you want to associate, providing a name (key) and value for each.
5247
* **Scan Interval**. Select the frequency for the Source to scan for host metrics data. Selecting a short interval will increase the message volume and could cause your deployment to incur additional charges. The default is 1 minute.
5348
* **Metrics**. Select check boxes for the metrics to collect. By default, all CPU and memory metrics are collected.
54-
55-
* Select the top level check box to select all metrics in that category. A blue checkmark icon ![check](/img/send-data/icon_blue_checkmark.png) indicates that the category is selected.
56-
* To select individual metrics, click the right-facing arrow to expand the category and select the individual metrics. The icon changes to ![minus](/img/send-data/icon_blue_minus.png) , as shown in the screenshot.
57-
58-
![host-metrics-source.png](/img/send-data/host-metrics-source.png)
49+
* Select the top level check box to select all metrics in that category. A blue checkmark icon <img src={useBaseUrl('img/send-data/icon_blue_checkmark.png')} alt="Blue checkmark" width="20" /> indicates that the category is selected.
50+
* To select individual metrics, click the right-facing arrow to expand the category and select the individual metrics. The icon changes to <img src={useBaseUrl('img/send-data/icon_blue_minus.png')} alt="Minus mark" width="20" />, as shown in the screenshot.<br/><img src={useBaseUrl('img/send-data/host-metrics-source.png')} alt="Select individual metrics" style={{border: '1px solid gray'}} width="600" />
5951

6052
1. When you are finished configuring the Source, click **Save**.
6153

docs/send-data/installed-collectors/sources/local-file-source.md

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,9 @@ When the Sumo collector accesses a log file to read its content, the collector o
4242
## Configure a Local File Source
4343

4444
1. [**New UI**](/docs/get-started/sumo-logic-ui). In the Sumo Logic main menu select **Data Management**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**.
45-
1. Find the name of the Installed Collector to which you'd like to add a Source. Click **Add...** then choose **Add Source** from the pop-up menu.
46-
47-
![img](/img/send-data/add-source.png)  
48-
1. Select **Local File** for the Source type.
49-
50-
![local file source icon.png](/img/send-data/local-file-source-icon.png) 
51-
1. Set the following choices:
52-
53-
![local file source.png](/img/send-data/local-file-source.png)
45+
1. Find the name of the Installed Collector to which you'd like to add a Source. Click **Add...** then choose **Add Source** from the pop-up menu.<br/><img src={useBaseUrl('img/send-data/add-source.png')} alt="Add source button" style={{border: '1px solid gray'}} width="800" />
46+
1. Select **Local File** for the Source type.<br/><img src={useBaseUrl('img/send-data/local-file-source-icon.png')} alt="Local file source icon" style={{border: '1px solid gray'}} width="100" />
47+
1. Set the following choices:<br/><img src={useBaseUrl('img/send-data/local-file-source.png')} alt="Local file source" style={{border: '1px solid gray'}} width="600" />
5448

5549
* **Name**. Type the name you'd like to display for the new Source. Description is optional.
5650

docs/send-data/installed-collectors/sources/local-windows-event-log-source.md

Lines changed: 9 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -19,18 +19,9 @@ To configure a Local Windows Event Log Source:
1919

2020
1. [**New UI**](/docs/get-started/sumo-logic-ui). In the Sumo Logic main menu select **Data Management**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. <br/>[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**.
2121

22-
1. Find the name of the installed collector to which you'd like to add a Source. Click **Add** and then choose **Add Source** from the pop-up menu.
23-
24-
![add source from collection page.png](/img/send-data/add-source-from-collection-page.png)
25-
26-
1. Click **Windows Event Log**.
27-
28-
![windows event log source icon.png](/img/send-data/windows-event-log-source-icon.png)
29-
30-
1. Choose **Local** for **Type of Windows Source**.
31-
32-
![type of windows event log source.png](/img/send-data/type-windows-event-log-source.png)
33-
22+
1. Find the name of the installed collector to which you'd like to add a Source. Click **Add** and then choose **Add Source** from the pop-up menu.<br/><img src={useBaseUrl('img/send-data/add-source-from-collection-page.png')} alt="Add source from collection page" style={{border: '1px solid gray'}} width="800" />
23+
1. Click **Windows Event Log**.<br/><img src={useBaseUrl('img/send-data/windows-event-log-source-icon.png')} alt="Windows event log source icon" style={{border: '1px solid gray'}} width="100" />
24+
1. Choose **Local** for **Type of Windows Source**.<br/><img src={useBaseUrl('img/send-data/type-windows-event-log-source.png')} alt="Type of windows event log source" style={{border: '1px solid gray'}} width="300" />
3425
1. Set the following:
3526
* **Name.** Type the name you'd like to display for the new Source. 
3627
:::note
@@ -42,39 +33,25 @@ To configure a Local Windows Event Log Source:
4233

4334
* <img src={useBaseUrl('img/reuse/green-check-circle.png')} alt="green check circle.png" width="20"/> A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema.
4435
* <img src={useBaseUrl('img/reuse/orange-exclamation-point.png')} alt="orange exclamation point.png" width="20"/> An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, you'll see an option to automatically add or enable the nonexistent fields to the Fields table schema. If a field is sent to Sumo Logic but isn’t present or enabled in the schema, it’s ignored and marked as **Dropped**.
45-
* **Event Format**. Select how you want your event logs formatted:
46-
![JSON format name update.png](/img/send-data/JSON-format-name-update.png)
36+
* **Event Format**. Select how you want your event logs formatted:<br/><img src={useBaseUrl('img/send-data/JSON-format-name-update.png')} alt="JSON format name update" style={{border: '1px solid gray'}} width="500" />
4737
* **Collect using legacy format**. Events retain their default text format from Windows.
4838
* **Collect using JSON format**. Events are formatted into JSON that is designed to work with Sumo Logic features, making it easier for you to reference your data.
4939

5040
:::note
5141
To **Collect using JSON format** the Collector must have version 19.319.2 or later installed. The Windows JSON App requires **JSON format**.
5242
:::
5343

54-
* **Windows Event Types.** Select the event types you want to collect:
55-
56-
![windows events types 2021 June.png](/img/send-data/windows-events-types.png)
57-
44+
* **Windows Event Types.** Select the event types you want to collect:<br/><img src={useBaseUrl('img/send-data/windows-events-types.png')} alt="Windows events types 2021 June" style={{border: '1px solid gray'}} width="500" />
5845
* **Standard Event Channels**. Select the main check box for all types, or individual check boxes for specific types (Security, Application, and/or System).
5946
* **Forwarded Events**. See how to [Collect Forwarded Events from a Windows Event Collector](collect-forwarded-events-windows-event-collector.md). Note that this box is not selectable when **Standard Event Channels** is checked.
6047
* **Custom Event Channels** to specify, in a comma-separated list, the channels you'd like to collect from. If you need help finding channels on the machine where the Source is installed, see [Windows Event Source Custom Channels](local-windows-event-log-source.md).  To collect from custom event channels in a Local Event Source, the Collector must have version 19.118 or later installed.
61-
6248
* Depending on the **Event Format** selected, you'll have different options.
63-
* **Event Collection Level**. When JSON format is selected you have the option to select:
64-
65-
![event levels.png](/img/send-data/event-levels.png)
66-
49+
* **Event Collection Level**. When JSON format is selected you have the option to select:<br/><img src={useBaseUrl('img/send-data/event-levels.png')} alt="Event levels" style={{border: '1px solid gray'}} width="500" />
6750
* **Complete Message** will ingest the entire event content along with metadata.
6851
* **Concise Message** will ingest the first line of event messages along with all of the metadata.
6952
* **Metadata Only** will ingest metadata fields from each event, including event ID and timestamp. The Windows JSON App requires **Complete Message**.
70-
* **Event IDs.** (Available in Collector version 19.351-4 and later.) You can set allow and deny Windows Event ID filters to only collect important events. Select the checkbox next to the type of filter you want to set, we recommend only using one at a time. Your list needs to be a comma-separated list of event IDs.
71-
72-
![windows event ID filter example.png](/img/send-data/windows-event-ID-filter-example.png)
73-
74-
* **Metadata.** When the legacy format is selected choose whether you would like the collector to minimize the amount of data collected by omitting the full message text of each event. Core metadata fields such as event ID, timestamp, user name, as well as the unformatted event data will still be present. This can reduce data usage and increase event throughput, but will prevent many dashboards and apps from correctly extracting data. To omit full event text and only collect event metadata, the collector must have version 19.155 or later installed.
75-
76-
![legacy metadata option.png](/img/send-data/legacy-metadata-option.png)
77-
53+
* **Event IDs.** (Available in Collector version 19.351-4 and later.) You can set allow and deny Windows Event ID filters to only collect important events. Select the checkbox next to the type of filter you want to set, we recommend only using one at a time. Your list needs to be a comma-separated list of event IDs.<br/><img src={useBaseUrl('img/send-data/windows-event-ID-filter-example.png')} alt="Windows event ID filter example" style={{border: '1px solid gray'}} width="500" />
54+
* **Metadata.** When the legacy format is selected choose whether you would like the collector to minimize the amount of data collected by omitting the full message text of each event. Core metadata fields such as event ID, timestamp, user name, as well as the unformatted event data will still be present. This can reduce data usage and increase event throughput, but will prevent many dashboards and apps from correctly extracting data. To omit full event text and only collect event metadata, the collector must have version 19.155 or later installed.<br/><img src={useBaseUrl('img/send-data/legacy-metadata-option.png')} alt="Legacy metadata option" style={{border: '1px solid gray'}} width="500" />
7855
* **Collection should begin**. Choose or enter how far back you'd like to begin collecting historical logs. You can either:
7956

8057
* Choose a predefined value from dropdown list, ranging from “Now” to “24 hours ago” to “All Time”.
@@ -138,7 +115,7 @@ You can use multiple variables, for example:
138115
{{sys.PATH}}-{{sys.YourEnvVar}}
139116
```
140117
141-
![img](/img/send-data/environment-variable-usage.png)
118+
<img src={useBaseUrl('img/send-data/environment-variable-usage.png')} alt="Multiple variables" style={{border: '1px solid gray'}} width="500" />
142119
143120
:::tip
144121
The example above uses a hyphen - character to separate variable components. Separator characters are not required. Curly brackets and spaces are not allowed. Underscores and hyphens are recommended.

docs/send-data/installed-collectors/sources/local-windows-performance-monitor-log-source.md

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,7 @@ To configure a Local Windows Performance Monitor Log Source:
3131
* <img src={useBaseUrl('img/reuse/green-check-circle.png')} alt="green check circle.png" width="20"/> A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema.
3232
* <img src={useBaseUrl('img/reuse/orange-exclamation-point.png')} alt="orange exclamation point.png" width="20"/> An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, you'll see an option to automatically add or enable the nonexistent fields to the Fields table schema. If a field is sent to Sumo Logic but isn’t present or enabled in the schema, it’s ignored and marked as **Dropped**.
3333
1. **Processing Rules.** (Optional.) To add rules or filters click **Add Rule**. Enter a name, a filter, and select the type. Then click **Apply**.
34-
1. **Perfmon Queries.** Select from the provided default Perfmon Queries, or create your own custom query.
35-
36-
![windows performance source.png](/img/send-data/windows-performance-source.png)
37-
34+
1. **Perfmon Queries.** Select from the provided default Perfmon Queries, or create your own custom query.<br/><img src={useBaseUrl('img/send-data/windows-performance-source.png')} alt="Windows performance source" style={{border: '1px solid gray'}} width="600" />
3835
* Click the query's check box to select it.
3936
* To add a custom query, click **Add Query**, enter a name and the query. Then click **Add**.
4037
1. When you are finished configuring the Source, click **Save**.
@@ -68,7 +65,7 @@ You can use multiple variables, for example:
6865
{{sys.PATH}}-{{sys.YourEnvVar}}
6966
```
7067

71-
![img](/img/send-data/environment-variable-usage.png)
68+
<img src={useBaseUrl('img/send-data/environment-variable-usage.png')} alt="Multiple variables" style={{border: '1px solid gray'}} width="500" />
7269

7370
:::tip
7471
The example above uses a hyphen - character to separate variable components. Separator characters are not required. Curly brackets and spaces are not allowed. Underscores and hyphens are recommended.

0 commit comments

Comments
 (0)