From fb806c1d1c37e45fa679f293af50d94e36abb12c Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Fri, 20 Feb 2026 15:32:29 -0600 Subject: [PATCH 01/14] DOCS-1409 - Proof the Manage guide --- docs/manage/fields.md | 84 ++++++++++++++++----------------- docs/manage/index.md | 8 ++-- docs/manage/partitions/index.md | 2 +- 3 files changed, 47 insertions(+), 47 deletions(-) diff --git a/docs/manage/fields.md b/docs/manage/fields.md index effa6fe6ca..bf9ad25cf6 100644 --- a/docs/manage/fields.md +++ b/docs/manage/fields.md @@ -7,9 +7,9 @@ description: Manage fields in Sumo Logic to control how log data is parsed and o import useBaseUrl from '@docusaurus/useBaseUrl'; -Fields allow you to reference log data based on meaningful associations. They act as metadata tags that are assigned to your logs so you can search with them. Each field contains a key-value pair, where the field name is the key. Fields may be referred to as Log Metadata Fields. +Fields allow you to reference log data based on meaningful associations. They act as metadata tags that are assigned to your logs so you can search with them. Each field contains a key-value pair, where the field name is the key. Fields may be referred to as *log metadata fields*. -In addition to defining fields through [Field Extraction Rules](/docs/manage/field-extractions), you can define fields on data sent to Sumo by manually defining them on Sources and Collectors, as well as dynamically through HTTP headers and tags from Amazon EC2. +In addition to defining fields through [Field Extraction Rules](/docs/manage/field-extractions), you can define fields on data sent to Sumo Logic by manually defining them on sources and collectors, as well as dynamically through HTTP headers and tags from Amazon EC2. The order of precedence for field assignment from highest to lowest is: @@ -20,13 +20,13 @@ The order of precedence for field assignment from highest to lowest is: 1. Source 1. Collector -So, if you have a field defined at the Collector or Source level, and you create a FER against the same source of data with the same field name, the FER will win the field assignment. +So, if you have a field defined at the collector or source level, and you create a FER against the same source of data with the same field name, the FER will win the field assignment. -Any fields you want assigned to log data need to exist in a Fields schema. Each account has its own Fields schema that is available to manage in the Sumo web interface. When a field is defined and enabled in the Fields schema it is assigned to the appropriate log data as configured. If a field is sent to Sumo Logic but isn’t present or enabled in the schema, it’s ignored and marked as **Dropped**. +Any fields you want assigned to log data need to exist in a fields schema. Each account has its own fields schema that is available to manage in the Sumo Logic web interface. When a field is defined and enabled in the fields schema it is assigned to the appropriate log data as configured. If a field is sent to Sumo Logic but isn’t present or enabled in the schema, it’s ignored and marked as **Dropped**. -Fields specified in field extraction rules are automatically added and enabled in your Fields schema. +Fields specified in field extraction rules are automatically added and enabled in your fields schema. -Field management is important to ensure search performance is maintained and you continue to have meaningful fields assigned to your data. You can manage fields defined through any of these methods at any time, to include deleting unneeded fields, see [manage fields](#manage-fields) for details. +Field management is important to ensure search performance is maintained and you continue to have meaningful fields assigned to your data. You can manage fields defined through any of these methods at any time, to include deleting unneeded fields, see [Manage fields](#manage-fields) for details. import TerraformLink from '../reuse/terraform-link.md'; @@ -38,11 +38,11 @@ You can use Terraform to provide a field with the [`sumologic_field`](https://re ## About metrics sources, fields, and metadata -Sumo Logic metrics sources also support tagging with fields defined in your Fields schema or other metadata that hasn’t been added to your schema. Here’s how it works: +Sumo Logic metrics sources also support tagging with fields defined in your fields schema or other metadata that hasn’t been added to your schema. Here’s how it works: -When creating or updating the configuration of an HTTP Source or a Collector that has an HTTP source, you assign it a field on the configuration page. If the field doesn’t exist in the schema, you are prompted whether or not you want to **Automatically activate all fields on save**. If you select that option, the field will be added to the schema and be applied to the logs collected by the Collector, and to metrics and logs collected by the HTTP Source. If you do not select **Automatically activate all fields on save**, the field will not be saved to your Fields schema, and the field will be applied only to the metrics collected by the HTTP Source. +When creating or updating the configuration of an HTTP source or a collector that has an HTTP source, you assign it a field on the configuration page. If the field doesn’t exist in the schema, you are prompted whether or not you want to **Automatically activate all fields on save**. If you select that option, the field will be added to the schema and be applied to the logs collected by the collector, and to metrics and logs collected by the HTTP source. If you do not select **Automatically activate all fields on save**, the field will not be saved to your fields schema, and the field will be applied only to the metrics collected by the HTTP source. -When creating or updating the configuration of a Streaming Metrics Source, a Host Metrics Source, or a Docker Source, you can assign it metadata on the source configuration page. Metadata fields you assign in this fashion to these metrics sources do not need to exist in your Fields schema and will not be added to the schema. +When creating or updating the configuration of a Streaming Metrics source, a Host Metrics source, or a Docker source, you can assign it metadata on the source configuration page. Metadata fields you assign in this fashion to these metrics sources do not need to exist in your fields schema and will not be added to the schema. ## Limitations @@ -52,55 +52,55 @@ When creating or updating the configuration of a Streaming Metrics Source, a Hos ::: fields-capacity * It can take up to 10 minutes for fields to start being assigned to your data. -* A Collector can have up to 10 fields. -* A Source can have up to 10 fields. +* A collector can have up to 10 fields. +* A source can have up to 10 fields. * An HTTP request is limited to 30 fields. * A field name (key) is limited to a maximum length of 255 characters. * A value is limited to a maximum length of 200 characters. * Fields cannot be used with [Live Tail](/docs/search/live-tail). -## Collector and Source fields +## Collector and source fields -Fields can be assigned to a Collector and Source using the **Fields** input table in the Sumo user interface when creating or editing a Collector or Source. +Fields can be assigned to a collector and source using the **Fields** input table in the Sumo Logic user interface when creating or editing a collector or source. 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. -1. Create or find and select the Collector or Source you want to assign fields to. +1. Create or find and select the collector or source you want to assign fields to. 1. Click the **+Add Field** link in the **Fields** section. Define the fields you want to associate, each field needs a name (key) and value. - * green check circle.png A green circle with a check mark is shown when the field exists and is enabled in the Fields table schema. - * orange exclamation point.png An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, you'll see an option to automatically add or enable the nonexistent fields to the Fields table schema. If a field is sent to Sumo Logic but isn’t present or enabled in the schema, it’s ignored and marked as **Dropped**. + * green check circle.png A green circle with a check mark is shown when the field exists and is enabled in the fields table schema. + * orange exclamation point.png An orange triangle with an exclamation point is shown when the field doesn't exist in the fields table schema. In this case, you'll see an option to automatically add or enable the nonexistent fields to the fields table schema. If a field is sent to Sumo Logic but isn’t present or enabled in the schema, it’s ignored and marked as **Dropped**. 1. **Automatically activate all fields on save**.  If you click **Automatically activate all fields on save**: - * The field will be saved to your Fields schema. - * The field will be applied to logs collected by the Collector or Source. - * If you are adding the field to an HTTP Source, or to a Collector that has an HTTP Source, the field will be applied to the metrics collected by the source. + * The field will be saved to your fields schema. + * The field will be applied to logs collected by the collector or source. + * If you are adding the field to an HTTP source, or to a collector that has an HTTP source, the field will be applied to the metrics collected by the source. If you do not click **Automatically activate all fields on save**: - * The field will be *not* be saved to your Fields schema - * The field will be applied to logs collected by the Collector or Source, but because the field won’t be added to your Fields schema, it will be dropped by Sumo Logic when logs with that field are ingested. - * If you are adding the field to an HTTP Source, or to a Collector that has an HTTP Source, the field will be applied to the metrics collected by the source. + * The field will be *not* be saved to your fields schema + * The field will be applied to logs collected by the collector or source, but because the field won’t be added to your fields schema, it will be dropped by Sumo Logic when logs with that field are ingested. + * If you are adding the field to an HTTP source, or to a collector that has an HTTP source, the field will be applied to the metrics collected by the source. 1. Click **Save**. Edit collector fields name -In the above example, we have created a new field called `cluster` and set the value to `k8s.dev`. With this configuration, any logs sent to this Collector will now have this key-value pair associated with it. +In the above example, we have created a new field called `cluster` and set the value to `k8s.dev`. With this configuration, any logs sent to this collector will now have this key-value pair associated with it. With this association, you can search for `cluster=k8s.dev` to return your logs.
Collector field search results -### Using Collector API +### Using collector API -Use the `fields` parameter with the [Collector API](/docs/api/collector-management) to define fields on a Collector or Source. +Use the `fields` parameter with the [Collector API](/docs/api/collector-management) to define fields on a collector or source. | Parameter | Type | Required? | Description | Access | |:--|:--|:--|:--|:--| -| fields | JSON Object | No | JSON map of key-value fields (metadata) to apply to the Collector or Source. | Modifiable | +| fields | JSON Object | No | JSON map of key-value fields (metadata) to apply to the collector or source. | Modifiable | -The following JSON is an example configuration of a Hosted Collector with the fields parameter: +The following JSON is an example configuration of a Hosted collector with the fields parameter: ```json { @@ -118,13 +118,13 @@ The following JSON is an example configuration of a Hosted Collector with the fi ### Using Local Configuration -Installed Collectors can use JSON files to configure their Sources when using [Local Configuration File Management](/docs/send-data/use-json-configure-sources/local-configuration-file-management). Use the `fields` parameter in your JSON configuration to define fields on a Source. +Installed collectors can use JSON files to configure their sources when using [Local Configuration File Management](/docs/send-data/use-json-configure-sources/local-configuration-file-management). Use the `fields` parameter in your JSON configuration to define fields on a source. | Parameter | Type | Required? | Description | Access | |:--|:--|:--|:--|:--| -| fields | JSON Object | No | JSON map of key-value fields (metadata) to apply to the Collector or Source. | Modifiable | +| fields | JSON Object | No | JSON map of key-value fields (metadata) to apply to the collector or source. | Modifiable | -The following JSON is an example configuration of a Local File Source with the fields parameter: +The following JSON is an example configuration of a Local File source with the fields parameter: ```json { @@ -153,19 +153,19 @@ The following JSON is an example configuration of a Local File Source with the f } ``` -### HTTP Source fields +### HTTP source fields -When uploading log data with HTTP Sources you can pass fields in two +When uploading log data with HTTP sources you can pass fields in two ways, * with the [X-Sumo-Fields HTTP header](#x-sumo-fields-http-header). -* enabling [Extended HTTP Metadata Collection](#extended-http-metadata-collection) on your Source. +* enabling [Extended HTTP Metadata Collection](#extended-http-metadata-collection) on your source. You can use both methods together. If there is a name collision between a given header and a value passed in X-Sumo-Fields, X-Sumo-Fields takes precedence. -Any fields passed with your data need to exist in your Fields schema defined in Sumo. Any fields not defined in Sumo that are passed through a header are dropped. See how to define fields in the [manage fields](#manage-fields) section. +Any fields passed with your data need to exist in your fields schema defined in Sumo Logic. Any fields not defined in Sumo Logic that are passed through a header are dropped. See how to define fields in the [Manage fields](#manage-fields) section. -See [how to upload logs to an HTTP Source](/docs/send-data/hosted-collectors/http-source/logs-metrics). +See [how to upload logs to an HTTP source](/docs/send-data/hosted-collectors/http-source/logs-metrics). #### X-Sumo-Fields HTTP header @@ -177,11 +177,11 @@ curl -v -X POST -H 'X-Sumo-Fields:environment=dev,cluster=k8s' -T /file.txt -With this field set on your Source, headers are processed as metadata fields. For example, a cURL command posting data with custom fields would look like: +With this field set on your source, headers are processed as metadata fields. For example, a cURL command posting data with custom fields would look like: ```bash curl -v -X POST -H 'environment: dev' -H 'cluster: k8s' -T /file.txt @@ -193,9 +193,9 @@ The following headers are reserved and can not be used: X-Sumo-Category, X-Sum ### Tags from EC2 -Create a Sumo Logic [AWS Metadata Source](/docs/send-data/hosted-collectors/amazon-aws/aws-metadata-tag-source.md) to collect custom tags from EC2 instances running on AWS. An Installed Collector automatically pulls [AWS instance identity documents](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html) (IMDSv2) from instances to get their accountID, availabilityZone, instanceId, instanceType, and region. +Create a Sumo Logic [AWS Metadata source](/docs/send-data/hosted-collectors/amazon-aws/aws-metadata-tag-source.md) to collect custom tags from EC2 instances running on AWS. An Installed collector automatically pulls [AWS instance identity documents](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html) (IMDSv2) from instances to get their accountID, availabilityZone, instanceId, instanceType, and region. -Logs ingested by Installed Collectors on EC2 instances will be tagged as long as the tag, including instance information tags, exists in the organization's Fields schema. See how to define fields in the [manage fields](#manage-fields) section. EC2 resource tags take precedence over EC2 instance information. Only one AWS Metadata Source is required to collect tags from multiple hosts. +Logs ingested by Installed collectors on EC2 instances will be tagged as long as the tag, including instance information tags, exists in the organization's fields schema. See how to define fields in the [Manage fields](#manage-fields) section. EC2 resource tags take precedence over EC2 instance information. Only one AWS Metadata source is required to collect tags from multiple hosts. Tags are returned in your search results and can be referenced in queries. For information about assigning tags to EC2 instances, see [Tagging Your Amazon EC2 Resources](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html) in AWS help.  @@ -239,8 +239,8 @@ The Fields page displays the following information:  * **Field Extraction Rules** shows the number of Field Extraction Rules that reference the field. * **Role Based Access** **Control** shows the number of Roles using a search filter that references the field. * **Partitions** shows the number of Partitions that reference the field. -* **Collectors** shows the number of Collectors that reference the field. (Available when viewing custom fields.) -* **Sources** shows the number of Sources that reference the field. (Available when viewing custom fields.) +* **Collectors** shows the number of collectors that reference the field. (Available when viewing custom fields.) +* **Sources** shows the number of sources that reference the field. (Available when viewing custom fields.) * **Fields Capacity** (bottom of table) shows how many fields your account is using, out of the total available for use. On the Fields page you can: @@ -263,7 +263,7 @@ For the fields listed, select a row to view its details. A details pane appears #### Add field -Adding a field will define it in the Fields schema allowing it to be assigned as metadata to your logs. +Adding a field will define it in the fields schema allowing it to be assigned as metadata to your logs. 1. Click the **+ Add** button on the top right of the table. A panel named **Add Field** appears to the right of the fields table. 1. Input a field name and click **Save**. diff --git a/docs/manage/index.md b/docs/manage/index.md index 8d3daf4f2a..14f2166dbb 100644 --- a/docs/manage/index.md +++ b/docs/manage/index.md @@ -1,7 +1,7 @@ --- slug: /manage title: Manage Account -description: Manage user accounts, Collectors and Sources, security, SEO, and other administrative details. +description: Manage user accounts, collectors and sources, security, SEO, and other administrative details. --- import useBaseUrl from '@docusaurus/useBaseUrl'; @@ -9,7 +9,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; icon :::tip -See [Collection](/docs/send-data/collection) to learn about Collectors, Sources, and processing rules. +See [Collection](/docs/send-data/collection) to learn about collectors, sources, and processing rules. ::: This topic describes features and options that give you administration over accounts, roles, collectors, content sharing, field extraction rules, and much more. @@ -30,7 +30,7 @@ This topic describes features and options that give you administration over acco
icon

Partitions

 -

Accelerate the search process by allowing Admins to filter a subset of the log messages in an index.

+

Accelerate the search process by allowing admins to filter a subset of the log messages in an index.

@@ -42,7 +42,7 @@ This topic describes features and options that give you administration over acco
icon

Health Events

 -

Monitor the health of your Collectors and Sources.

+

Monitor the health of your collectors and sources.

diff --git a/docs/manage/partitions/index.md b/docs/manage/partitions/index.md index f025a68dea..3df892b0ff 100644 --- a/docs/manage/partitions/index.md +++ b/docs/manage/partitions/index.md @@ -1,7 +1,7 @@ --- slug: /manage/partitions title: Partitions -description: Partitions speed the search process by allowing an Admin to filter a subset of the log messages in an index. +description: Partitions speed the search process by allowing an admin to filter a subset of the log messages in an index. --- import Iframe from 'react-iframe'; From 5dddfdb49557604c2e95e6fb1e016db8d8aa8123 Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Fri, 20 Feb 2026 16:22:39 -0600 Subject: [PATCH 02/14] Continue --- .../create-field-extraction-rule.md | 14 +++++----- .../field-naming-convention.md | 12 ++++----- docs/manage/field-extractions/index.md | 2 +- docs/manage/fields.md | 27 +++++++++---------- 4 files changed, 26 insertions(+), 29 deletions(-) diff --git a/docs/manage/field-extractions/create-field-extraction-rule.md b/docs/manage/field-extractions/create-field-extraction-rule.md index 69e768df89..e66110e9bf 100644 --- a/docs/manage/field-extractions/create-field-extraction-rule.md +++ b/docs/manage/field-extractions/create-field-extraction-rule.md @@ -61,17 +61,17 @@ To create a Field Extraction Rule: * Rule limit - none * Time - During a search when using **Auto Parse Mode** from [Dynamic Parsing](../../search/get-started-with-search/build-search/dynamic-parsing.md). * **Scope**. Select either **All Data** or **Specific Data**. When specifying data the options for the scope differ depending on when the rule is applied. - * For an **Ingest Time** rule, type a [keyword search expression](/docs/search/get-started-with-search/build-search/keyword-search-expressions.md) that points to the subset of logs you'd like to parse. Think of the Scope as the first portion of an ad hoc search, before the first pipe (`|`). You'll use the Scope to run a search against the rule. Custom metadata fields are not supported here, they have not been indexed to your data yet at this point in collection. - * For a **Run Time** rule, define the scope of your JSON data. You can define your JSON data source as a [Partition](/docs/manage/partitions) Name(index), sourceCategory, Host Name, Collector Name, or any other [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) that describes your JSON data. Think of the Scope as the first portion of an ad hoc search, before the first pipe (`|`). You'll use the Scope to run a search against the rule. You cannot use keywords like “info” or “error” in your scope. + * For an **Ingest Time** rule, type a [keyword search expression](/docs/search/get-started-with-search/build-search/keyword-search-expressions.md) that points to the subset of logs you'd like to parse. Think of the scope as the first portion of an ad hoc search, before the first pipe (`|`). You'll use the scope to run a search against the rule. Custom metadata fields are not supported here, they have not been indexed to your data yet at this point in collection. + * For a **Run Time** rule, define the scope of your JSON data. You can define your JSON data source as a [partition](/docs/manage/partitions) Name(index), sourceCategory, Host Name, Collector Name, or any other [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) that describes your JSON data. Think of the scope as the first portion of an ad hoc search, before the first pipe (`|`). You'll use the scope to run a search against the rule. You cannot use keywords like “info” or “error” in your scope. :::note - Always set up JSON auto extraction (Run Time field extraction) on a specific Partition name (recommended) or a particular Source. Failing to do so might cause the auto parsing logic to run on data sources where it is not applicable and will add additional overhead that might deteriorate the performance of your queries. + Always set up JSON auto extraction (Run Time field extraction) on a specific partition name (recommended) or a particular Source. Failing to do so might cause the auto parsing logic to run on data sources where it is not applicable and will add additional overhead that might deteriorate the performance of your queries. ::: :::sumo Best Practices - If you are not using Partitions we recommend using [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) fields like `_sourceCategory`, `_sourceHost` or `_collector` to define the scope. + If you are not using partitions we recommend using [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) fields like `_sourceCategory`, `_sourceHost` or `_collector` to define the scope. - We recommend creating a separate Partition for your JSON dataset and use that Partition as the scope for run time field extraction. For example, let's say you have AWS CloudTrail logs, and they are stored in `_view=cloudtrail` Partition in Sumo. You can create a Run Time FER with the scope `_view=cloudtrail`. Creating a separate Partition and using it as scope for a run time field extraction ensures that auto parsing logic only applies to necessary Partitions. + We recommend creating a separate partition for your JSON dataset and use that partition as the scope for run time field extraction. For example, let's say you have AWS CloudTrail logs, and they are stored in `_view=cloudtrail` partition in Sumo. You can create a Run Time FER with the scope `_view=cloudtrail`. Creating a separate partition and using it as scope for a run time field extraction ensures that auto parsing logic only applies to necessary partitions. ::: * **Parsed template** (Optional for Ingest Time rules). @@ -111,7 +111,7 @@ parse "user=\"*\" action=\"*\" sessionId=\"*\"" as user, action, sessionid | action | Action performed by the user | Delete | | sessionId | Session ID for user action | 145623 | -## Best practices for designing Rules +## Best practices for designing rules **Include the most accurate keywords to identify the subset of data from which you want to extract data.** Lock down the scope as tightly as possible to make sure it's extracting just the data you want, nothing more. Using a broader scope means that Sumo Logic will inspect more data for the fields you'd like to parse, which may mean that fields are extracted when you do not actually need them. @@ -123,7 +123,7 @@ parse "user=\"*\" action=\"*\" sessionId=\"*\"" as user, action, sessionid **Test the scope before creating the rule.** Make sure that you can extract fields from all messages you need to be returned in search results. Test them by running a potential rule as a search. -**Make sure all fields appear in the Scope you define.** When Field Extraction is applied to data, all fields must be present to have any fields indexed; even if one field isn't found in a message, that message is dropped from the results. In other words, it's all or nothing. For multiple sets of fields that are somewhat independent, make two rules. +**Make sure all fields appear in the scope you define.** When Field Extraction is applied to data, all fields must be present to have any fields indexed; even if one field isn't found in a message, that message is dropped from the results. In other words, it's all or nothing. For multiple sets of fields that are somewhat independent, make two rules. **Reuse field names in multiple FERs if scope is distinct and separate and not matching same messages.** To save space and allow for more FERs within your 200 field limit, you can reuse the field names as long as they are used in non-overlapping FERs.  diff --git a/docs/manage/field-extractions/field-naming-convention.md b/docs/manage/field-extractions/field-naming-convention.md index 99887b0620..e911ef0715 100644 --- a/docs/manage/field-extractions/field-naming-convention.md +++ b/docs/manage/field-extractions/field-naming-convention.md @@ -5,26 +5,26 @@ description: Sumo Logic recommends using the following naming convention for sta --- -Sumo Logic recommends using the following naming convention for standard fields. This best practice creates standardization across your deployment for use with Field Extraction Rules (FER), Searches and Dashboards, makes it easier for users to recognize fields by their names, and can even improve search performance. +Sumo Logic recommends using the following naming convention for standard fields. This best practice creates standardization across your deployment for use with Field Extraction Rules (FER), searches and dashboards, makes it easier for users to recognize fields by their names, and can even improve search performance. -For example, if you create your own FER for Source IP, and at some point you want to count by Source IPs across multiple Sources, you can easily do so because you've used the same name for the field across all Sources. In your query, simply use: +For example, if you create your own FER for source IP, and at some point you want to count by source IPs across multiple sources, you can easily do so because you've used the same name for the field across all sources. In your query, simply use: ```sql | count by src_ip ``` -Another benefit of using the standard field naming convention is that [Sumo Logic Apps](/docs/get-started/apps-integrations) are created using this naming convention. So if you use it too, your queries will match those of the Sumo Logic Apps’ pre-configured searches and Dashboards. +Another benefit of using the standard field naming convention is that [Sumo Logic apps](/docs/get-started/apps-integrations) are created using this naming convention. So if you use it too, your queries will match those of the Sumo Logic apps’ pre-configured searches and dashboards. If you cannot use all the naming conventions for standard fields, we recommend that you at least use the field name conventions for the following: * Source Hosts * Destination Hosts * IP address -* user +* User -## Source Information +## Source information -| Field Name | Description | +| Field name | Description | |:--|:--| | src_host | Source Host (name or IP) | | src_interface | Source Interface | diff --git a/docs/manage/field-extractions/index.md b/docs/manage/field-extractions/index.md index 9bf5a08c4a..71fe250775 100644 --- a/docs/manage/field-extractions/index.md +++ b/docs/manage/field-extractions/index.md @@ -33,7 +33,7 @@ The Field Extraction Rules page displays the following information:  When hovering over a row in the table there are icons that appear on the far right for editing, disabling and deleting the rule. -* **Status** shows a checkmark in a green circle Check in green circle to indicate if the Rule is actively being applied or an exclamation mark in a red circle Exclamation in red circl to indicate if the Rule is disabled. +* **Status** shows a checkmark in a green circle Check in green circle to indicate if the rule is actively being applied or an exclamation mark in a red circle Exclamation in red circl to indicate if the rule is disabled. * **Rule Name** * **Applied At** indicates when the field extraction process occurs, either at Ingest or Run time. * **Scope**  diff --git a/docs/manage/fields.md b/docs/manage/fields.md index bf9ad25cf6..51d27fb275 100644 --- a/docs/manage/fields.md +++ b/docs/manage/fields.md @@ -38,7 +38,7 @@ You can use Terraform to provide a field with the [`sumologic_field`](https://re ## About metrics sources, fields, and metadata -Sumo Logic metrics sources also support tagging with fields defined in your fields schema or other metadata that hasn’t been added to your schema. Here’s how it works: +Sumo Logic metrics sources also support tagging with fields defined in your fields schema or other metadata that hasn’t been added to your schema. When creating or updating the configuration of an HTTP source or a collector that has an HTTP source, you assign it a field on the configuration page. If the field doesn’t exist in the schema, you are prompted whether or not you want to **Automatically activate all fields on save**. If you select that option, the field will be added to the schema and be applied to the logs collected by the collector, and to metrics and logs collected by the HTTP source. If you do not select **Automatically activate all fields on save**, the field will not be saved to your fields schema, and the field will be applied only to the metrics collected by the HTTP source. @@ -116,9 +116,9 @@ The following JSON is an example configuration of a Hosted collector with the fi } ``` -### Using Local Configuration +### Using local configuration -Installed collectors can use JSON files to configure their sources when using [Local Configuration File Management](/docs/send-data/use-json-configure-sources/local-configuration-file-management). Use the `fields` parameter in your JSON configuration to define fields on a source. +Installed collectors can use JSON files to configure their sources when using [local configuration file management](/docs/send-data/use-json-configure-sources/local-configuration-file-management). Use the `fields` parameter in your JSON configuration to define fields on a source. | Parameter | Type | Required? | Description | Access | |:--|:--|:--|:--|:--| @@ -175,7 +175,7 @@ Your fields need to be in a comma separated list of key-value pairs. For example curl -v -X POST -H 'X-Sumo-Fields:environment=dev,cluster=k8s' -T /file.txt ``` -#### Extended HTTP Metadata Collection +#### Extended HTTP metadata collection When creating or editing your HTTP source that will receive log data add the field `_convertHeadersToFields` with a value of `true`. This field needs to be added to your fields schema to work. @@ -203,9 +203,9 @@ Tags are returned in your search results and can be referenced in queries. For i Fields can be used in the following ways: -* Log [Search page](/docs/search). Use the key-value pair as a keyword search expression (before the first pipe, \| ). +* [Log Search ](/docs/search). Use the key-value pair as a keyword search expression (before the first pipe, \| ). * [Role Based Access Control](/docs/manage/users-roles/roles) (RBAC). Fields can be used in role search filters to control access to data. -* [Partitions](/docs/manage/partitions), [Scheduled Views](/docs/manage/scheduled-views), and [Field Extraction Rules](/docs/manage/field-extractions). Fields can be used in the scope of Partitions, Scheduled Views, and Field Extraction Rules. +* [Partitions](/docs/manage/partitions), [Scheduled Views](/docs/manage/scheduled-views), and [Field Extraction Rules](/docs/manage/field-extractions). Fields can be used in the scope of partitions, Scheduled Views, and Field Extraction Rules. :::note Fields cannot be used with [Live Tail](/docs/search/live-tail). @@ -237,21 +237,18 @@ The Fields page displays the following information:  * **Field Name** is the name of the field, known as the key in the key-value pair. * **Data Type** shows the data type of the field. * **Field Extraction Rules** shows the number of Field Extraction Rules that reference the field. -* **Role Based Access** **Control** shows the number of Roles using a search filter that references the field. -* **Partitions** shows the number of Partitions that reference the field. +* **Role Based Access** **Control** shows the number of roles using a search filter that references the field. +* **Partitions** shows the number of partitions that reference the field. * **Collectors** shows the number of collectors that reference the field. (Available when viewing custom fields.) * **Sources** shows the number of sources that reference the field. (Available when viewing custom fields.) * **Fields Capacity** (bottom of table) shows how many fields your account is using, out of the total available for use. On the Fields page you can: - * Click **+ Add** to add fields. -* Search fields * The dropdown next to the add button lets you toggle between the following: - - * **Existing -** **Built-in Fields**. These are [metadata fields created by Sumo Logic](../search/get-started-with-search/search-basics/built-in-metadata.md) and cannot be modified. - * **Existing - Custom Fields**. These fields were either created by FERs or users. - * **Dropped Fields**. These fields are being dropped due to not existing in the fields table. - +* Search fields. The dropdown next to the add button lets you toggle between the following: + * **Existing -** **Built-in Fields**. These are [metadata fields created by Sumo Logic](../search/get-started-with-search/search-basics/built-in-metadata.md) and cannot be modified. + * **Existing - Custom Fields**. These fields were either created by FERs or users. + * **Dropped Fields**. These fields are being dropped due to not existing in the fields table. * Disable fields * Delete fields  From c07cd48f6e4678227157852b31d9d19171a5e208 Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Wed, 25 Feb 2026 15:18:34 -0600 Subject: [PATCH 03/14] Data tiers --- .../edit-field-extraction-rules.md | 6 +-- .../field-extractions/fer-templates/index.md | 2 +- .../data-tiers/create-edit-partition.md | 50 +++++++++---------- docs/manage/partitions/data-tiers/index.md | 36 ++++++------- .../data-tiers/searching-data-tiers.md | 8 +-- .../data-tiers/view-partition-details.md | 6 +-- docs/manage/partitions/index.md | 18 +++---- 7 files changed, 63 insertions(+), 63 deletions(-) diff --git a/docs/manage/field-extractions/edit-field-extraction-rules.md b/docs/manage/field-extractions/edit-field-extraction-rules.md index 476f7f7b57..94e7a2cdf6 100644 --- a/docs/manage/field-extractions/edit-field-extraction-rules.md +++ b/docs/manage/field-extractions/edit-field-extraction-rules.md @@ -1,15 +1,15 @@ --- id: edit-field-extraction-rules title: Edit Field Extraction Rules -description: You can change Field Extraction Rules. +description: You can change field extraction rules. --- :::important You need the **Manage field extraction rules** [role capability](../users-roles/roles/role-capabilities.md) to edit a field extraction rule.  ::: -Changes to Field Extraction Rules are implemented immediately. Additionally, you can save a copy of a rule and make edits to the new version of the rule without making any changes to the original rule. +Changes to field extraction rules are implemented immediately. Additionally, you can save a copy of a rule and make edits to the new version of the rule without making any changes to the original rule. -1. [**New UI**](/docs/get-started/sumo-logic-ui). To access the Field Extraction Rules page, in the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. +1. [**New UI**](/docs/get-started/sumo-logic-ui). To access the field extraction rules page, in the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. 1. Find the rule in the table and click it. A window appears on the right of the table, click the **Edit** button. 1. Make changes as needed and click **Save** when done.  diff --git a/docs/manage/field-extractions/fer-templates/index.md b/docs/manage/field-extractions/fer-templates/index.md index 5be207b3fa..f15a331238 100644 --- a/docs/manage/field-extractions/fer-templates/index.md +++ b/docs/manage/field-extractions/fer-templates/index.md @@ -5,7 +5,7 @@ description: Instead of creating a parse expression, you can select a Template f --- import useBaseUrl from '@docusaurus/useBaseUrl'; -FER Templates are provided for common applications such as Apache Access, Akamai Cloud Monitor, AWS ELB, and Microsoft IIS logs. Rather than creating a parse expression from scratch, you can select a Template from the list, preview it, and then click to apply it. +FER templates are provided for common applications such as Apache Access, Akamai Cloud Monitor, AWS ELB, and Microsoft IIS logs. Rather than creating a parse expression from scratch, you can select a template from the list, preview it, and then click to apply it. FER Templates diff --git a/docs/manage/partitions/data-tiers/create-edit-partition.md b/docs/manage/partitions/data-tiers/create-edit-partition.md index 959a202d5f..942ebd2c56 100644 --- a/docs/manage/partitions/data-tiers/create-edit-partition.md +++ b/docs/manage/partitions/data-tiers/create-edit-partition.md @@ -1,7 +1,7 @@ --- id: create-edit-partition title: Create and Edit a Partition -description: Learn how to create and edit a Partition in an Index. +description: Learn how to create and edit a partition in an index. --- import useBaseUrl from '@docusaurus/useBaseUrl'; @@ -11,58 +11,58 @@ Partitions provide three primary functions: * Enhance searches * Enhance retention options -Partitions ingest your messages in real time, and differ from [Scheduled Views](/docs/manage/scheduled-views), which backfill with aggregate data. Partitions begin building a non-aggregate index from the time the Partition is created and only index data moving forward (from the time of creation). +Partitions ingest your messages in real time, and differ from [Scheduled Views](/docs/manage/scheduled-views), which backfill with aggregate data. Partitions begin building a non-aggregate index from the time the partition is created and only index data moving forward (from the time of creation). See [Partitions](/docs/manage/partitions) for limitations. ## Prerequisites -To create or edit a Partition, you must be an account Administrator or have the [Manage Partitions role capability](/docs/manage/users-roles/roles/role-capabilities). It's important to note that Partitions only affect data generated from the date of their creation onwards; any data predating their establishment is not included. +To create or edit a partition, you must be an account Administrator or have the [Manage Partitions role capability](/docs/manage/users-roles/roles/role-capabilities). It's important to note that partitions only affect data generated from the date of their creation onwards; any data predating their establishment is not included. -## Partitions and Data Tiers +## Partitions and data tiers -If you have a Sumo Logic Enterprise Suite account, you can take advantage of the [Data Tiers](/docs/manage/partitions/data-tiers/) feature, which allows you to choose the tier where the Partition will reside. You select the tier when you configure the Partition.  +If you have a Sumo Logic Enterprise Suite account, you can take advantage of the [data tiers](/docs/manage/partitions/data-tiers/) feature, which allows you to choose the tier where the partition will reside. You select the tier when you configure the partition.  -## Create a Partition +## Create a partition 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Partitions**. You can also click the **Go To...** menu at the top of the screen and select **Partitions**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Manage Data > Logs > Partitions**. 1. Click **+ Add Partition**. 1. The **Create New Partition** pane appears.
create-new-partition.png -1. **Name**. Enter a name for the Partition. Partitions must be named alphanumerically, with no special characters, with the exception of underscores (`_`) and hyphens (`-`). However, a Partition name cannot start with `sumologic_`, an underscore `_`, or a hyphen (`-`). -1. **Data Tier**. (Enterprise Suite accounts only) Click the radio button for the tier where you want the Partition to reside. -1. **Routing Expression**. Enter a [keyword search expression](/docs/search/get-started-with-search/build-search/keyword-search-expressions.md) that matches the data you want to have in the Partition, using [built-in metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) or [custom metadata fields](/docs/manage/fields). If you have an Enterprise Suite account, and are going to assign the Partition to the Infrequent Tier, see the information in the [Assigning Data to a Data Tier](/docs/manage/partitions/data-tiers#assigning-data-to-a-data-tier) section of the [Data Tiers](/docs/manage/partitions/data-tiers/) page. +1. **Name**. Enter a name for the partition. Partitions must be named alphanumerically, with no special characters, with the exception of underscores (`_`) and hyphens (`-`). However, a partition name cannot start with `sumologic_`, an underscore `_`, or a hyphen (`-`). +1. **Data Tier**. (Enterprise Suite accounts only) Click the radio button for the tier where you want the partition to reside. +1. **Routing Expression**. Enter a [keyword search expression](/docs/search/get-started-with-search/build-search/keyword-search-expressions.md) that matches the data you want to have in the partition, using [built-in metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) or [custom metadata fields](/docs/manage/fields). If you have an Enterprise Suite account, and are going to assign the partition to the Infrequent Tier, see the information in the [Assigning data to a data tier](/docs/manage/partitions/data-tiers#assigning-data-to-a-data-tier) section of the [Data Tiers](/docs/manage/partitions/data-tiers/) page. :::note - The [`_dataTier`](searching-data-tiers.md) search modifier is not supported in Partition routing expressions. + The [`_dataTier`](searching-data-tiers.md) search modifier is not supported in partition routing expressions. ::: -1. **Retention Period**. Enter the number of days you wish to retain the data in the Partition, or click **Apply the retention period of the Default Continuous Index**. -1. **Data Forwarding**. If you want to forward the data in the Partition to a cloud environment, click **Enable Data Forwarding** and specify the necessary information for the options that appear. For more information, see [Data Forwarding](/docs/manage/data-forwarding). +1. **Retention Period**. Enter the number of days you wish to retain the data in the partition, or click **Apply the retention period of the Default Continuous Index**. +1. **Data Forwarding**. If you want to forward the data in the partition to a cloud environment, click **Enable Data Forwarding** and specify the necessary information for the options that appear. For more information, see [Data Forwarding](/docs/manage/data-forwarding). ### Enhance search and retention -* To learn how to run a search against a Partition, see [Run a Search Against a Partition](/docs/manage/partitions/run-search-against-partition) and [Optimize Your Search with Partitions](/docs/search/optimize-search-partitions.md). +* To learn how to run a search against a partition, see [Run a Search Against a Partition](/docs/manage/partitions/run-search-against-partition) and [Optimize Your Search with Partitions](/docs/search/optimize-search-partitions.md). * To learn about data retention periods and how to modify them, see [Manage Indexes with Variable Retention](/docs/manage/partitions/manage-indexes-variable-retention). ### Best practices for optimum performance When designing partitions, keep the following in mind: -* **Avoid using queries that are subject to change**. In order to benefit from using Partitions, they should be used for long-term message organization. -* **Make the query as specific as possible**. Making the query specific will reduce the amount of data in the Partition, which increases search performance. +* **Avoid using queries that are subject to change**. In order to benefit from using partitions, they should be used for long-term message organization. +* **Make the query as specific as possible**. Making the query specific will reduce the amount of data in the partition, which increases search performance. * **Keep the query flexible**. Use a flexible query, such as `_sourceCategory=*Apache*`, so that metadata can be adjusted without breaking the query. -* **Group data together that is most often used together**. For example, create Partitions for categories such as web data, security data, or errors. +* **Group data together that is most often used together**. For example, create partitions for categories such as web data, security data, or errors. * **Group data together that is used by teams**. Partitions are an excellent way to organize messages by role and teams within your organization. -* **Avoid including too much data in your partition**. Send between 2% and 20% of your data to a Partition. Including 90% of the data in your index in a Partition won’t improve search performance. -* **Don’t create overlapping partitions**. With multiple Partitions, messages could be duplicated if you create routing expressions that overlap. For example, if you have the following Partitions, messages for `_sourceCategory=prod/Apache` would be duplicated as they would be stored in both Partitions.  +* **Avoid including too much data in your partition**. Send between 2% and 20% of your data to a partition. Including 90% of the data in your index in a partition won’t improve search performance. +* **Don’t create overlapping partitions**. With multiple partitions, messages could be duplicated if you create routing expressions that overlap. For example, if you have the following partitions, messages for `_sourceCategory=prod/Apache` would be duplicated as they would be stored in both partitions.  * Partition1: `_sourceCategory=prod` * Partition2: `_sourceCategory=*/Apache` -Overlapping data between two or more Partitions will count as additional ingest toward your account's quota. See [Data Volume Index](/docs/manage/ingestion-volume/data-volume-index). +Overlapping data between two or more partitions will count as additional ingest toward your account's quota. See [Data Volume Index](/docs/manage/ingestion-volume/data-volume-index). ## Edit a partition This section has instructions for editing a partition.   -When you create a partition, you specify the Data Tier where the partition will reside, a routing expression that determines what data is stored in the partition, and a retention period. Optionally, you can enable data forwarding of the partition’s data to an S3 bucket.   +When you create a partition, you specify the data tier where the partition will reside, a routing expression that determines what data is stored in the partition, and a retention period. Optionally, you can enable data forwarding of the partition’s data to an S3 bucket.   ### About partition editability @@ -74,8 +74,8 @@ You can make some changes to an existing partition:   By default, Sumo Logic internal partitions like `sumologic_audit_events`, `sumologic_volume`, and so on, have the same retention period as the Default Continuous Index. You can change the retention period for any of these internal partitions as desired. ::: * You can change the data forwarding configuration. -* You cannot change the name of partition, reuse a partition name, or change the target Data Tier.   -* Security partitions can’t be edited. Sumo Logic stores Cloud SIEM Records in seven partitions, one for each [Cloud SIEM Record type](/docs/cse/schema/cse-record-types). The names of the Sumo Logic partitions that contain Cloud SIEM Records begin with the string `sec_record_`. If you have a role that grants you the **View Partitions** capability, you can view the security partitions in the Sumo Logic UI. Note, however, that no user can edit or remove a security partition. +* You cannot change the name of partition, reuse a partition name, or change the target data tier.   +* Security partitions can’t be edited. Sumo Logic stores Cloud SIEM records in seven partitions, one for each [Cloud SIEM record type](/docs/cse/schema/cse-record-types). The names of the Sumo Logic partitions that contain Cloud SIEM records begin with the string `sec_record_`. If you have a role that grants you the **View Partitions** capability, you can view the security partitions in the Sumo Logic UI. Note, however, that no user can edit or remove a security partition. ### Changing a partition's routing expression @@ -87,9 +87,9 @@ Before changing the routing expression for a partition, consider the impact of t 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Partitions**. You can also click the **Go To...** menu at the top of the screen and select **Partitions**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Manage Data > Logs > Partitions**. 1. To refine the table results, use the **Add a filter** section located above the table. *AND* logic is applied when filtering between different sections, while *OR* logic is applied when filtering within the same section. - :::note - You can see the suggestions only if there are two or more responses for the same column or section. - ::: + :::note + You can see the suggestions only if there are two or more responses for the same column or section. + ::: 1. Click the row with the partition you want to edit. 1. The partition details are displayed on the right side of the page. 1. Click **Edit** to open the pane for editing.
edit-partition-pane.png diff --git a/docs/manage/partitions/data-tiers/index.md b/docs/manage/partitions/data-tiers/index.md index 240df92a21..be808dd005 100644 --- a/docs/manage/partitions/data-tiers/index.md +++ b/docs/manage/partitions/data-tiers/index.md @@ -1,11 +1,11 @@ --- slug: /manage/partitions/data-tiers title: Data Tiers -description: Data Tiers provide the ability to allocate data to different storage tiers based on frequency of access - Continuous, Frequent, and Infrequent. +description: Data tiers provide the ability to allocate data to different storage tiers based on frequency of access - Continuous, Frequent, and Infrequent. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -This page describes Sumo Logic's Data Tiers feature. +This page describes Sumo Logic's data tiers feature. :::tip For related information, see [Data Tiers FAQ](faq.md). @@ -21,25 +21,25 @@ Some use cases require “high touch” data that you need to monitor and analyz Other use cases require much less frequent data analysis. Here, we’re talking about “low touch” data that can be very valuable when you want to mine your data for insights, provide periodic reports, or perform a root cause analysis. These use cases can require frequent or infrequent access to data like development, test, and pre-production logs; debug logs; CDN logs; and network logs. -Sumo Logic’s *Data Tiers* provide a comprehensive solution for all types of data that an organization has, low touch, high touch and everything in between, at an economical price. Data Tiers provide tier-based pricing based on your planned usage of the data you ingest.  +Sumo Logic’s *data tiers* provide a comprehensive solution for all types of data that an organization has, low touch, high touch and everything in between, at an economical price. Data tiers provide tier-based pricing based on your planned usage of the data you ingest.  :::note -Data Tiers must be enabled on your [Cloud Flex Legacy account](/docs/manage/manage-subscription/cloud-flex-legacy-accounts) or [Sumo Logic Credits account](/docs/manage/manage-subscription/sumo-logic-credits-accounts) plan to be able to access this functionality. Infrequent Tier, described below, is only available on Sumo Logic Credits. For more information, contact your Sumo Logic account representative. +Data tiers must be enabled on your [Cloud Flex Legacy account](/docs/manage/manage-subscription/cloud-flex-legacy-accounts) or [Sumo Logic Credits account](/docs/manage/manage-subscription/sumo-logic-credits-accounts) plan to be able to access this functionality. Infrequent Tier, described below, is only available on Sumo Logic Credits. For more information, contact your Sumo Logic account representative. ::: -## Types of Data Tiers  +## Types of data tiers  -Each Sumo Logic Data Tier supports a different use case and provides its own set of features and capabilities:  +Each Sumo Logic data tier supports a different use case and provides its own set of features and capabilities:  * The Continuous Tier is for the data you use to monitor and troubleshoot production applications and to ensure the security of your applications. * The Frequent Tier - available only for Sumo Logic Enterprise Suite plans - is for data you need to frequently access to troubleshoot and investigate issues. For example, you might use the Frequent Tier for development and test data that helps you investigate issues during development. Searching the Frequent Tier is free: it's included in the data ingestion price. * The Infrequent Tier - available only for Sumo Logic Enterprise Suite plans - is for data that is used to troubleshoot intermittent or hard-to-reproduce issues. For example, you might use the Infrequent Tier for debug logs, OS logs, thread dumps, and so on. The Infrequent Tier has a pay-per-search pricing model, and very low ingestion cost. -## Planning your use of Data Tiers  +## Planning your use of data tiers  If you do not specify a data tier, all data ingested into Sumo Logic will go to the Continuous Tier. Only data that goes to a partition can go to the Frequent or Infrequent Tiers. You'll need to configure the target tier for the data in a partition on the **Partition** page. -When planning your use of Data Tiers, it is important to remember the following guidelines: +When planning your use of data tiers, it is important to remember the following guidelines: * The General Index cannot be changed, and it is always in the Continuous Tier. * The tier where you assign your data governs how you can search and analyze the data. The table below shows capabilities that are available in each tier.  @@ -52,7 +52,7 @@ After a partition is created in a given tier, you cannot change its tier. If you ## Feature support by tier -How you can search and use your ingested data varies by the Data Tier it resides in, as described in the following table.  +How you can search and use your ingested data varies by the data tier it resides in, as described in the following table.  | Feature support | Continuous Tier | Frequent Tier | Infrequent Tier | | :-- | :-- | :-- | :-- | @@ -74,17 +74,17 @@ How you can search and use your ingested data varies by the Data Tier it resides * Feature activation is subject to minimum volume and service plan requirements, confirmed at time of transaction. -## Assigning data to a Data Tier +## Assigning data to a data tier -You assign data to a Data Tier at the partition level. When you create a partition, you define a routing expression and select the target tier for the data that matches the routing expression. For instructions, see [Create a Partition](/docs/manage/partitions/data-tiers/create-edit-partition). +You assign data to a data tier at the partition level. When you create a partition, you define a routing expression and select the target tier for the data that matches the routing expression. For instructions, see [Create and Edit a Partition](/docs/manage/partitions/data-tiers/create-edit-partition). -## Searching Data Tiers  +## Searching data tiers  For information about searching data tiers, see [Searching Data Tiers](searching-data-tiers.md). ## Common error messages -This section describes the most common error messages for Data Tiers. +This section describes the most common error messages for data tiers. * If you try to add a panel to a dashboard that uses data from the Frequent or Infrequent Tiers, you'll receive the following error message, because you can only use data from the Continuous Tier in a dashboard: `This query is not supported in Dashboards/Scheduled Searches because it is not in the Continuous Analytics tier. Please modify query and try again.`
Create panel> * If you try to specify the scope of a Scheduled View or a Scheduled Search using a partition in the Frequent or Infrequent Data tiers, you'll receive this error message: `This query is not supported in Dashboards/Scheduled Searches because it is not in the Continuous Analytics tier. Please modify query and try again.` @@ -97,25 +97,25 @@ In this section, we'll introduce the following concepts:
icon

Create and Edit a Partition

 -

Learn how to create and edit a Partition in an Index.

+

Learn how to create and edit a partition in an Index.

icon

View Details About a Partition

 -

Learn how to view details about a Sumo Logic Partition.

+

Learn how to view details about a Sumo Logic partition.

- icon

Searching Data Tiers

 -

Learn how to search specific Data Tiers.

+ icon

Searching data tiers

 +

Learn how to search specific data tiers.

icon

Data Tiers FAQs

 -

Get answers on various FAQs about Data Tiers.

+

Get answers on various FAQs about data tiers.

diff --git a/docs/manage/partitions/data-tiers/searching-data-tiers.md b/docs/manage/partitions/data-tiers/searching-data-tiers.md index c5c5905894..812c4022b6 100644 --- a/docs/manage/partitions/data-tiers/searching-data-tiers.md +++ b/docs/manage/partitions/data-tiers/searching-data-tiers.md @@ -1,11 +1,11 @@ --- id: searching-data-tiers title: Searching Data Tiers -description: Learn how to search specific Data Tiers. +description: Learn how to search specific data tiers. --- import useBaseUrl from '@docusaurus/useBaseUrl'; -This page has information about how to search different Data Tiers, and when you should use `_dataTier`, a *search modifier* that restricts your search to a single tier.  +This page has information about how to search different data tiers, and when you should use `_dataTier`, a *search modifier* that restricts your search to a single tier.  import Iframe from 'react-iframe'; @@ -27,7 +27,7 @@ import Iframe from 'react-iframe'; ## About the _dataTier search modifier -In Sumo Logic, a search modifier is a tag that gives the Sumo Logic backend information about how to process a query. The `_dataTier` modifier tells Sumo Logic which Data Tier a query should run against: Continuous, Frequent, or Infrequent. +In Sumo Logic, a search modifier is a tag that gives the Sumo Logic backend information about how to process a query. The `_dataTier` modifier tells Sumo Logic which data tier a query should run against: Continuous, Frequent, or Infrequent. :::note Search modifiers are different from Sumo Logic’s [built-in metadata fields](/docs/search/get-started-with-search/search-basics/built-in-metadata), which are key-value pairs that are tagged to incoming log data, and then can be used to find that data easily, later.  @@ -94,7 +94,7 @@ When you query scheduled views, the Sumo Logic Audit Index, or the Sumo Logic Au If you use `_dataTier` to specify a tier other than Continuous in a query of scheduled views or either of the audit indexes, Sumo Logic presents an error message. -### API Support with Rate Limiting +### API support with rate limiting The rate limits described in [Rate limit throttling](/docs/api/search-job/#rate-limit-throttling) apply to cross-tier searches with these concurrent active job limits:  diff --git a/docs/manage/partitions/data-tiers/view-partition-details.md b/docs/manage/partitions/data-tiers/view-partition-details.md index 6a38e7ccd5..79a7587ee9 100644 --- a/docs/manage/partitions/data-tiers/view-partition-details.md +++ b/docs/manage/partitions/data-tiers/view-partition-details.md @@ -6,13 +6,13 @@ description: Learn how to view details about a Sumo Logic partition. import useBaseUrl from '@docusaurus/useBaseUrl'; -To view details about a Partition: +To view details about a partition: 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Partitions**. You can also click the **Go To...** menu at the top of the screen and select **Partitions**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Manage Data > Logs > Partitions**.
partitions-page -1. Click the row for a Partition to view its details.
view-edit-partition-pane.png +1. Click the row for a partition to view its details.
view-edit-partition-pane.png :::note - The information displayed for partitions that contain Cloud SIEM Records varies from other partitions. You can tell if a partition contains Cloud SIEM Records from its name: The names of the Sumo Logic partitions that contain Cloud SIEM Records begin with the string `sec_record_`. The detailed view for security partitions does not display Data Tier or a routing expression. Note also that you can’t edit a security partition, or configure data forwarding for it. Cloud SIEM users can search security partitions, as described in [Searching for Cloud SIEM Records in Sumo Logic](/docs/cse/records-signals-entities-insights/search-cse-records-in-sumo). + The information displayed for partitions that contain Cloud SIEM records varies from other partitions. You can tell if a partition contains Cloud SIEM records from its name: The names of the Sumo Logic partitions that contain Cloud SIEM records begin with the string `sec_record_`. The detailed view for security partitions does not display Data Tier or a routing expression. Note also that you can’t edit a security partition, or configure data forwarding for it. Cloud SIEM users can search security partitions, as described in [Searching for Cloud SIEM Records in Sumo Logic](/docs/cse/records-signals-entities-insights/search-cse-records-in-sumo). :::   diff --git a/docs/manage/partitions/index.md b/docs/manage/partitions/index.md index 3df892b0ff..d1690cd1ca 100644 --- a/docs/manage/partitions/index.md +++ b/docs/manage/partitions/index.md @@ -27,11 +27,11 @@ You can use Terraform to provide a partition with the [`sumologic_partition`](ht ::: -## About Partitions +## About partitions Partitions route your data to an index becoming a separate subset of data in your account. Creating smaller and separate subsets of data is central to search optimization. When you run a search against an index, results are returned more quickly and efficiently because the search runs against a smaller data set. -After routing messages to a partition, you can reference it in your search by using the field `_index` with the partition's name. See [Optimizing Search with Partitions](/docs/search/optimize-search-partitions) for details. +After routing messages to a partition, you can reference it in your search by using the field `_index` with the partition's name. See [Optimize Your Search with Partitions](/docs/search/optimize-search-partitions) for details. Partitions ingest your messages in real time. They differ from scheduled views in that partitions don’t backfill with aggregate data. They begin building a non-aggregate index from the time the partition is created and index only the data moving forward. Scheduled views backfill with aggregate data, meaning that all data that extends back to the start date of the view query is added to the view. @@ -70,7 +70,7 @@ In this section, we'll introduce the following concepts:
icon

Data Tiers

 -

Data Tiers provide the ability to allocate data to different storage tiers based on frequency of access - Continuous, Frequent, and Infrequent.

+

Data tiers provide the ability to allocate data to different storage tiers based on frequency of access - Continuous, Frequent, and Infrequent.

@@ -82,38 +82,38 @@ In this section, we'll introduce the following concepts:
icon

Estimate Scan Data

 -

Learn about the estimate scan data for Data tier and Flex pricing.

+

Learn about the estimate scan data for data tier and Flex pricing.

Learn about Sumo Logic Flex Pricing.

icon

Search a Partition

 -

Learn how to run a search against data in a Partition.

+

Learn how to run a search against data in a partition.

icon

Edit Data Forwarding Destinations for a Partition

 -

Learn how to specify Data Forwarding settings for a Partition.

+

Learn how to specify data forwarding settings for a partition.

icon

Manage Indexes with Variable Retention

 -

Learn how to create Index Partitions and Scheduled Views to store your data.

+

Learn how to create index partitions and Scheduled Views to store your data.

icon

Decommission a Partition

 -

Learn how to decommission a Partition to keep it from being started.

+

Learn how to decommission a partition to keep it from being started.

icon

Partitions FAQs

 -

Answers to frequently asked questions about Sumo Logic Partitions.

+

Answers to frequently asked questions about Sumo Logic partitions.

From bc1218fe06c7d5c0fcdc33ae5280dfb1c6cfac34 Mon Sep 17 00:00:00 2001 From: John Pipkin Date: Wed, 25 Feb 2026 16:26:14 -0600 Subject: [PATCH 04/14] Scheduled views --- docs/manage/health-events.md | 8 ++--- .../partitions/decommission-partition.md | 2 +- ...-data-forwarding-destinations-partition.md | 4 +-- docs/manage/partitions/faq.md | 2 +- .../flex/create-edit-partition-flex.md | 36 +++++++++---------- docs/manage/partitions/flex/index.md | 6 ++-- .../flex/view-partition-details-flex.md | 6 ++-- .../manage-indexes-variable-retention.md | 20 +++++------ .../run-search-against-partition.md | 2 +- .../scheduled-views/add-scheduled-view.md | 2 +- docs/manage/scheduled-views/index.md | 4 +-- .../run-search-against-scheduled-view.md | 4 +-- .../scheduled-view-lag-time.md | 2 +- .../scheduled-views-best-practices.md | 12 +++---- docs/reuse/flex-pricing.md | 2 +- 15 files changed, 56 insertions(+), 56 deletions(-) diff --git a/docs/manage/health-events.md b/docs/manage/health-events.md index cc58b12bd4..4094cf7f5a 100644 --- a/docs/manage/health-events.md +++ b/docs/manage/health-events.md @@ -74,7 +74,7 @@ Each health event log has common keys that categorize it to a product area and p | subsystem | The product area of the event. | String | | resourceIdentity | This includes any unique identifiers, names, and the type of the object associated with the event. | JSON object of Strings | -## Configure Scheduled Search +## Configure scheduled search Configuring the scheduled search for the selected health event will help you with timely alerts to all the recipients when the health event is triggered every time. To configure, follow the below steps: @@ -101,7 +101,7 @@ _index=sumologic_system_events "0000000007063B25" | where eventType = "Health-Change" AND resourceId = "0000000007063B25" AND eventName="LookupsLimitApproaching" ``` -## View Health Events +## View health events The health events table allows you to easily view and investigate problems which occur while injecting the data to Sumo Logic. On the health events table, you can search, filter, and sort incidents by key aspects like severity, resource name, event name, resource type, and opened since date. @@ -111,7 +111,7 @@ It may take up to 15 minutes for a 90% usage breach for Lookup Tables, Partition 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). Go to **Manage Data > Monitoring > Health Events**.
[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Data Collection** select **Health Events**.
health-events-table 1. Click on the required row to view the details of a health event.
health-events-detial - - **Create Scheduled Search**. Click this button to get alerts for specific health events. The unique identifier of the resource type is used in the query. See [Schedule a Search](../alerts/scheduled-searches/schedule-search.md) for details. + - **Create Scheduled Search**. Click this button to get alerts for specific health events. The unique identifier of the resource type is used in the query. See [Create a Scheduled Search](../alerts/scheduled-searches/schedule-search.md) for details. - Under the **More Actions** menu you can select: * **Event History** to run a search against the **sumologic_system_events** partition to view all of the related event logs. * **View Object** to view the resource in detail related to the event. @@ -131,7 +131,7 @@ It may take up to 15 minutes for a 90% usage breach for Lookup Tables, Partition - **Error Info**. Detailed information about the event. This may include error context and suggested corrective actions. - **Minutes Since Last Heartbeat**. The number of minutes that have elapsed since the system last received a heartbeat signal from the resource. A higher number may indicate the resource is offline or unresponsive. This field is only available for *Collector* resource type. -## View Health Events in Collection page +## View health events in collection page A **Health** column on the Collection page shows color-coded healthy, error, and warning states for Collectors and Sources to quickly determine the health of your Collectors and Sources.
Collection-health-column diff --git a/docs/manage/partitions/decommission-partition.md b/docs/manage/partitions/decommission-partition.md index 0f51ab8209..9d4ef5116c 100644 --- a/docs/manage/partitions/decommission-partition.md +++ b/docs/manage/partitions/decommission-partition.md @@ -20,5 +20,5 @@ To decommission a partition: ::: 1. The partition details appear on the right side of the page.
decommision-button 1. Click **Decommission**. -1. In the Confirm dialog, click **OK**. +1. In the confirmation dialog, click **OK**. 1. The partition is decommissioned. diff --git a/docs/manage/partitions/edit-data-forwarding-destinations-partition.md b/docs/manage/partitions/edit-data-forwarding-destinations-partition.md index 76c08cd4a3..a58ae0465a 100644 --- a/docs/manage/partitions/edit-data-forwarding-destinations-partition.md +++ b/docs/manage/partitions/edit-data-forwarding-destinations-partition.md @@ -9,11 +9,11 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; You can specify data forwarding settings for a partition so that the messages that were routed to an index can be forwarded to an existing or new Amazon S3 destination. 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Partitions**. You can also click the **Go To...** menu at the top of the screen and select **Partitions**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Manage Data > Logs > Partitions**. -1. To refine the table results, use the **Add a filter** section located above the table. *AND* logic is applied when filtering between different sections, while *OR* logic is applied when filtering within the same section. Click the Partition you want to update. +1. To refine the table results, use the **Add a filter** section located above the table. *AND* logic is applied when filtering between different sections, while *OR* logic is applied when filtering within the same section. Click the partition you want to update. :::note You can see the suggestions only if there are two or more responses for the same column or section. ::: partitions-page 1. The partition details are displayed on the right side of the page.
edit-partition-pane-search-icon 1. Click **Edit** to open the pane for editing.
edit-partition-pane.png -1. You can configure Data Forwarding, or if Data Forwarding is already configured, modify the configuration. For more information, see [Forward Data from Sumo Logic to S3 or GCS](../data-forwarding/forward-data-from-sumologic.md). +1. You can configure data forwarding, or if data forwarding is already configured, modify the configuration. For more information, see [Forward Data from Sumo Logic to S3 or GCS](../data-forwarding/forward-data-from-sumologic.md). diff --git a/docs/manage/partitions/faq.md b/docs/manage/partitions/faq.md index 73fb941b2a..75afd19c62 100644 --- a/docs/manage/partitions/faq.md +++ b/docs/manage/partitions/faq.md @@ -21,7 +21,7 @@ For Flex customers: ## How does Sumo Logic decide on which partitions to scan? 1. For any query, the first step is determining the scope of the query. If your query does not explicitly mention the `index/view` clause in the source expression, Sumo Logic will consider all partitions in the default scope. You can override the scope of the query by mentioning the specific `index/view` in the source expression `(_index=partitionA)` or adding other tier partitions in the scope by using `_dataTier` modifier like `_dataTier=Infrequent or _dataTier=All`. -2. Then apply a **[partition selection process](#what-happens-in-the-partition-selection-process)** as mentioned below that helps with the final list of partitions that will scan. +2. Then apply a [partition selection process](#what-happens-in-the-partition-selection-process) as mentioned below that helps with the final list of partitions that will scan. ## What happens in the partition selection process? diff --git a/docs/manage/partitions/flex/create-edit-partition-flex.md b/docs/manage/partitions/flex/create-edit-partition-flex.md index 65a181a39e..ba6c2facd7 100644 --- a/docs/manage/partitions/flex/create-edit-partition-flex.md +++ b/docs/manage/partitions/flex/create-edit-partition-flex.md @@ -1,7 +1,7 @@ --- id: create-edit-partition-flex title: Create and Edit a Partition -description: Learn how to create and edit a Partition in an Index. +description: Learn how to create and edit a partition in an Index. --- import useBaseUrl from '@docusaurus/useBaseUrl'; @@ -11,15 +11,15 @@ Partitions provide three primary functions: * Enhance searches * Enhance retention options -Partitions ingest your messages in real time, and differ from [Scheduled Views](/docs/manage/scheduled-views), which backfill with aggregate data. Partitions begin building a non-aggregate index from the time the Partition is created and only index data moving forward (from the time of creation). +Partitions ingest your messages in real time, and differ from [Scheduled Views](/docs/manage/scheduled-views), which backfill with aggregate data. Partitions begin building a non-aggregate index from the time the partition is created and only index data moving forward (from the time of creation). See [Partitions](/docs/manage/partitions) for limitations. ## Prerequisites -To create or edit a Partition, you must be an account Administrator or have the [Manage Partitions role capability](/docs/manage/users-roles/roles/role-capabilities). It's important to note that Partitions only affect data generated from the date of their creation onwards; any data predating their establishment is not included. +To create or edit a partition, you must be an account Administrator or have the [Manage Partitions role capability](/docs/manage/users-roles/roles/role-capabilities). It's important to note that partitions only affect data generated from the date of their creation onwards; any data predating their establishment is not included.   -## Create a Partition +## Create a partition :::important The search modifier `dataTier` is not supported for Flex queries. @@ -28,31 +28,31 @@ The search modifier `dataTier` is not supported for Flex queries. 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Partitions**. You can also click the **Go To...** menu at the top of the screen and select **Partitions**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Manage Data > Logs > Partitions**. 1. Click **+ Add Partition**. 1. The **Create New Partition** pane appears.
create-new-partition-flex.png -1. **Name**. Enter a name for the Partition. Partitions must be named alphanumerically, with no special characters, with the exception of underscores (`_`) and hyphens (`-`). However, a Partition name cannot start with `sumologic_`, an underscore `_`, or a hyphen (`-`). +1. **Name**. Enter a name for the partition. Partitions must be named alphanumerically, with no special characters, with the exception of underscores (`_`) and hyphens (`-`). However, a partition name cannot start with `sumologic_`, an underscore `_`, or a hyphen (`-`). 1. (Optional) **Include this partition in default scope**. By default, this checkbox is selected. Deselect this checkbox if you need to exclude this partition from the [default scope in your search](/docs/manage/partitions/flex/faq/#how-can-i-optimize-my-query-using-default-scope). :::note After changing the default scope of a partition, expect a delay of 2 to 3 minutes to reflect the change in the query scope. ::: -1. **Routing Expression**. Enter a [keyword search expression](/docs/search/get-started-with-search/build-search/keyword-search-expressions.md) that matches the data you want to have in the Partition, using [built-in metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) or [custom metadata fields](/docs/manage/fields).  -1. **Retention Period**. Enter the number of days you wish to retain the data in the Partition, or click **Apply the retention period of sumologic_default**. +1. **Routing Expression**. Enter a [keyword search expression](/docs/search/get-started-with-search/build-search/keyword-search-expressions.md) that matches the data you want to have in the partition, using [built-in metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) or [custom metadata fields](/docs/manage/fields).  +1. **Retention Period**. Enter the number of days you wish to retain the data in the partition, or click **Apply the retention period of sumologic_default**. 1. **Compliance data**. Click the **Mark as compliance data** to not change the routing expression and the retention period for partitions. -1. **Data Forwarding**. If you want to forward the data in the Partition to a cloud environment, click **Enable Data Forwarding** and specify the necessary information for the options that appear. For more information, see [Data Forwarding](/docs/manage/data-forwarding). +1. **Data Forwarding**. If you want to forward the data in the partition to a cloud environment, click **Enable Data Forwarding** and specify the necessary information for the options that appear. For more information, see [Data Forwarding](/docs/manage/data-forwarding). ### Enhance search and retention -* To learn how to run a search against a Partition, see [Run a Search Against a Partition](/docs/manage/partitions/run-search-against-partition) and [Optimize Your Search with Partitions](/docs/search/optimize-search-partitions.md). +* To learn how to run a search against a partition, see [Run a Search Against a Partition](/docs/manage/partitions/run-search-against-partition) and [Optimize Your Search with Partitions](/docs/search/optimize-search-partitions.md). * To learn about data retention periods and how to modify them, see [Manage Indexes with Variable Retention](/docs/manage/partitions/manage-indexes-variable-retention). ### Best practices for optimum performance When designing partitions, keep the following in mind: -* **Avoid using queries that are subject to change**. In order to benefit from using Partitions, they should be used for long-term message organization. -* **Make the query as specific as possible**. Making the query specific will reduce the amount of data in the Partition, which increases search performance. +* **Avoid using queries that are subject to change**. In order to benefit from using partitions, they should be used for long-term message organization. +* **Make the query as specific as possible**. Making the query specific will reduce the amount of data in the partition, which increases search performance. * **Keep the query flexible**. Use a flexible query, such as `_sourceCategory=*Apache*`, so that metadata can be adjusted without breaking the query. -* **Group data together that is most often used together**. For example, create Partitions for categories such as web data, security data, or errors. +* **Group data together that is most often used together**. For example, create partitions for categories such as web data, security data, or errors. * **Group data together that is used by teams**. Partitions are an excellent way to organize messages by role and teams within your organization. -* **Avoid including too much data in your partition**. Send between 2% and 20% of your data to a Partition. Including 90% of the data in your index in a Partition won’t improve search performance. -* **Don’t create overlapping partitions**. With multiple Partitions, messages could be duplicated if you create routing expressions that overlap. For example, if you have the following Partitions, messages for `_sourceCategory=prod/Apache` would be duplicated as they would be stored in both Partitions.  +* **Avoid including too much data in your partition**. Send between 2% and 20% of your data to a partition. Including 90% of the data in your index in a partition won’t improve search performance. +* **Don’t create overlapping partitions**. With multiple partitions, messages could be duplicated if you create routing expressions that overlap. For example, if you have the following partitions, messages for `_sourceCategory=prod/Apache` would be duplicated as they would be stored in both partitions.  * Partition1: `_sourceCategory=prod` * Partition2: `_sourceCategory=*/Apache` @@ -76,15 +76,15 @@ You can make some changes to an existing partition:   * You can change the data forwarding configuration. * You cannot change the name of a partition or reuse a partition name. * You cannot edit the audit index partition to include it in the default scope. -* Security partitions can’t be edited. Sumo Logic stores Cloud SIEM Records in seven partitions, one for each [Cloud SIEM Record type](/docs/cse/schema/cse-record-types). The names of the Sumo Logic partitions that contain Cloud SIEM Records begin with the string `sec_record_`. If you have a role that grants you the **View Partitions** capability, you can view the security partitions in the Sumo Logic UI. Note, however, that no user can edit or remove a security partition. +* Security partitions can’t be edited. Sumo Logic stores Cloud SIEM records in seven partitions, one for each [Cloud SIEM record type](/docs/cse/schema/cse-record-types). The names of the Sumo Logic partitions that contain Cloud SIEM records begin with the string `sec_record_`. If you have a role that grants you the **View Partitions** capability, you can view the security partitions in the Sumo Logic UI. Note, however, that no user can edit or remove a security partition. ### How to edit a partition 1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Partitions**. You can also click the **Go To...** menu at the top of the screen and select **Partitions**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu select **Manage Data > Logs > Partitions**. 1. To refine the table results, use the **Add a filter** section located above the table. *AND* logic is applied when filtering between different sections, while *OR* logic is applied when filtering within the same section. - :::note - You can see the suggestions only if there are two or more responses for the same column or section. - ::: + :::note + You can see the suggestions only if there are two or more responses for the same column or section. + ::: 1. Click the row with the partition you want to edit. 1. The partition details are displayed on the right side of the page. 1. Click **Edit** to open the pane for editing.
edit-partition-pane-flex.png diff --git a/docs/manage/partitions/flex/index.md b/docs/manage/partitions/flex/index.md index fbbb5dcc95..f9fc7d1585 100644 --- a/docs/manage/partitions/flex/index.md +++ b/docs/manage/partitions/flex/index.md @@ -7,7 +7,7 @@ description: Learn about Sumo Logic Flex Pricing. import useBaseUrl from '@docusaurus/useBaseUrl'; import Iframe from 'react-iframe'; -Flex Pricing delivers a new financial model for log management in which you can centralize, store, and analyze all application, infrastructure, and security data in one place. This drives collaboration and velocity while delivering a reliable and secure digital experience. Here's how it works: +Flex Pricing delivers a new financial model for log management in which you can centralize, store, and analyze all application, infrastructure, and security data in one place. This drives collaboration and velocity while delivering a reliable and secure digital experience.