Sumologic

Basic auth: Authorization: Basic base64(accessId:accessKey). Credentials from Sumo Logic Preferences → My Access Keys. HTTPS enforced. Deployment-specific base URL (us1, us2, eu, au, jp, etc. — determined by account region at signup). HTTP Source: unique URL per source (created in Sumo Logic Collection configuration) — no per-request auth for ingestion. Rate limiting: 4 concurrent search jobs per org (standard); increase via support.

Standard HTTP status codes with JSON error bodies. Search job lifecycle: GATHERING_RESULTS → DONE GATHERING RESULTS — poll until DONE. Results pagination: offset + limit for messages/records. CSQL parse errors: 400 with syntax detail. Time range: specify in ISO 8601 format. Sumo Logic uptime at status.sumologic.com. Query timeout: long-running queries may time out — optimize with index hints. Free tier limits: limited log ingest volume per day. HTTP Source: Sumo Logic validates JSON structure — malformed events are discarded silently.

Sumo Logic is a cloud-native alternative to Splunk — fully managed, SaaS-delivered, with strong AWS, GCP, and Azure log collection integrations. CSQL (Continuous SQL) is the query language for log analytics. For agents: the Search API submits CSQL queries and retrieves results, the HTTP Source ingests custom events (simple POST, no agent required), and the Dashboard API queries dashboard data. Free trial available. Strong SIEM capability for security event correlation. Confidence is docs-derived.

REST API at api.{deployment}.sumologic.com/api/v1. HTTP Source ingestion: POST {HTTP Source URL} ({...event object}) — no auth needed for ingestion (URL contains token). Search Jobs API: POST /api/v1/search/jobs ({query: "| where status=500", from, to, timeZone}) creates job. GET /api/v1/search/jobs/{jobId} polls status. GET /api/v1/search/jobs/{jobId}/messages retrieves log results. GET /api/v1/search/jobs/{jobId}/records retrieves aggregated results. Metrics: POST /api/v1/metrics/results runs metric query ({query: [{rowId, query}], startMs, endMs}). Dashboard API: GET /api/v2/dashboards lists dashboards. Monitors (alerts): GET /api/v1/monitors lists monitors; POST /api/v1/monitors creates alert.

help.sumologic.com/docs/api covers Search Jobs API, Metrics API, Dashboard API, Monitor API, and HTTP Source setup documentation. Getting started: create Sumo Logic account (free trial), set up HTTP Source (5 minutes), first log ingest in under 10 minutes. Search Jobs API: requires polling pattern — not a synchronous query/response. Community via Sumo Logic Community (community.sumologic.com) and developer documentation. Good documentation for the cloud-native log analytics use case.