Closed jodem closed 8 years ago
Hi @jodem, thank you for using Sumo Logic. If I understand correctly, you have 2 collectors with the same name on purpose and you want the logs from 2 slaves to go under the same collector? We actually do not allow collectors running on different hosts to have the same name, which is probably not enforced in our containerized collector currently.
However, what you can do here is to use another common field to run searches instead of using _collector
or _collectorName
. One way is to set the _sourceCategory
field of both collectors to be the same. Please check our documentation on this field: https://help.sumologic.com/Send_Data/01_Design_Your_Deployment/Best_Practices%3A_Good_Source_Category%2C_Bad_Source_Category
For future questions please utilize the Sumo Logic Support site as you will get more prompt answers from our support engineers: https://support.sumologic.com/ You can submit a support ticket by clicking on Submit a request on the top right corner of the page.
Hi @maimaisie, you understood well, I have been using _sourceCategory for 10 days and it works correctly. I'll add a random string on my bootstrap script to have different collector name.
Hello,
I use sumologic to monitor a wide marathon/mesos cluster.
On each slave I panned to install you collector container for syslog. Then on each container started by marathon I use syslog driver as explained in you example.
I tag in my docker container the output of each line using options like :
--log-opt tag="[config=another-poc-1]/[image={{.ImageName}}]"
What I need now is to make sure each one of my marathon slave will report on the SAME collector name.
I started the collector on 2 slaves with the following params :
docker run -d -p 514:514 -p 514:514/udp --name="sumo-logic-collector" -e SUMO_COLLECTOR_NAME="CloudV2/Dev/Containers" -e SUMO_COLLECTOR_NAME_PREFIX="X3" sumologic/collector:latest-syslog
Problem is on sumologic view I see 2 collector with the same name.
I need only one to filter all logs from marathon containers in an reliable way.
Any idea ?