Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
44 commits
Select commit Hold shift + click to select a range
e4233c0
SUMO-254678: Doc update Database apps migration V1 to V2
chetanchoudhary-sumo Jan 29, 2025
6643ff6
Updating monitor part
chetanchoudhary-sumo Jan 29, 2025
a44f0ee
updating fields section
chetanchoudhary-sumo Jan 29, 2025
4d9206f
updating FER section
chetanchoudhary-sumo Jan 29, 2025
a6d64e0
Merge branch 'main' into v1v2migration-db-apps-doc-updates
kimsauce Jan 30, 2025
1e67c7c
Fixing Fields section
chetanchoudhary-sumo Jan 30, 2025
d3f313d
Merge remote-tracking branch 'refs/remotes/origin/v1v2migration-db-ap…
chetanchoudhary-sumo Jan 30, 2025
dde2b09
Addressing review comments from PR #5017
chetanchoudhary-sumo Feb 3, 2025
5e56bf6
Update sql-server.md
amee-sumo Feb 3, 2025
35947f8
Update docs/integrations/amazon-aws/dynamodb.md
chetanchoudhary-sumo Feb 4, 2025
11df94a
Update docs/integrations/amazon-aws/dynamodb.md
chetanchoudhary-sumo Feb 4, 2025
c025cb1
Update docs/integrations/amazon-aws/dynamodb.md
chetanchoudhary-sumo Feb 4, 2025
21f2c0c
Update docs/integrations/databases/cassandra.md
chetanchoudhary-sumo Feb 4, 2025
d2b2779
Update docs/integrations/databases/cassandra.md
chetanchoudhary-sumo Feb 4, 2025
87390a5
Update docs/integrations/databases/cassandra.md
chetanchoudhary-sumo Feb 4, 2025
51d7c7e
Update docs/integrations/databases/couchbase.md
chetanchoudhary-sumo Feb 4, 2025
8332e5e
Update docs/integrations/databases/couchbase.md
chetanchoudhary-sumo Feb 4, 2025
c02a514
Update docs/integrations/databases/couchbase.md
chetanchoudhary-sumo Feb 4, 2025
871dc6d
Update docs/integrations/databases/mariadb.md
chetanchoudhary-sumo Feb 4, 2025
3b6ae78
Update docs/integrations/microsoft-azure/sql-server.md
chetanchoudhary-sumo Feb 4, 2025
6d71bdd
Update docs/observability/application-components.md
chetanchoudhary-sumo Feb 4, 2025
50fb40c
Update docs/integrations/databases/mysql.md
chetanchoudhary-sumo Feb 4, 2025
cf2dcbc
Update docs/integrations/databases/redis.md
chetanchoudhary-sumo Feb 4, 2025
75aeeb8
Update docs/integrations/databases/oracle.md
chetanchoudhary-sumo Feb 4, 2025
b10a1cf
Update docs/integrations/databases/mariadb.md
chetanchoudhary-sumo Feb 4, 2025
a5052b0
Update docs/integrations/databases/mariadb.md
chetanchoudhary-sumo Feb 4, 2025
aec6c18
Update docs/integrations/databases/memcached.md
chetanchoudhary-sumo Feb 4, 2025
593c49f
Update docs/integrations/databases/memcached.md
chetanchoudhary-sumo Feb 4, 2025
6d149e1
Update docs/integrations/databases/memcached.md
chetanchoudhary-sumo Feb 4, 2025
ead4389
Update docs/integrations/databases/mongodb.md
chetanchoudhary-sumo Feb 4, 2025
534d2ac
Update docs/integrations/databases/mongodb.md
chetanchoudhary-sumo Feb 4, 2025
fbccf2a
Update docs/integrations/databases/mongodb.md
chetanchoudhary-sumo Feb 4, 2025
59911bb
Update docs/integrations/databases/mongodb.md
chetanchoudhary-sumo Feb 4, 2025
efc20dd
Apply suggestions from code review
chetanchoudhary-sumo Feb 4, 2025
0cb57e2
Apply suggestions from code review
chetanchoudhary-sumo Feb 4, 2025
80d83ab
Merge branch 'main' into v1v2migration-db-apps-doc-updates
chetanchoudhary-sumo Feb 4, 2025
0062af6
Reverting DynamoDB documentation
chetanchoudhary-sumo Feb 4, 2025
156e6b1
Merge branch 'main' into v1v2migration-db-apps-doc-updates
chetanchoudhary-sumo Apr 30, 2025
4b32c89
Updating Cassandra Doc
chetanchoudhary-sumo Apr 30, 2025
e9b4d39
Updating V2 Migrated Database apps docs to standard pattern
chetanchoudhary-sumo May 1, 2025
379e857
removing commented alert install section
chetanchoudhary-sumo May 2, 2025
1a3fc31
Merge branch 'main' into v1v2migration-db-apps-doc-updates
chetanchoudhary-sumo May 2, 2025
05f02c2
reverting application-components
chetanchoudhary-sumo May 2, 2025
9b94d14
Merge branch 'main' into v1v2migration-db-apps-doc-updates
sumoanema May 2, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/integrations/amazon-aws/dynamodb.md
Original file line number Diff line number Diff line change
Expand Up @@ -222,4 +222,4 @@ Use this dashboard to:

* Identify malicious IPs performing operations on DynamoDB tables using Sumo Logic Threat Intel.

<img src={useBaseUrl('img/integrations/amazon-aws/AWS-DynamoDB-Threat-Intel.png')} alt="Amazon DynamoDB" />
<img src={useBaseUrl('img/integrations/amazon-aws/AWS-DynamoDB-Threat-Intel.png')} alt="Amazon DynamoDB" />
240 changes: 63 additions & 177 deletions docs/integrations/databases/cassandra.md

Large diffs are not rendered by default.

212 changes: 35 additions & 177 deletions docs/integrations/databases/couchbase.md

Large diffs are not rendered by default.

143 changes: 29 additions & 114 deletions docs/integrations/databases/elasticsearch.md
Original file line number Diff line number Diff line change
Expand Up @@ -62,42 +62,8 @@ The Elasticsearch app is a unified logs and metrics app that helps you monitor t

Configuring log and metric collection for the Elasticsearch app includes the following tasks.

### Step 1: Configure Fields in Sumo Logic

Create the following Fields in Sumo Logic before configuring the collection. This ensures that your logs and metrics are tagged with relevant metadata required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields).

<Tabs
groupId="k8s-nonk8s"
defaultValue="k8s"
values={[
{label: 'Kubernetes environments', value: 'k8s'},
{label: 'Non-Kubernetes environments', value: 'non-k8s'},
]}>

<TabItem value="k8s">

If you're using Elasticsearch in a Kubernetes environment, create the fields:

* `pod_labels_component`
* `pod_labels_environment`
* `pod_labels_db_system`
* `pod_labels_db_cluster`

</TabItem>
<TabItem value="non-k8s">

If you're using Elasticsearch in a non-Kubernetes environment, create the fields:

* `component`
* `environment`
* `db_system`
* `db_cluster`
* `pod`

</TabItem>
</Tabs>

### Step 2: Configure Collection for Elasticsearch
### Configure Collection for Elasticsearch

<Tabs
groupId="k8s-nonk8s"
Expand Down Expand Up @@ -368,92 +334,37 @@ At this point, Elasticsearch logs should start flowing into Sumo Logic.
</TabItem>
</Tabs>

## Installing Elasticsearch Monitors

Sumo Logic has provided pre-packaged alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you proactively determine if an Elasticsearch cluster is available and performing as expected. These monitors are based on metric and log data and include pre-set thresholds that reflect industry best practices and recommendations. For more information about individual alerts, see [Elasticsearch Alerts](#elasticsearch-alerts).

To install these monitors, you must have the **Manage Monitors** role capability. You can install monitors by importing a JSON file or using a Terraform script. There are limits to how many alerts can be enabled. For more information, see [Monitors](/docs/alerts/monitors/create-monitor) for details.

### Method 1: Importing a JSON file

1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Elasticsearch/Elasticsearch.json) that describes the monitors.
2. The [JSON](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Elasticsearch/Elasticsearch.json) contains the alerts that are based on Sumo Logic searches that do not have any scope filters, and therefore will be applicable to all Elasticsearch clusters, the data for which has been collected via the instructions in the previous sections. However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_cluster=*` with `<Your Custom Filter>`. Custom filter examples:
* For alerts applicable only to a specific cluster, your custom filter would be: `db_cluster=dev-elasticsearch-01`
* For alerts applicable to all clusters that start with `elasticsearch-prod`, your custom filter would be: `db_cluster=elasticsearch-prod*`
* For alerts applicable to a specific clusters, within a production environment, your custom filter would be: `db_cluster=dev-elasticsearch-01` AND `environment=prod`. This assumes you have set the optional environment tag while configuring collection.
3. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Monitoring > Monitors**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select **Alerts > Monitors**. You can also click the **Go To...** menu at the top of the screen and select **Monitors**.
4. Click **Add**.
5. Click **Import**.
6. On the **Import Content popup**, enter **Elasticsearch** in the Name field, paste in the JSON into the popup, and click **Import**.
7. The monitors are created in a **Elasticsearch** folder. The monitors are disabled by default. See the [Monitors](/docs/alerts/monitors) topic for information about enabling monitors and configuring notifications or connections.

### Method 2: Using a Terraform script
## Installing the Elasticsearch app

1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys).
2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it.
3. Download the Sumo Logic Terraform package for Elasticsearch monitors. The alerts package is available in the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Elasticsearch). You can either download it using the git clone command or as a zip file.
4. Alert Configuration. After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Elasticsearch/` directory.
* Edit the `Elasticsearch.auto.tfvars` file and add the Sumo Logic Access Key and Access ID from Step 1 and your Sumo Logic deployment. If you're not sure of your deployment, see [Sumo Logic Endpoints and Firewall Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security).
```bash
access_id = "<SUMOLOGIC ACCESS ID>"
access_key = "<SUMOLOGIC ACCESS KEY>"
environment = "<SUMOLOGIC DEPLOYMENT>"
```
* The Terraform script installs the alerts without any scope filters. If you would like to restrict the alerts to specific clusters or environments, update the `elasticsearch_data_source` variable. For example:
* To configure alerts for a specific cluster, set `elasticsearch_data_source` to something like `db_cluster=elasticsearch.prod.01`
* To configure alerts for all clusters in an environment, set `elasticsearch_data_source` to something like `environment=prod`
* To configure alerts for multiple clusters using a wildcard, set `elasticsearch_data_source` to something like `db_cluster=elasticsearch-prod*`
* To configure alerts for a specific clusters within a specific environment, set `elasticsearch_data_source` to something like `db_cluster=elasticsearch-1` and `environment=prod`. This assumes you have configured and applied Fields as described in [Configure Sumo Logic Fields](#step-1-configure-fields-in-sumo-logic).

All monitors are disabled by default on installation. To enable all of the monitors, set the `monitors_disabled` parameter to `false`. By default, the monitors will be located in a "Elasticsearch" folder on the **Monitors** page. To change the name of the folder, update the monitor folder name in the folder variable in the `Elasticsearch.auto.tfvars` file.
5. If you want your alerts to send email or connection notifications, edit the `Elasticsearch_notifications.auto.tfvars` file to populate the `connection_notifications` and `email_notifications` sections. Examples are provided below. In the variable definition below, replace `<CONNECTION_ID>` with the connection ID of the Webhook connection. You can obtain the Webhook connection ID by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections).
```bash title="Pagerduty connection example"
connection_notifications = [
{
connection_type = "PagerDuty",
connection_id = "<CONNECTION_ID>",
payload_override = "{\"service_key\": \"your_pagerduty_api_integration_key\",\"event_type\": \"trigger\",\"description\": \"Alert: Triggered {{TriggerType}} for Monitor {{Name}}\",\"client\": \"Sumo Logic\",\"client_url\": \"{{QueryUrl}}\"}",
run_for_trigger_types = ["Critical", "ResolvedCritical"]
},
{
connection_type = "Webhook",
connection_id = "<CONNECTION_ID>",
payload_override = "",
run_for_trigger_types = ["Critical", "ResolvedCritical"]
}
]
```
import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md';

For information about overriding the payload for different connection types, see [Set Up Webhook Connections](/docs/alerts/webhook-connections/set-up-webhook-connections).

```bash title="Email notifications example"
email_notifications = [
{
connection_type = "Email",
recipients = ["abc@example.com"],
subject = "Monitor Alert: {{TriggerType}} on {{Name}}",
time_zone = "PST",
message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}",
run_for_trigger_types = ["Critical", "ResolvedCritical"]
}
]
```
6. Installation.
1. Navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Elasticsearch/` directory and run terraform init. This will initialize Terraform and download the required components.
2. Run `terraform plan` to view the monitors that Terraform will create or modify.
3. Run `terraform apply`.
<AppInstall2 />

## Installing the Elasticsearch app
As part of the app installation process, the following fields will be created by default:
* `component`
* `environment`
* `db_system`
* `db_cluster`
* `pod`
* `db_cluster_address`
* `db_cluster_port`

import AppInstall from '../../reuse/apps/app-install.md';
Additionally, if you're using Elasticsearch in the Kubernetes environment, the following additional fields will be created by default during the app installation process:
* `pod_labels_component`
* `pod_labels_environment`
* `pod_labels_db_system`
* `pod_labels_db_cluster`
* `pod_labels_db_cluster_address`
* `pod_labels_db_cluster_port`

<AppInstall/>
For information on setting up fields, see [Fields](/docs/manage/fields).

## Viewing Elasticsearch dashboards

:::tip Filter with template variables
Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md).
:::
import ViewDashboards from '../../reuse/apps/view-dashboards.md';

<ViewDashboards/>

### Overview

Expand Down Expand Up @@ -533,9 +444,13 @@ The **ElasticSearch - Queries** dashboard shows Elasticsearch provides analytics

<img src={useBaseUrl('img/integrations/databases/elasticsearch-q.png')} alt="elasticsearch dashboards" />

## Elasticsearch Alerts
## Create monitors for Elasticsearch app

import CreateMonitors from '../../reuse/apps/create-monitors.md';

<CreateMonitors/>

Sumo Logic has provided out-of-the-box alerts available via[ Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the Elasticsearch database cluster is available and performing as expected.
### Elasticsearch Alerts

| Alert Type (Metrics/Logs) | Alert Name | Alert Description | Trigger Type (Critical / Warning) | Alert Condition | Recover Condition |
|---|---|---|---|---|---|
Expand Down
Loading