Sumo Logic with Logging operator and syslog-ng
This guide helps you install and configure the Logging operator and syslog-ng to forward logs to your Sumo Logic account.
Prerequisites
We assume that you already have:
-
A Sumo Logic account.
-
A HTTP Hosted Collector configured in the Sumo Logic service.
To configure a Hosted Collector, complete the steps in the Configure a Hosted Collector section on the official Sumo Logic website.
-
The unique HTTP collector code you receive while configuring your Host Collector for HTTP requests.
Deploy the Logging operator and a demo Application
Install the Logging operator and a demo application to provide sample log messages.
Deploy the Logging operator with Helm
To install the Logging operator using Helm, complete the following steps.
Note: You need Helm v3.8 or later to be able to install the chart from an OCI registry.
-
Install the Logging operator into the logging namespace:
Expected output:
Note:
-
Helm has a known issue in version 3.13.0 that requires users to log in to the registry, even though the repo is public.
Upgrade to 3.13.1 or higher to avoid having to log in, see: https://github.com/kube-logging/logging-operator/issues/1522
-
If you’re installing the Helm chart from Terraform, reference the repository as
repository = "oci://ghcr.io/kube-logging/helm-charts/"
(without thelogging-operator
suffix). Otherwise, you’ll get a 403 Forbidden error.
-
Configure the Logging operator
-
Create the
logging
resource with a persistent syslog-ng installation.Note: You can use the
ClusterOutput
andClusterFlow
resources only in thecontrolNamespace
. -
Create a Sumo Logic output secret from the URL of your Sumo Logic collection.
-
Create a
SyslogNGOutput
resource. -
Create a
SyslogNGFlow
resource. -
Install log-generator to produce logs with the label
app.kubernetes.io/name: log-generator
If you don’t get the expected result you can find help in the troubleshooting section.