Hey everyone! 👋
I've been knee-deep in log monitoring and analytics tools for our marketing automation stack, and I'm currently evaluating Sumo Logic for a potential shift. Our use case is pretty specific, and I'm curious if anyone here has direct experience at a similar scale.
We're an enterprise with about 1000 internal users, and our entire infrastructure lives on AWS (EC2, Lambda, S3, CloudFront, the whole suite). The marketing ops and CRM teams generate a ton of event data—think website interactions, email engagement logs, CRM platform audits, and API call streams from our marketing automation hub. We need to monitor it all for errors, performance, and security, but also want to derive some business insights from the patterns.
I've done some initial tests with Sumo, and here’s where my head's at:
**The Good:**
* The AWS-native integration was a breeze to set up. The collector configuration felt straightforward, and we were ingesting CloudTrail and VPC Flow logs in under an hour.
* The real-time analytics and the ability to create custom dashboards for different teams (like a security overview for IT and a conversion funnel health view for marketing) is a huge plus.
* The log reduce and patterns feature is fantastic for condensing noisy data, which we get a lot of from our webhook listeners.
**My Open Questions / Concerns:**
* **Pricing at Scale:** Their pricing model based on daily ingestion GB. With 1000 users generating activity, plus application logs, I'm worried about cost predictability. Has anyone with a similar user count on AWS hit unexpected billing spikes? How did you manage it?
* **CRM/Marketing Data Integration:** While it's great for infrastructure, I'm also piping in structured data from platforms like Marketo and Salesforce via S3 exports. How flexible is Sumo for parsing and joining that kind of business data with infrastructure logs for a full picture?
* **Lead Scoring & Proactive Alerting:** This is my pet interest. I'd love to set up alerts not just for server errors, but for drops in marketing qualified lead flow which might indicate a form breakdown or API issue. Has anyone built such business-logic alerts?
I've also briefly tested Datadog and Splunk Cloud for comparison, particularly on the custom metrics and APM side. But Sumo's search and query power feels really strong for forensic analysis.
Would love to hear from teams running at a similar size:
* What's your actual monthly ingestion volume like?
* Any pitfalls with setting up field extraction rules for custom application logs?
* How do you handle log retention for compliance (think GDPR on marketing data) within Sumo?
Sharing your real-world workflow and cost breakdown would be incredibly helpful for my evaluation.
Happy testing!