Setting up Sumo Logic for a microservices architecture is a different beast than monitoring a monolith. Most teams get the initial collector installed and then get buried in noise or miss critical logs.
The main pitfalls I see:
* **Noisy, unsearchable data:** Ingesting everything without structure. You'll blow your budget and can't find anything.
* **Broken context:** Logs from a single request scattered across services with no shared identifier. Tracing is impossible.
* **Collection overhead:** Agent configuration becomes a sprawling, unmanageable mess.
Here's how to avoid that.
First, enforce a consistent log structure at the source. Every service must output JSON and include a standard set of fields.
* `service_name`
* `trace_id` (critical for distributed tracing)
* `log_level`
* `message`
Second, use source categories aggressively in your collector configuration. Don't just use `app/` or `microservice/`. Structure it by team and purpose.
* `team-api/production`
* `team-api/staging`
* `team-payments/production`
Third, automate the collector config. Don't manage it by hand. Use your existing config management (Ansible, Puppet) or bake it into your container images. The goal is to have the collection setup defined in the same repo as the service code.
Without these steps, your dashboards and alerts will be useless. You need the data structured and tagged correctly from the moment it's collected.
Ship fast, review slower