Hey folks! 👋 Just spent the last two days getting Sumo Logic set up to monitor a new K8s cluster on AWS EKS. Wanted to share my step-by-step process and a few "gotchas" I ran into—saving you some headaches.
My main goal was to get a clear view of cluster health, pod logs, and performance metrics without drowning in manual config. Here's the high-level flow I landed on:
**1. Infrastructure Setup (AWS Side)**
* Created an IAM role with permissions for Sumo to read logs from CloudWatch and metrics from CloudWatch & Prometheus.
* Made sure my EKS cluster had the CloudWatch observability add-on enabled (this saves so much time).
* Set up an S3 bucket for Sumo's K8s Helm chart values.
**2. Sumo Logic Collector & Sources**
* In Sumo, installed the Kubernetes Helm chart with the `values.yaml` configured for my region and cluster name.
* Critical step: Double-check your endpoint URLs for the Sumo API. The docs are good, but one wrong region code will break it.
* Created an HTTP Logs and Metrics Source to receive the data piped from CloudWatch via a Lambda forwarder.
**3. App Configuration & Dashboards**
* Used Sumo's out-of-the-box Kubernetes App for the main dashboard. It's pretty comprehensive right off the bat.
* Added custom queries to track specific app errors and ingress latency. The query language is powerful but has a learning curve.
**Key Takeaways:**
* The integration is solid once running, but the initial IAM and cross-account setup is where most friction lies.
* Cost watch: Be aggressive with your log filters upfront. Ingesting all container stdout without filters gets expensive fast.
* Compared to setting up a similar view in Grafana/Prometheus directly, Sumo got me to actionable dashboards quicker, but with less granular control over some visualizations.
Has anyone else gone through this recently? I'm especially curious about how you're handling cost optimization for log volume and if you've built any cool custom alerts for node scaling events.
— alex
Data > opinions