Get started with Opsgenie as a user
Learn how to configure your profile, get notifications from Opsgenie and view on-call schedules.
Integrate Opsgenie with Sumo Logic
What does Opsgenie offer Sumo Logic users?
Opsgenie provides a two-way integration with Sumo Logic. When an action happened at Opsgenie alerts, the webhook data will be forwarded to the Sumo Logic. Also, Sumo Logic sends webhook alerts to Opsgenie which acts as a dispatcher for these alerts and determines the right people to notify based on on-call schedules– notifies via email, text messages (SMS), phone calls, and iPhone & Android push notifications, and escalates alerts until the alert is acknowledged or closed.
Functionality of the integration
When an alert is created in Sumo Logic, an alert will be created automatically in Opsgenie.
When an alert action happened in Opsgenie, the webhook payload will be sent to Sumo Logic.
Add Sumo Logic integration in Opsgenie
You can add this integration from your team dashboard
If you're using Opsgenie's Free or Essentials plan, or if you’re using Opsgenie with Jira Service Management's Standard plan, you can only add this integration from your team dashboard as the Integrations page under Settings is not available in your plan.
Adding the integration from your team dashboard will make your team the owner of the integration. This means Opsgenie will assign the alerts received through this integration to your team only.
To do that,
Go to your team’s dashboard from Teams,
Select Integrations, and select Add integration.
Follow the rest of the steps to complete the integration.
Go to Settings > Integrations. Search for Sumo Logic and select Add.
Specify who is notified of Sumo Logic alerts using the Responders field. Auto-complete suggestions are provided as you type.
Copy the URL to use in Sumo Logic.
To forward alert data to Sumo Logic activate Opsgenie to Sumo Logic field and fill the collector URL which is provided from Sumo Logic.
Select Save Integration.
Configuration on Sumo Logic
In Sumo Logic, scheduled searches send alerts to other tools via Webhook connections. To send alerts from Sumo Logic to Opsgenie, create a Webhook first and use it in a scheduled search configuration.
Create Webhook
In Sumo Logic, open Manage Data -> Settings -> Connections.
Click + Add and choose Webhook as connection type.
Populate the name as "Opsgenie" and give an optional description to the connection.
Paste the URL copied previously into the "URL" field.
Populate "Payload" field with the following content:
JSON
1
2
3
4
5
6
7
8
9
10
11
12
{
"searchName": "{{SearchName}}",
"searchDescription": "{{SearchDescription}}",
"searchQuery": "{{SearchQuery}}",
"searchQueryUrl": "{{SearchQueryUrl}}",
"timeRange": "{{TimeRange}}",
"fireTime": "{{FireTime}}",
"rawResultsJson": "{{RawResultsJson}}",
"numRawResults": "{{NumRawResults}}",
"priority" : "P3",
"aggregateResultsJson" : "{{AggregateResultsJson}}"
}
6. Click Save.
Configure Scheduled Search
In the desired search screen to schedule, click Save As under the query currently displayed in the search box.
In the "Save Search As" dialog box, enter a name for the search and an optional description.
Choose an option from the Time Range menu.
Click Schedule this search.
Choose an option from the "Run Frequency" menu.
For Alert Type, choose "Webhook" to upload search results to your connection.
Select "Opsgenie" connection from the Webhook connections list.
Click Save.
Sample payload sent from Sumo Logic
JSON
1
2
3
4
5
6
7
8
9
10
11
12
{
"searchName": "Reporting Hosts",
"searchDescription": "Cem",
"searchQuery": "_sourceCategory=linux/system | parse regex \"\\d+\\s+\\d+:\\d+:\\d+\\s(?<dest_hostname>\\S+)\\s(?<process_name>\\w*)(?:\\[\\d+\\]|):\\s+\" | count_distinct(dest_hostname) as _hostCount",
"searchQueryUrl": "https://service.eu.sumologic.com/ui/index.html#/search/1NJLAwKvQOkwHOyhfkd1wfuI1dXqUFhf0vrf7XnR2XvYWT6LOMeOO4nW1babPnhkAzfnETUgU5dlvJNU8ALz9UIv6SYhR6gvxHVX4UjUaUa8314H8ALCL2gXyoSt0Ivr",
"timeRange": "2019-03-18 13:28:45 EET - 2019-03-18 13:33:45 EET",
"fireTime": "2019-03-18 13:34:17 EET",
"rawResultsJson": "",
"numRawResults": "1",
"priority": "P3",
"aggregateResultsJson": "[{\"Hostcount\":1}]"
}
Sample format for search results dynamic field
From a raw results json sent in Sumo Logic payload, in this format:
JSON
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
[
{
"Category": "logfile",
"Collector": "Tuba-MacBook-Pro.local",
"Host": "Tuba-MacBook-Pro.local",
"Message": "test log message1",
"Name": "request.log",
"Time": 1448545024149
},
{
"Category": "logfile",
"Collector": "Tuba-MacBook-Pro.local",
"Host": "Tuba-MacBook-Pro.local",
"Message": "test log message2",
"Name": "request.log",
"Time": 1448545028149
}
]
The result in this format is generated:
Text
1
2
3
4
5
6
7
8
9
10
11
12
Search Results:
1- Time: 11/26/2015 01:37:04
Message: test log message1
Host: Tuba-MacBook-Pro.local
Name: request.log
Category: logfile
2- Time: 11/26/2015 01:37:08
Message: test log message2
Host: Tuba-MacBook-Pro.local
Name: request.log
Category: logfile
Was this helpful?