Skip to content

Conversation

rjury-sumo
Copy link
Collaborator

This PR adds support for a local windows events source for the installed collector. Like the local file source this is a special case as it can only be applied to existing installed collectors rather than to a hosted collector.

I don't have tests for this (the local file source doesn't either) - but have successfully been able to create or modify sources on a windows instance with installed collector installed using the two example configurations in the mardkdown file.

This was requested by one sumo customer and has an internal JIRA field request https://sumologic.atlassian.net/browse/FIELD-95

Closes #581

local event log source resource

local windows source

local event log docs

remove typo

fix log_names

deny_list is a string not array of strings

deny_list is a string not array of strings

updated example

custom source example
@rjury-sumo rjury-sumo requested review from maimaisie, vsinghal13 and a team as code owners July 14, 2025 00:28
Copy link
Collaborator

@vsinghal13 vsinghal13 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @rjury-sumo for creating the PR. LGTM except one point

Description: "Comma-separated list of event IDs to deny",
}

// "allowlist": is not implmemented yet
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we get the allow_list also added?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've done that, tidied up a few loose ends and fixed the two linting bugs

@vsinghal13 vsinghal13 added the collection Item is related to data collection aspect of Sumo Logic. label Jul 14, 2025
@vsinghal13
Copy link
Collaborator

Also tagging Windows collection SMEs for review @jagan2221 @raunakmandaokar

@rjury-sumo
Copy link
Collaborator Author

rjury-sumo commented Jul 14, 2025

If you do want to test it works fine with this tf if you have an installed collector

terraform {
  required_providers {
    sumologic = {
      source = "sumologic.com/dev/sumologic"
      version = "~> 1.0.0"
    }
  }
}

data "sumologic_collector" "installed_collector" {
  name = "terraform_source_testing"
}

resource "sumologic_local_windows_event_log_source" "local" {
  name             = "windows_logs"
  description      = "windows system and application logs in json format"
  category         = "/os/windows/events"
  collector_id     = "${data.sumologic_collector.installed_collector.id}"
  log_names  = ["System","Application","Microsoft-Windows-PowerShell/Operational", "Microsoft-Windows-TaskScheduler/Operational"]
  deny_list = "9999,7890"
 // allow_list = "1000,2000"
  event_format = 1 // 0 = XML, 1 = JSON
}

@rjury-sumo
Copy link
Collaborator Author

Vijit Singhal asked me to create this as a new PR on the repo so will close this out. Closed in favour of #785

@rjury-sumo rjury-sumo closed this Jul 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
collection Item is related to data collection aspect of Sumo Logic.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

local windows event log source
3 participants