Yes, for years in multiple companies. I greatly prefer it over Splunk or self rolled ELK crap.

If you reformat all your logs to output as json you can "| json auto nodrop" and suddenly you have fantastic statistics off every single field. It's also smart enough to figure out 'close enough' json, like if you're piping log output to syslog which adds it's own metadata.

Their Logreduce feature is also nice for "Ingestion suddenly shot up but eyeballing doesn't show a pattern, help me out here!" Hit the button and get logs grouped by 'these are pretty close except for x."

Amusingly they called me once. I apparently managed to craft a scheduled query that was causing their systems issues. I okayed them adjusting the query to something a little less aggressive.

The only feature that seems wonky is 'real time' (which they limit you on how many you can use). Never was a big issue, I generally would run 'real time' stuff every 15 minutes.

I will be very sad if they die or get bought out by Splunk. It's a great product.

Oh, one other great feature. There's no on-prem option besides the collectors. So someone can't get the bright idea to take it in-house (like with Splunk), wasting the time of a principle engineer for months on a project that doesn't make us any money.

I'll outsource SIEM every time and sleep very well doing it.

My previous employer used it, and I use it nowadays for my side project. I like it, but granted, its the only log ingestion software I've ever used, so cant compare it. The charts I made are nice and I can easily pinpoint errors, bottlenecks and similar in my platform/code.

Here are some views that we're using for our little startup:

https://i.imgur.com/Q1V6ArY.png

https://i.imgur.com/rCfg4nr.png

https://i.imgur.com/GgYHgPA.png

Those metrics are pretty but not much different than what one gets from Prometheus+Grafana

From my experience, Sumo really touts its `logreduce` functionality, which is a process of filtering logs for anomalous messages and bringing interesting things to your attention.

It worked pretty well to be fair, but it got a bit expensive (as things usually do).

I would probably use them again.

Yeah but you get a whole bunch of other stuff. Alerting, flexible outlier detection, aggregations, aggregations + joins (like sql)...

Yes. I am the devops lead at a startup and it's an absolutely essential piece of our devops stack.

It's basically the Lite version of splunk, 90% of the features at 10% of the cost (which matters when we're talking 10s of thousands of dollars per year).

Do you know how much does it cost per month per GB?

I implemented SumoLogic about 5 years ago at another company and it was great. At some point we will need it in our current company (we have ELK, but it is clunky) and it does not compare with what sumo had to offer 5 years ago. But their pricing page has some crap "credit" metric that does not let you compare it.

Their pricing page has price per gb: https://www.sumologic.com/pricing/ Says the "essentials" is 2.50 per gb so if you're pumping 10gb a month it would be like $750 per month.

The listed price for the "Essentials" plan is about $70/Month for each GB of daily ingest. Retention is charged at S3 rates, so $0.023/GB/Month.

> 90% of the features at 10% of the cost

How'd you swing that? We are fairly large Sumologic users, and it's more like 80% of the features at 80% of the cost.

+1

It's a rock solid product, it's extremely reliable but it's not that cheap.

Yeah. I've used Sumo, Kibana, Loggly, paper trail, and GCP's logging stuff. And you know, good ole grep.

If I can't have grep, I'll probably always beg for SumoLogic. It's great, at least compared to what I've used so far.

Have you tried Scalyr? I am an employee at Scalyr and been in the infra space for quite a while. I think our logging product is the best I've used personally. Searches are actually fast.

Speed hasn't really been an issue with any of the providers I've tried except Loggly which has a very slow UI if you run into big messages. Even with ingesting 200gb of logs a day at one job, per environment, Sumo wasn't slow that I recall.

Of course, we didn't try to negotiate, but it looks more expensive than Sumo. At one company we were spending around $600k a year on it, and it looks like you would cost closer to 1m.

Not to be rude, but jumping into comment sections about your competitor's S1 and replying to comments praising them looks pretty bad.

I tried hard not to be sales person and replied to people who were looking for logging product. I understand where you are coming from though!

I've used it for some projects alongside Splunk and ELK/Kibana for others. They're all effective at the scales we've thrown at them, but I find Splunk more intuitive to use, and IMO the query language is better documented.

Full disclosure: Employee at Scalyr

May I suggest you try out Scalyr? Our trials are easy to set up. We are cost effective at large scale ingest, our searches are fast and power queries are super nice!

> May I suggest you try out Scalyr?

No. Please stop.

We're using CloudWatch, Stackdriver and SumoLogic. SumoLogic is by far the best. It still has some room for improvement. But if you're stuck with could providers log aggregators - it's miserable.

At the dayjob we switched from Scalyr to Sumo Logic, primarily to meet requirements imposed by infosec.

I miss Scalyr, but I think that’s mostly because I haven’t learned how to be very effective with Sumo Logic yet.

The feedback I have heard has mostly been great, it is described as costly but worth the money at the same time.

I used it at a previous gig. It's ok. I prefer Splunk, but the cost difference is massive.

I do due diligence for a living. I see it just as much as I see splunk. Anecdotal I know.

we do use it, it's actually pretty neat. I was pretty surprised that no one on HN ever talked about it.

It works, it doesn't have any groundbreaking features. It's boring in a good way, so rarely posted here.