From my experience, Sumo really touts its `logreduce` functionality, which is a process of filtering logs for anomalous messages and bringing interesting things to your attention.

It worked pretty well to be fair, but it got a bit expensive (as things usually do).

I would probably use them again.

Yeah but you get a whole bunch of other stuff. Alerting, flexible outlier detection, aggregations, aggregations + joins (like sql)...