Sumo Logic Monitoring and Analytics Platform

What do you like best about the product?

Cloud-native, no infrastructure to manage: There are no servers to maintain, and it scales with log volume.
Powerful search and query language: You can parse, filter, and aggregate logs quickly, and saved searches and dashboards make recurring analysis easy.
Unified logs, metrics, and traces: One platform covers observability and security monitoring.
Built-in security analytics: Its cloud SIEM features and pre-built apps for AWS, Kubernetes, and others speed up setup.
Real-time alerting: Alerts and dashboards help teams catch issues early and cut troubleshooting time.
Integrations: It connects with most major cloud services and DevOps tools.

What do you dislike about the product?

Cost: Pricing can climb quickly as log volume grows, and many users find it hard to predict or control spend.
Learning curve: The query language is powerful but takes time to learn, especially for complex parsing and aggregation.
Performance on large searches: Queries over big time ranges or huge data sets can be slow.
Dashboard and UI limitations: Some users find customization less flexible than competitors, and the interface can feel cluttered as features expand.
Alert tuning: Setting up alerts that are accurate without being noisy takes effort.
Support and documentation: Experiences vary, and some users say complex issues take a while to resolve.
Feature sprawl: Because the platform covers logs, metrics, traces, and SIEM, some capabilities feel less mature than specialized tools.

What problems is the product solving and how is that benefiting you?

Scattered logs: Applications, servers, and cloud services each produce their own logs. Sumo Logic centralizes them in one searchable place.
Slow troubleshooting: Instead of logging into individual systems, teams can search across everything at once to find the root cause of an outage or error.
Security visibility: It helps detect threats and suspicious activity by correlating events across systems, and it supports compliance reporting.
Monitoring blind spots: Dashboards and alerts surface performance problems before users notice them.
Scaling overhead: Being cloud-hosted, teams don't have to run or scale their own logging infrastructure.

What do you like best about the product?

I really appreciate how fast the search is across a lot of data, and the saved searches are a huge benefit because I often reuse the same queries instead of rebuilding them. Writing and tuning detection rules is pretty straightforward, which makes things easier for us. The support from Sumo Logic has been great since we started using them. The dashboards are very helpful as I can build a specific view around a detection or system and share it with other teams, saving time on having to teach the query language. This setup facilitates better collaboration, as security and operations can look at the same information during an investigation and get to a resolution faster. The initial setup of Sumo Logic was pretty easy, especially with the help we got from their team. It's been overall a great tool, and I consider Sumo Logic our main source of truth.

What do you dislike about the product?

My one gripe is cost. The pricing is tied to how much you ingest so the bill scales with log volume. We've had to make some tough calls about what to send based on budget based on what we actually want visibility into.

What problems is the product solving and how is that benefiting you?

Sumo Logic allows us to investigate security alerts from one spot, making it easy to write detection rules and search across logs quickly. It reduces the need for switching between tools and facilitates sharing views with other teams, enhancing investigation speed.

What do you like best about the product?

I like the customer service Sumo Logic offers through our representative, Greg Jerry, who is always ready to help with any issues and is proactive in providing tailored solutions. The reliability of the data logging is also impressive, ensuring we get accurate and deep data queries. Additionally, I find the interface to be user-friendly and easy to navigate, which doesn't require much extra exposure to get used to. It's simple and straightforward to use, making it a convenient tool for our needs. I also appreciate the new mobile features, which aid in investigations and correlating previously triggered signals. Integrating Sumo Logic with our single sign-on system was pretty straightforward, aided by Okta, and it enhances our capability to run logic seamlessly.

What do you dislike about the product?

Sometimes the time it takes for a query to execute can be slow, especially when dealing with large queries. However, this may not be entirely a Sumo Logic issue and could relate to how old the data is or how it's stored. It's understandable that larger queries take longer, but it's still something that occasionally impacts my experience.

What problems is the product solving and how is that benefiting you?

Sumo Logic helps us investigate security alerts by screening log systems for insights and details, supporting our security incident investigations effectively.

What do you like best about the product?

I use Sumo Logic to look at all the logs of our services and to dive into the response times and health of our systems. I appreciate being able to see the performance of our services at any time, helping to manage system uptime and errors. It's also very helpful when a customer has an issue because I can search logs to understand exactly what they have done. I really like the new AI connectors that assist in writing new queries, as they help me explore deeper without needing extensive knowledge of all the Sumo Logic query standards. I spend most of my time using the search, SLOs, and dashboards within Sumo Logic. The initial setup was very easy with lots of assistance and good training provided.

What do you dislike about the product?

I think my dislike in the past has been about the fact that we can only store xx number of months data due to price. Also early day internal AI wasn't as evolved as I thought it might be. This has got better over time.

What problems is the product solving and how is that benefiting you?

I use Sumo Logic to monitor our services' logs, response times, and health. It ensures uptime, helps manage errors, and allows me to track customer issues effectively.

What do you like best about the product?

I really appreciate how Sumo Logic correlates incidents from different platforms into insightful signals, giving analysts a comprehensive view for incident investigation, especially on the SIEM side. Its strongest feature for me is the integration, particularly with the MCP server and the SOC analyst agent, which embeds smoothly into our workflow to provide new insights and correlated activities. I also like the detection engineering and rule set fine-tuning capabilities with MCP integration. The cloud-first model makes setup easy, with minimal maintenance since there's nothing on-premise. The fact that everything ultimately got delivered, like custom parsers, is definitely a plus.

What do you dislike about the product?

I think the biggest area where Sumo Logic could improve is its out-of-the-box rules and SIEM capabilities. They seem to need a significant update to keep up with the current landscape, especially with the rise of AI. The rule sets are still quite basic, and it would be great if there was a way for AI to analyze our large datasets to find attack patterns and create customized rules tailored to our needs. Additionally, the recent UI changes from a non-tab to a tab version, with tabs inside tabs, is quite messy. I would prefer if Sumo Logic stuck to a consistent design rather than trying to cater to everyone.

What problems is the product solving and how is that benefiting you?

Sumo Logic correlates incidents, providing comprehensive insights for incident investigation. Its integration enhances workflow and enables detection engineering, while the cloud-first model eases maintenance and setup.