Integration

Sumo Logic integration

Sumo Logic is a cloud log and metrics analytics platform. Run log searches as search jobs (create, poll the status, page through messages and aggregate records) and metrics queries; manage saved log and metrics searches, monitors (alerts), SLOs, muting schedules, dashboards and their report schedules, the content library (folders, export, copy, move, delete), users and roles, lookup tables, custom fields, scheduled views, partitions, installed apps and health events, and read account status and usage forecasts. Left out: access keys, OAuth clients, service accounts, SAML and SCIM, security policies, connections (webhook destinations carry auth headers), data forwarding, archiving and deletion rules, ingest budgets, source templates, tracing and span analytics, parsers, and CSV uploads to lookup tables. Authentication is HTTP Basic with a Sumo Logic access ID as the username and its access key as the password; api_host is your deployment's API host: api.sumologic.com (US1), api.us2.sumologic.com, api.au.sumologic.com, api.ca.sumologic.com, api.ch.sumologic.com, api.de.sumologic.com, api.eu.sumologic.com, api.esc.sumologic.com (AWS European Sovereign Cloud), api.fed.sumologic.com, api.jp.sumologic.com or api.kr.sumologic.com. Rate limit: 4 requests per second per user and 10 concurrent requests per access key.

Connect Sumo Logic How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Sumo Logic.Built from the 134 Sumo Logic tools below, on the connection you add once.

What you can do with Sumo Logic

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Status, 10 operations

get_account_statusGet account statusGETGet information related to the account's plan, pricing model, expiration and payment status.
get_app_install_statusGet app install statusGETGet the status of an asynchronous app install request for the given job identifier.
get_app_uninstall_statusGet app uninstall statusGETGet the status of an asynchronous app uninstall request for the given job identifier.
get_app_upgrade_statusGet app upgrade statusGETGet the status of an asynchronous app upgrade request for the given job identifier.
get_content_copy_statusGet content copy statusGETGet the status of the copy request with the given job identifier.
get_content_delete_statusGet content delete statusGETGet the status of an asynchronous content deletion job request for the given job identifier.
get_content_export_statusGet content export statusGETGet the status of a content export job (start_content_export). Once status is Success, read the exported definition with get_content_export_result.
get_content_import_statusGet content import statusGETGet the status of a content import job for the given job identifier.
get_dashboard_report_job_statusGet dashboard report job statusGETGet the status of a dashboard report job (generate_dashboard_report). Once status is Success, download the file with get_dashboard_report_result.
get_lookup_table_job_statusGet lookup table job statusGETRetrieve the status of a previously made request. If the request was successful, the status of the response object will be `Success`.

User, 6 operations

assign_role_to_userAssign role to userPUTAssign a role to a user in the organization.
create_userCreate userPOSTCreate a user in the organization with the given roles (role ids from list_roles); Sumo Logic sends the new user a welcome email.
delete_userDelete userDELETEDelete a user with the given identifier from the organization and transfer their content to the user with the identifier specified in "transferTo".
get_userGet userGETGet a user with the given identifier from the organization.
list_usersList usersGETGet a list of all users in the organization. The response is paginated with a default limit of 100 users per page.
remove_role_from_userRemove role from userDELETERemove a role from a user in the organization.

Dashboard, 5 operations

create_dashboardCreate dashboardPOSTCreates a new dashboard.
delete_dashboardDelete dashboardDELETEDelete a dashboard by the given identifier.
get_dashboardGet dashboardGETGet a dashboard by the given identifier.
list_dashboardsList dashboardsGETList all dashboards under the Personal folder created by the user or under folders viewable by user.
update_dashboardUpdate dashboardPUTUpdate a dashboard by the given identifier.

Path, 5 operations

get_content_by_pathGet content by pathGETGet a content item corresponding to the given path. _Path is specified in the required query parameter `path`.
get_content_pathGet content pathGETGet full path of a content item with the given identifier.
get_monitor_by_pathGet monitor by pathGETRead a monitor or folder by its path in the monitors library structure.
get_monitor_pathGet monitor pathGETGet the full path of the monitor or folder in the monitors library.
get_slo_pathGet slo pathGETGet the full path of the slo or folder in the slos library.

Field, 4 operations

create_custom_fieldCreate custom fieldPOSTAdding a field will define it in the Fields schema allowing it to be assigned as metadata to your logs.
delete_custom_fieldDelete custom fieldDELETEDeleting a field does not delete historical data assigned with that field.
get_custom_fieldGet custom fieldGETGet the details of a custom field.
list_custom_fieldsList custom fieldsGETRequest a list of all the custom fields configured in your account.

Log search, 4 operations

create_log_searchCreate log searchPOSTSave the log search in the content library.
delete_log_searchDelete log searchDELETEDelete the saved log search from the content library.
get_log_searchGet log searchGETGet a saved log search from the content library by identifier.
list_log_searchesList log searchesGETList all saved log searches viewable by the user.

Metrics search, 4 operations

create_metrics_search_pageCreate metrics search pagePOSTCreates a new metrics search page.
delete_metrics_search_pageDelete metrics search pageDELETEDelete metrics search page by the given identifier.
get_metrics_search_pageGet metrics search pageGETGet a metrics search page by the given identifier.
list_metrics_search_pagesList metrics search pagesGETList all metrics search pages under the Personal folder created by the user or under folders viewable by user.

Monitor, 4 operations

create_monitorCreate monitorPOSTCreate a monitor (type MonitorsLibraryMonitor, with monitorType, queries and triggers) or a folder (type MonitorsLibraryFolder) in a monitors folder. A monitor with notifications alerts its recipients as soon as a trigger fires.
delete_monitorDelete monitorDELETEDelete a monitor or folder from the monitors library.
get_monitorGet monitorGETGet a monitor or folder from the monitors library.
get_monitors_by_idsGet monitors by idsGETBulk read a monitor or folder by the given identifiers from the monitors library.

Muting schedule, 4 operations

create_muting_scheduleCreate muting schedulePOSTCreate a muting schedule (type MutingSchedulesLibraryMutingSchedule, with schedule and monitor scope) that silences monitor notifications, or a folder. It takes effect at its start date.
delete_muting_scheduleDelete muting scheduleDELETEDelete a mutingschedule or folder from the mutingSchedules library.
get_muting_scheduleGet muting scheduleGETGet a mutingschedule or folder from the mutingSchedules library.
get_muting_schedules_by_idsGet muting schedules by idsGETBulk read a mutingschedule or folder by the given identifiers from the mutingSchedules library.

Report schedule, 4 operations

create_report_scheduleCreate report schedulePOSTSchedule a dashboard report that Sumo Logic emails to the recipients of emailNotification on the chosen schedule, while isActive is true (the default).
delete_report_scheduleDelete report scheduleDELETEDelete the schedule of a scheduled dashboard report by the given identifier. The scheduled dashboard report will no longer be generated and sent.
get_report_scheduleGet report scheduleGETGet the schedule of a scheduled dashboard report by the given identifier.
list_report_schedulesList report schedulesGETList all dashboard report schedules created by the user.

Role, 4 operations

create_roleCreate rolePOSTCreate a new role in the organization.
delete_roleDelete roleDELETEDelete a role with the given identifier from the organization.
get_roleGet roleGETGet a role with the given identifier in the organization.
list_rolesList rolesGETGet a list of all the roles in the organization. The response is paginated with a default limit of 100 roles per page.

Slo, 4 operations

create_sloCreate sloPOSTCreate an SLO (type SlosLibrarySlo, with signalType, compliance and indicator) or a folder (type SlosLibraryFolder) in an SLOs folder.
delete_sloDelete sloDELETEDelete a slo or folder from the slos library.
get_sloGet sloGETGet a slo or folder from the slos library.
get_slos_by_idsGet slos by idsGETBulk read a slo or folder by the given identifiers from the slos library.

Disable, 3 operations

disable_custom_fieldDisable custom fieldDELETEAfter disabling a field Sumo Logic will start dropping its incoming values at ingest. As a result, they won't be searchable or usable.
disable_monitorsDisable monitorsPUTDisable the given monitors: they stop running and sending notifications until updated with isDisabled false.
disable_scheduled_viewDisable scheduled viewDELETEDisable a scheduled view with the given identifier.

Job, 3 operations

create_search_jobCreate search jobPOSTStart a log search; returns the job id. Then call get_search_job_status every 20 to 30 s (an idle job is cancelled) until DONE GATHERING RESULTS, and read results with get_search_job_messages or get_search_job_records.
delete_search_jobDelete search jobDELETEDelete a search job once its results are read, so it no longer counts toward the organization's limit of 200 active search jobs.
get_search_job_statusGet search job statusGETGet a search job's state and its messageCount and recordCount. Poll every 20 to 30 s until state is DONE GATHERING RESULTS (or CANCELLED, FORCE PAUSED); results can be read earlier.

Lookup table, 3 operations

create_lookup_tableCreate lookup tablePOSTCreate a lookup table from a schema (fields, primaryKeys) in a library folder: parentFolderId is required (get a folder id with get_content_by_path or get_personal_folder).
delete_lookup_tableDelete lookup tableDELETEDelete a lookup table completely. Warning: `This operation cannot be undone`.
get_lookup_tableGet lookup tableGETGet a lookup table for the given identifier.

Partition, 3 operations

create_partitionCreate partitionPOSTCreate a new partition.
get_partitionGet partitionGETGet a partition with the given identifier from the organization.
list_partitionsList partitionsGETGet a list of all partitions in the organization. The response is paginated with a default limit of 100 partitions per page.

Quota, 3 operations

get_field_quotaGet field quotaGETEvery account has a limited number of fields available. This endpoint returns your account limitations and remaining quota.
get_partitions_quotaGet partitions quotaGETEvery customer can use a limited number of partitions. This endpoint allows learning about these limitations and remaining quota.
get_scheduled_views_quotaGet scheduled views quotaGETEvery customer can use a limited number of scheduled views. This endpoint allows learning about these limitations and remaining quota.

Root, 3 operations

get_monitors_root_folderGet monitors root folderGETGet the root folder in the monitors library.
get_muting_schedules_root_folderGet muting schedules root folderGETGet the root folder in the mutingSchedules library.
get_slos_root_folderGet slos root folderGETGet the root folder in the slos library.

Scheduled view, 3 operations

create_scheduled_viewCreate scheduled viewPOSTCreates a new scheduled view in the organization.
get_scheduled_viewGet scheduled viewGETGet a scheduled view with the given identifier.
list_scheduled_viewsList scheduled viewsGETGet a list of all scheduled views in the organization. The response is paginated with a default limit of 100 scheduled views per page.

Search, 3 operations

search_monitorsSearch monitorsGETSearch for a monitor or folder in the monitors library structure.
search_muting_schedulesSearch muting schedulesGETSearch for a mutingschedule or folder in the mutingSchedules library structure.
search_slosSearch slosGETSearch for a slo or folder in the slos library structure.

Builtin, 2 operations

get_built_in_fieldGet built in fieldGETGet the details of a built-in field.
list_built_in_fieldsList built in fieldsGETBuilt-in fields are created automatically by Sumo Logic for standard configuration purposes. They include `_sourceHost` and `_sourceCategory`.

Copy, 2 operations

copy_monitorCopy monitorPOSTCopy a monitor or folder in the monitors library.
start_content_copyStart content copyPOSTStart an asynchronous content copy job with the given identifier to the destination folder. If the content item is a folder, everything under the folder is copied recursively.

Export, 2 operations

export_monitorExport monitorGETExport a monitor or folder. If the given identifier is a folder, everything under the folder is exported recursively with folder as the root.
start_content_exportStart content exportPOSTSchedule an _asynchronous_ export of content with the given identifier. You will get back an asynchronous job identifier on success.

Folder, 2 operations

create_folderCreate folderPOSTCreates a new folder under the given parent folder. Set the header parameter `isAdminMode` to `"true"` to create a folder inside "Admin Recommended" folder.
get_folderGet folderGETGet a folder with the given identifier. Set the header parameter `isAdminMode` to `"true"` if fetching a folder inside "Admin Recommended" folder.

Move, 2 operations

move_contentMove contentPOSTMoves an item from its current location to another folder.
move_monitorMove monitorPOSTMove a monitor or folder to a different location in the monitors library.

Result, 2 operations

get_content_export_resultGet content export resultGETGet the JSON definition of an exported content item once get_content_export_status reports Success; it can be imported again with start_content_import.
get_dashboard_report_resultGet dashboard report resultGETDownload the PDF or PNG file of a finished dashboard report job (generate_dashboard_report), once get_dashboard_report_job_status reports Success.

Usage info, 2 operations

get_monitor_usage_infoGet monitor usage infoGETGet the current number and the allowed number of log and metrics monitors.
get_slo_usage_infoGet slo usage infoGETGet the current number and the allowed number of log and metrics SLOs.

App, 1 operation

list_appsList appsGETList all apps from the App Catalog.

Cancel retention update, 1 operation

cancel_retention_updateCancel retention updatePOSTCancel update to retention of a partition for which retention was updated previously using `reduceRetentionPeriodImmediately` parameter as false

Decommission, 1 operation

decommission_partitionDecommission partitionPOSTDecommission a partition with the given identifier from the organization.

Delete, 1 operation

start_content_deleteStart content deleteDELETEStart an asynchronous content deletion job with the given identifier.

Delete table row, 1 operation

delete_lookup_table_rowDelete lookup table rowPUTDelete a row from lookup table by providing the row's primary keys' values. The complete set of primary key fields of the lookup table should be provided.

Detail, 1 operation

get_app_detailsGet app detailsGETGet details about an app with the given UUID and version. The details include: 1. The base URL for all the resource for the app. 2. The app manifest

Dropped, 1 operation

list_dropped_fieldsList dropped fieldsGETDropped fields are fields sent to Sumo Logic, but are ignored since they are not defined in your Fields schema.

Enable, 1 operation

enable_custom_fieldEnable custom fieldPUTFields have to be enabled to be assigned to your data. This operation ensures that a specified field is enabled and Sumo Logic will treat it as safe to process.

Health event, 1 operation

list_health_eventsList health eventsGETGet a list of all the unresolved health events in your account.

Import, 1 operation

start_content_importStart content importPOSTImport a content item (folder, search, dashboard, lookup table ...) into a folder from its JSON definition, as returned by get_content_export_result. Returns a job id: poll get_content_import_status.

Install, 1 operation

install_appInstall appPOSTSchedule an asynchronous job to install the app with the given UUID and version from the App Catalog. The app will be installed in 'Installed Apps' folder in the Content Library.

Message, 1 operation

get_search_job_messagesGet search job messagesGETPage through the raw log messages of a non-aggregate search job (create_search_job), up to 10,000 per call; raise offset by the count returned.

Metrics query, 1 operation

run_metrics_queriesRun metrics queriesPOSTExecute multiple metrics queries.

Pause, 1 operation

pause_scheduled_viewPause scheduled viewPOSTPause a scheduled view with the given identifier.

Permission, 1 operation

get_content_permissionsGet content permissionsGETReturns content permissions of a content item with the given identifier.

Personal, 1 operation

get_personal_folderGet personal folderGETGet the personal folder of the current user.

Record, 1 operation

get_search_job_recordsGet search job recordsGETPage through the aggregate records (rows of count, sum, group by ...) of an aggregate search job (create_search_job). Raise offset by the count returned.

Report job, 1 operation

generate_dashboard_reportGenerate dashboard reportPOSTSchedule an asynchronous job to generate a report from a template. All items in the template will be included unless specified.

Resource, 1 operation

list_health_events_for_resourcesList health events for resourcesPOSTGet a list of all the unresolved events in your account that belong to the supplied resource identifiers.

Sli, 1 operation

get_slo_sli_valuesGet slo sli valuesGETBulk fetch SLI values, error budget remaining and SLI computation status for the current compliance period.

Start, 1 operation

start_scheduled_viewStart scheduled viewPOSTStart a scheduled view with the given identifier.

Truncate, 1 operation

truncate_lookup_tableTruncate lookup tablePOSTDelete every row of a lookup table (the table and its schema stay). Cannot be undone.

Uninstall, 1 operation

uninstall_appUninstall appPOSTSchedule an asynchronous job to uninstall app with the given UUID. _You get back an identifier of asynchronous job in response to this endpoint.

Usage forecast, 1 operation

get_usage_forecastGet usage forecastGETGet usage forecast with respect to last number of days specified. If nothing is provided for last number of days, the average of term period will be taken to do the forecast.

Showing the first 120 of 134 endpoints. The rest are in the product, searchable from the workflow builder and from chat.

Use Sumo Logic from Claude Code, Cursor or Codex

Connect Sumo Logic in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Sumo Logic operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Sumo Logic

Create your workspace
Sign up free. Nothing to install.
Connect Sumo Logic once
Add your Sumo Logic connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.