Sumo Logic Calculate time between two log events

Question

I have a controller action method in .NET Web API where at the beginning of method there's a log statement that simply logs Started which means that the execution has started.

Then, just before returning the response, there's another log statement that logs Finished which means that execution has completed.

Now, I want to setup a Sumo Logic notification alert if the time difference between the two log events exceeds a specific number e.g. 10 seconds.

Basically, what I want to achieve from this is that if my API endpoint takes time more than a specific duration to send response, I want to get notified.

Answer 1

I'm not familiar with SumoLogic so don't know if there's a way to have it search the logs for a Started and Ended event with the same id (i.e. something to indicate the Ended found relates to the same query as the Started) then compare the times.

However it looks like it does allow you to fire alerts based on single log entries: https://help.sumologic.com/Dashboards-and-Alerts/Alerts/03-Create-a-Real-Time-Alert

public T MyApiFunction()
{
    T result;
    var id = Guid.NewGuid(); //id used so we can tie up related start and end events if that option's possible
    var startedAt = DateTime.UtcNow;
    logger.Log("Started", id, startedAt);

    //...

    var completedAt = DateTime.UtcNow;
    logger.Log("Completed", id, completedAt);
    var secondsTaken = end.Subtract(start).TotalSeconds;
    if (secondsTaken > AlertThresholdSeconds)
    {
        logger.Error(String.Format("API call time exceeded threshold: {0} seconds", secondsTaken),id);
    }
    return result;
}

I suspect there are better options out there / that SumoLogic offers options which monitor the call externally, rather than requiring additional logic in the API's code to handle this. Sadly I couldn't see any obvious documentation for that though.