Sumo Logic Calculate time between two log events

Question

I have a controller action method in .NET Web API where at the beginning of method there's a log statement that simply logs Started which means that the execution has started.

Then, just before returning the response, there's another log statement that logs Finished which means that execution has completed.

Now, I want to setup a Sumo Logic notification alert if the time difference between the two log events exceeds a specific number e.g. 10 seconds.

Basically, what I want to achieve from this is that if my API endpoint takes time more than a specific duration to send response, I want to get notified.

Pardon me for asking but what prevented you from coding it? There is no direct question and no signs of any attempt in code. Cannot you just subtract start time from end time and take action based on the number of seconds of the outcome? — Peter Bons, Mar 18 '18 at 13:54
@PeterBons that's probably because I'm stupid :D I mean how could I not think of this most simple solution you mentioned i.e. calculate the time diff in code and send notification alert if it takes more than a specific time. But, I think it happens as sometimes you forget about the simplest solution of a problem and start thinking about the most complex one :( — Sibtain Norain, Mar 18 '18 at 14:59
You can post your solution as an answer and I'll be happy to accept it :) — Sibtain Norain, Mar 18 '18 at 15:00

score 1 · Accepted Answer · answered Mar 18 '18 at 18:39

I'm not familiar with SumoLogic so don't know if there's a way to have it search the logs for a Started and Ended event with the same id (i.e. something to indicate the Ended found relates to the same query as the Started) then compare the times.

However it looks like it does allow you to fire alerts based on single log entries: https://help.sumologic.com/Dashboards-and-Alerts/Alerts/03-Create-a-Real-Time-Alert

public T MyApiFunction()
{
    T result;
    var id = Guid.NewGuid(); //id used so we can tie up related start and end events if that option's possible
    var startedAt = DateTime.UtcNow;
    logger.Log("Started", id, startedAt);

    //...

    var completedAt = DateTime.UtcNow;
    logger.Log("Completed", id, completedAt);
    var secondsTaken = end.Subtract(start).TotalSeconds;
    if (secondsTaken > AlertThresholdSeconds)
    {
        logger.Error(String.Format("API call time exceeded threshold: {0} seconds", secondsTaken),id);
    }
    return result;
}

I suspect there are better options out there / that SumoLogic offers options which monitor the call externally, rather than requiring additional logic in the API's code to handle this. Sadly I couldn't see any obvious documentation for that though.

score 0 · Answer 2 · answered Mar 18 '18 at 18:07

0

Pardon me for asking but what prevented you from coding it? Cannot you just subtract start time from end time and take action based on the number of seconds of the outcome?

answered Mar 18 '18 at 18:07

Peter Bons

26,826
4
50
74

score 0 · Answer 3 · answered Jun 01 '18 at 08:12

This is possible with the join operator.
Effectively, if you have 2 searches (one for the start event and one for the finish event), you can join them together and then subtract finish time from start time to get a delta and fire an event from that.

Example
Input

starting stream from stream-2454 starting stream from stream-7343 starting search search-733434 from parent stream stream-2454 starting search search-854343 from parent stream stream-7343 starting stream from stream-6543 starting search search-455563 from parent stream stream-6543 starting search search-32342 from parent stream stream-7343

Code
* | join (parse "starting stream from *" AS a) AS T1, (parse "starting search * from parent stream *" AS b, c) AS T2 on T1.a = T2.c

Results
a b c stream-2454 search-733434 stream-2454 stream-7343 search-854343 stream-7343 stream-7343 search-32342 stream-7343 stream-6543 search-854343 stream-6543

Sumo Logic Calculate time between two log events

3 Answers3