From 93f561e69c243a6707624a2e951ecaef587b9dd4 Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Thu, 3 Sep 2026 13:43:33 +0530 Subject: [PATCH 1/6] DOCS-1852 - Document colon-delimited Metric Rules match expressions Metric Rules match expressions and variable extractions now also support colon (:) as a segment delimiter, alongside dot, gated behind metrics.rules.parser.enable.extended.delimiters (SUMO-292913). Useful for colon-separated identifiers like AWS ARNs. Adds a note that a colon-delimited expression matching nothing may mean the flag isn't enabled yet for the account. --- docs/metrics/metric-rules-editor.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/docs/metrics/metric-rules-editor.md b/docs/metrics/metric-rules-editor.md index 8fd8dc04b7e..9c173f79f2e 100644 --- a/docs/metrics/metric-rules-editor.md +++ b/docs/metrics/metric-rules-editor.md @@ -50,11 +50,15 @@ The subsections that follow describe the information shown in the columns on the A metric match expression defines the scope of the rule. Put another way, the match expression specifies the metrics to which the tags (defined by variable extraction) will be applied.  -### Dot-delimited match expressions +### Dot- and colon-delimited match expressions -A match expression can be one or more dot-delimited string, like this: `collectd.*.*.*.*`, which matches all Graphite metrics that have five segments in the string, where the value of the first segment is `collectd`. +A match expression can be one or more dot-delimited or colon-delimited string. For example, `collectd.*.*.*.*` matches all Graphite metrics that have five segments in the string, where the value of the first segment is `collectd`. Colon-delimited match expressions work the same way, and are useful for colon-separated identifiers such as AWS ARNs, for example: `arn:aws:bedrock-agentcore:*:*:*`. -Given a dot-delimited match expression, Sumo Logic applies the match expression to the `_rawName` field, which is present for Graphite metrics and contains the metric path for a metric. +Given a dot- or colon-delimited match expression, Sumo Logic applies the match expression to the `_rawName` field, which is present for Graphite metrics and contains the metric path for a metric. + +:::note +If a colon-delimited match expression doesn't match any time series even though the metric names use colons, colon-delimited matching may not be enabled for your account yet. Contact [Sumo Logic Support](https://support.sumologic.com/support/s) to have it enabled. +::: ### Key-value pair(s) match expressions @@ -72,7 +76,7 @@ You can define multiple match expressions for the same rule. If you do, tags wil ### Greedy match expressions  -You can use greedy matching in a metric match expression. This is useful when your match expression is a dot-delimited string if the values in `_rawName` vary in terms of the number of segments. In this metric example, the portion in green is a class name: `prod.prod-lru-7.katta-svc.com.svc.soa.service.InstResponder.KattaProtocol.countPerShard_v3.m5_rate`. +You can use greedy matching in a metric match expression. This is useful when your match expression is a dot- or colon-delimited string if the values in `_rawName` vary in terms of the number of segments. In this metric example, the portion in green is a class name: `prod.prod-lru-7.katta-svc.com.svc.soa.service.InstResponder.KattaProtocol.countPerShard_v3.m5_rate`. Different classes have dot-delimited names of various lengths, so a match expression for this metric should use greedy matching for the class name segment. For example: `prod.*.*.**.*.*.*`. @@ -90,7 +94,7 @@ Here's how to create a metrics rule using the metrics rules editor in the Sumo L ::: The **Time Series** section of the page lists metrics that match the expression you entered. If no metrics are listed, edit your match expression until matching metrics appear.
Add metrics rule with expression 1. In the **Define variables** section of the page, for each tag you want to apply to matching metrics, enter a meaningful tag name in the **Variable name** field on the left. In the **Tag sequence** field, assign a variable to the tag. There are two different formats for specifying the Tag Sequence. - * To pull a tag from a dot-delimited string in the metric's `_rawName` field, use `$_1` to extract the first segment of the string, `$_2` to extract the second segment of the string, and so on.  For more information, see [Extracting variables from a dot-delimited match expression](#extract-variables-from-a-dot-delimited-match-expression). + * To pull a tag from a dot- or colon-delimited string in the metric's `_rawName` field, use `$_1` to extract the first segment of the string, `$_2` to extract the second segment of the string, and so on.  For more information, see [Extracting variables from a dot- or colon-delimited match expression](#extract-variables-from-a-dot--or-colon-delimited-match-expression). * To pull a tag from a dot-delimited string in metric field other than `_rawName` field, use `$FieldName._1` to extract the first segment of the string, `$FieldName._2` to extract the second segment of the string, and so on. For more information, see [Extracting variables from a key-value pair match expression](#extract-variables-from-a-key-value-pair-match-expression). 1. Select a metric in the **Time Series** section to see the values that would be assigned to each extracted tag for the selected metric. The entries in the columns show what values would be assigned to the selected metric given the specified Tag Sequences.
Variables in time series   1. Click **Save** to save your rule. The tags will be applied to incoming metrics. Sumo Logic will not re-index your historical data. @@ -101,9 +105,11 @@ Variable extractions define the tags you want to attach to metrics that match a When you define a variable you give it a name and define its Tag Sequence, which maps the variable to a specific segment of a delimited string. The format for the Tag Sequence depends on whether the corresponding match expression is a Graphite string or is one or more key-value pairs.  -### Extract variables from a dot-delimited match expression +### Extract variables from a dot- or colon-delimited match expression + +For this dot-delimited match expression: `collectd.*.*.*.*` you can define four variables: one for each of the segments represented by an asterisk. As described in [Dot- and colon-delimited match expressions](#dot--and-colon-delimited-match-expressions), if no key is specified, Sumo Logic will match the expression against metrics’ `_rawName` field. When matching against ` _rawName`, specify the Tag Sequence for a variable in this form: `$_sequence`, where `sequence` indicates the placement of the segment in the match expression. For example, enter `$_2` to extract the second component of the metric match expression. -For this dot-delimited match expression: `collectd.*.*.*.*` you can define four variables: one for each of the segments represented by an asterisk. As described in [Dot-delimited match expressions](#dot-delimited-match-expressions), if no key is specified, Sumo Logic will match the expression against metrics’ `_rawName` field. When matching against ` _rawName`, specify the Tag Sequence for a variable in this form: `$_sequence`, where `sequence` indicates the placement of the segment in the match expression. For example, enter `$_2` to extract the second component of the metric match expression. +The same syntax applies to a colon-delimited match expression. For example, given the match expression `arn:aws:bedrock-agentcore:*:*:*`, enter `$_4` to extract the region segment of the ARN. ### Extract variables from a key-value pair match expression From a452b1fee8ec7e457880ac5eb67a26c4fdb2f93f Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Thu, 3 Sep 2026 17:21:01 +0530 Subject: [PATCH 2/6] DOCS-1852 - Spell out suspended hyphens, add Word List entry Microsoft Manual of Style outranks Chicago in our style guide's reference precedence, and Microsoft recommends against suspended compound modifiers outside space-constrained contexts. Spells out "dot-delimited or colon-delimited" in full instead of "dot- or colon-delimited", and adds a Word List entry so this doesn't need re-litigating. --- docs/contributing/word-list.md | 2 ++ docs/metrics/metric-rules-editor.md | 12 ++++++------ 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 1a930c6ed43..72866f47c78 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -184,6 +184,8 @@ Capitalize "Source" only where it's the literal UI text, such as the **Add Sourc **Sumo Logic**. For all references, always use "Sumo Logic," never "Sumo" alone, including in the possessive. This helps our SEO, which is essential for a SaaS offering. To be more conversational, "we" is also fine. +**Suspended hyphens**. Avoid these in body text — spell out both compound modifiers in full: "dot-delimited or colon-delimited," not "dot- or colon-delimited." Reserve suspended hyphens for space-constrained contexts like table headers or UI labels. + ## T diff --git a/docs/metrics/metric-rules-editor.md b/docs/metrics/metric-rules-editor.md index 9c173f79f2e..4d086e014d3 100644 --- a/docs/metrics/metric-rules-editor.md +++ b/docs/metrics/metric-rules-editor.md @@ -50,11 +50,11 @@ The subsections that follow describe the information shown in the columns on the A metric match expression defines the scope of the rule. Put another way, the match expression specifies the metrics to which the tags (defined by variable extraction) will be applied.  -### Dot- and colon-delimited match expressions +### Dot-delimited or colon-delimited match expressions A match expression can be one or more dot-delimited or colon-delimited string. For example, `collectd.*.*.*.*` matches all Graphite metrics that have five segments in the string, where the value of the first segment is `collectd`. Colon-delimited match expressions work the same way, and are useful for colon-separated identifiers such as AWS ARNs, for example: `arn:aws:bedrock-agentcore:*:*:*`. -Given a dot- or colon-delimited match expression, Sumo Logic applies the match expression to the `_rawName` field, which is present for Graphite metrics and contains the metric path for a metric. +Given a dot-delimited or colon-delimited match expression, Sumo Logic applies the match expression to the `_rawName` field, which is present for Graphite metrics and contains the metric path for a metric. :::note If a colon-delimited match expression doesn't match any time series even though the metric names use colons, colon-delimited matching may not be enabled for your account yet. Contact [Sumo Logic Support](https://support.sumologic.com/support/s) to have it enabled. @@ -76,7 +76,7 @@ You can define multiple match expressions for the same rule. If you do, tags wil ### Greedy match expressions  -You can use greedy matching in a metric match expression. This is useful when your match expression is a dot- or colon-delimited string if the values in `_rawName` vary in terms of the number of segments. In this metric example, the portion in green is a class name: `prod.prod-lru-7.katta-svc.com.svc.soa.service.InstResponder.KattaProtocol.countPerShard_v3.m5_rate`. +You can use greedy matching in a metric match expression. This is useful when your match expression is a dot-delimited or colon-delimited string if the values in `_rawName` vary in terms of the number of segments. In this metric example, the portion in green is a class name: `prod.prod-lru-7.katta-svc.com.svc.soa.service.InstResponder.KattaProtocol.countPerShard_v3.m5_rate`. Different classes have dot-delimited names of various lengths, so a match expression for this metric should use greedy matching for the class name segment. For example: `prod.*.*.**.*.*.*`. @@ -94,7 +94,7 @@ Here's how to create a metrics rule using the metrics rules editor in the Sumo L ::: The **Time Series** section of the page lists metrics that match the expression you entered. If no metrics are listed, edit your match expression until matching metrics appear.
Add metrics rule with expression 1. In the **Define variables** section of the page, for each tag you want to apply to matching metrics, enter a meaningful tag name in the **Variable name** field on the left. In the **Tag sequence** field, assign a variable to the tag. There are two different formats for specifying the Tag Sequence. - * To pull a tag from a dot- or colon-delimited string in the metric's `_rawName` field, use `$_1` to extract the first segment of the string, `$_2` to extract the second segment of the string, and so on.  For more information, see [Extracting variables from a dot- or colon-delimited match expression](#extract-variables-from-a-dot--or-colon-delimited-match-expression). + * To pull a tag from a dot-delimited or colon-delimited string in the metric's `_rawName` field, use `$_1` to extract the first segment of the string, `$_2` to extract the second segment of the string, and so on.  For more information, see [Extracting variables from a dot-delimited or colon-delimited match expression](#extract-variables-from-a-dot-delimited-or-colon-delimited-match-expression). * To pull a tag from a dot-delimited string in metric field other than `_rawName` field, use `$FieldName._1` to extract the first segment of the string, `$FieldName._2` to extract the second segment of the string, and so on. For more information, see [Extracting variables from a key-value pair match expression](#extract-variables-from-a-key-value-pair-match-expression). 1. Select a metric in the **Time Series** section to see the values that would be assigned to each extracted tag for the selected metric. The entries in the columns show what values would be assigned to the selected metric given the specified Tag Sequences.
Variables in time series   1. Click **Save** to save your rule. The tags will be applied to incoming metrics. Sumo Logic will not re-index your historical data. @@ -105,9 +105,9 @@ Variable extractions define the tags you want to attach to metrics that match a When you define a variable you give it a name and define its Tag Sequence, which maps the variable to a specific segment of a delimited string. The format for the Tag Sequence depends on whether the corresponding match expression is a Graphite string or is one or more key-value pairs.  -### Extract variables from a dot- or colon-delimited match expression +### Extract variables from a dot-delimited or colon-delimited match expression -For this dot-delimited match expression: `collectd.*.*.*.*` you can define four variables: one for each of the segments represented by an asterisk. As described in [Dot- and colon-delimited match expressions](#dot--and-colon-delimited-match-expressions), if no key is specified, Sumo Logic will match the expression against metrics’ `_rawName` field. When matching against ` _rawName`, specify the Tag Sequence for a variable in this form: `$_sequence`, where `sequence` indicates the placement of the segment in the match expression. For example, enter `$_2` to extract the second component of the metric match expression. +For this dot-delimited match expression: `collectd.*.*.*.*` you can define four variables: one for each of the segments represented by an asterisk. As described in [Dot-delimited or colon-delimited match expressions](#dot-delimited-or-colon-delimited-match-expressions), if no key is specified, Sumo Logic will match the expression against metrics’ `_rawName` field. When matching against ` _rawName`, specify the Tag Sequence for a variable in this form: `$_sequence`, where `sequence` indicates the placement of the segment in the match expression. For example, enter `$_2` to extract the second component of the metric match expression. The same syntax applies to a colon-delimited match expression. For example, given the match expression `arn:aws:bedrock-agentcore:*:*:*`, enter `$_4` to extract the region segment of the ARN. From cbfa943393cd2d9b52e94c309134bd0a74282aa4 Mon Sep 17 00:00:00 2001 From: Jagadisha V <129049263+JV0812@users.noreply.github.com> Date: Thu, 3 Sep 2026 17:22:26 +0530 Subject: [PATCH 3/6] Apply suggestion from @JV0812 --- docs/contributing/word-list.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 72866f47c78..74f073f614d 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -184,7 +184,7 @@ Capitalize "Source" only where it's the literal UI text, such as the **Add Sourc **Sumo Logic**. For all references, always use "Sumo Logic," never "Sumo" alone, including in the possessive. This helps our SEO, which is essential for a SaaS offering. To be more conversational, "we" is also fine. -**Suspended hyphens**. Avoid these in body text — spell out both compound modifiers in full: "dot-delimited or colon-delimited," not "dot- or colon-delimited." Reserve suspended hyphens for space-constrained contexts like table headers or UI labels. +**Suspended hyphens**. Avoid these in body text — spell out both compound modifiers in full: "dot-delimited or colon-delimited," not "dot- or colon-delimited". ## T From 9bb02d7ec927648971607d9255cad66dcc6047e8 Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Fri, 4 Sep 2026 11:51:10 +0530 Subject: [PATCH 4/6] DOCS-1852 - Fix number agreement and quote punctuation - metric-rules-editor.md: "a match expression can be a dot-delimited or colon-delimited string" (was "one or more ... string", singular/plural mismatch). - word-list.md: closing period now inside the quote, matching the first example and the file's existing convention. --- docs/contributing/word-list.md | 2 +- docs/metrics/metric-rules-editor.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index 74f073f614d..d4c83dd7564 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -184,7 +184,7 @@ Capitalize "Source" only where it's the literal UI text, such as the **Add Sourc **Sumo Logic**. For all references, always use "Sumo Logic," never "Sumo" alone, including in the possessive. This helps our SEO, which is essential for a SaaS offering. To be more conversational, "we" is also fine. -**Suspended hyphens**. Avoid these in body text — spell out both compound modifiers in full: "dot-delimited or colon-delimited," not "dot- or colon-delimited". +**Suspended hyphens**. Avoid these in body text — spell out both compound modifiers in full: "dot-delimited or colon-delimited," not "dot- or colon-delimited." ## T diff --git a/docs/metrics/metric-rules-editor.md b/docs/metrics/metric-rules-editor.md index 4d086e014d3..f07825d1c82 100644 --- a/docs/metrics/metric-rules-editor.md +++ b/docs/metrics/metric-rules-editor.md @@ -52,7 +52,7 @@ A metric match expression defines the scope of the rule. Put another way, the ma ### Dot-delimited or colon-delimited match expressions -A match expression can be one or more dot-delimited or colon-delimited string. For example, `collectd.*.*.*.*` matches all Graphite metrics that have five segments in the string, where the value of the first segment is `collectd`. Colon-delimited match expressions work the same way, and are useful for colon-separated identifiers such as AWS ARNs, for example: `arn:aws:bedrock-agentcore:*:*:*`. +A match expression can be a dot-delimited or colon-delimited string. For example, `collectd.*.*.*.*` matches all Graphite metrics that have five segments in the string, where the value of the first segment is `collectd`. Colon-delimited match expressions work the same way, and are useful for colon-separated identifiers such as AWS ARNs, for example: `arn:aws:bedrock-agentcore:*:*:*`. Given a dot-delimited or colon-delimited match expression, Sumo Logic applies the match expression to the `_rawName` field, which is present for Graphite metrics and contains the metric path for a metric. From b795e5fc295c17d9a1d63f474495cb3212007b73 Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Tue, 8 Sep 2026 22:05:17 +0530 Subject: [PATCH 5/6] DOCS-1852 - Remove feature flag note now that colon-delimited matching is GA Co-Authored-By: Claude Sonnet 5 --- docs/metrics/metric-rules-editor.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/docs/metrics/metric-rules-editor.md b/docs/metrics/metric-rules-editor.md index f07825d1c82..1fa8fcfe606 100644 --- a/docs/metrics/metric-rules-editor.md +++ b/docs/metrics/metric-rules-editor.md @@ -56,10 +56,6 @@ A match expression can be a dot-delimited or colon-delimited string. For example Given a dot-delimited or colon-delimited match expression, Sumo Logic applies the match expression to the `_rawName` field, which is present for Graphite metrics and contains the metric path for a metric. -:::note -If a colon-delimited match expression doesn't match any time series even though the metric names use colons, colon-delimited matching may not be enabled for your account yet. Contact [Sumo Logic Support](https://support.sumologic.com/support/s) to have it enabled. -::: - ### Key-value pair(s) match expressions A match expression can be one or more key-value pairs, each of which specify a field available for the metric and a field value, like this: `_sourceCategory=training/shipping/metrics type=payment`, which matches all metrics with the source category `training/shipping/metrics`, whose `type` field is `payment`. From 8ba2b321eac0b4b795a08a6d815c1e6d45a8e07c Mon Sep 17 00:00:00 2001 From: Jagadisha V Date: Wed, 9 Sep 2026 09:16:37 +0530 Subject: [PATCH 6/6] DOCS-1852 - Address review feedback: em dash, redundant sentence, extraction scope - Remove em dash from the Suspended hyphens Word List entry - Drop the sentence in Dot-delimited or colon-delimited match expressions that just restated the first sentence - Clarify that colon-delimited strings aren't supported for key-value pair field extraction (only for _rawName matching) Co-Authored-By: Claude Sonnet 5 --- docs/contributing/word-list.md | 2 +- docs/metrics/metric-rules-editor.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/contributing/word-list.md b/docs/contributing/word-list.md index d4c83dd7564..3dcb538ca10 100644 --- a/docs/contributing/word-list.md +++ b/docs/contributing/word-list.md @@ -184,7 +184,7 @@ Capitalize "Source" only where it's the literal UI text, such as the **Add Sourc **Sumo Logic**. For all references, always use "Sumo Logic," never "Sumo" alone, including in the possessive. This helps our SEO, which is essential for a SaaS offering. To be more conversational, "we" is also fine. -**Suspended hyphens**. Avoid these in body text — spell out both compound modifiers in full: "dot-delimited or colon-delimited," not "dot- or colon-delimited." +**Suspended hyphens**. Avoid these in body text. Spell out both compound modifiers in full: "dot-delimited or colon-delimited," not "dot- or colon-delimited." ## T diff --git a/docs/metrics/metric-rules-editor.md b/docs/metrics/metric-rules-editor.md index 1fa8fcfe606..aabb42af08e 100644 --- a/docs/metrics/metric-rules-editor.md +++ b/docs/metrics/metric-rules-editor.md @@ -52,7 +52,7 @@ A metric match expression defines the scope of the rule. Put another way, the ma ### Dot-delimited or colon-delimited match expressions -A match expression can be a dot-delimited or colon-delimited string. For example, `collectd.*.*.*.*` matches all Graphite metrics that have five segments in the string, where the value of the first segment is `collectd`. Colon-delimited match expressions work the same way, and are useful for colon-separated identifiers such as AWS ARNs, for example: `arn:aws:bedrock-agentcore:*:*:*`. +A match expression can be a dot-delimited or colon-delimited string. For example, `collectd.*.*.*.*` matches all Graphite metrics that have five segments in the string, where the value of the first segment is `collectd`. Colon-delimited match expressions are useful for colon-separated identifiers such as AWS ARNs, for example: `arn:aws:bedrock-agentcore:*:*:*`. Given a dot-delimited or colon-delimited match expression, Sumo Logic applies the match expression to the `_rawName` field, which is present for Graphite metrics and contains the metric path for a metric. @@ -91,7 +91,7 @@ Here's how to create a metrics rule using the metrics rules editor in the Sumo L The **Time Series** section of the page lists metrics that match the expression you entered. If no metrics are listed, edit your match expression until matching metrics appear.
Add metrics rule with expression 1. In the **Define variables** section of the page, for each tag you want to apply to matching metrics, enter a meaningful tag name in the **Variable name** field on the left. In the **Tag sequence** field, assign a variable to the tag. There are two different formats for specifying the Tag Sequence. * To pull a tag from a dot-delimited or colon-delimited string in the metric's `_rawName` field, use `$_1` to extract the first segment of the string, `$_2` to extract the second segment of the string, and so on.  For more information, see [Extracting variables from a dot-delimited or colon-delimited match expression](#extract-variables-from-a-dot-delimited-or-colon-delimited-match-expression). - * To pull a tag from a dot-delimited string in metric field other than `_rawName` field, use `$FieldName._1` to extract the first segment of the string, `$FieldName._2` to extract the second segment of the string, and so on. For more information, see [Extracting variables from a key-value pair match expression](#extract-variables-from-a-key-value-pair-match-expression). + * To pull a tag from a dot-delimited string in metric field other than `_rawName` field, use `$FieldName._1` to extract the first segment of the string, `$FieldName._2` to extract the second segment of the string, and so on. Colon-delimited strings are not supported for this type of extraction. For more information, see [Extracting variables from a key-value pair match expression](#extract-variables-from-a-key-value-pair-match-expression). 1. Select a metric in the **Time Series** section to see the values that would be assigned to each extracted tag for the selected metric. The entries in the columns show what values would be assigned to the selected metric given the specified Tag Sequences.
Variables in time series   1. Click **Save** to save your rule. The tags will be applied to incoming metrics. Sumo Logic will not re-index your historical data.