EvoHub DocsEvoHub Docs Sign in

Sumo Logic

Use with AI
View as MarkdownThis page as plain text, for pasting into an AI tool Open in ClaudeAsk Claude questions about this page Open in ChatGPTAsk ChatGPT questions about this page
Connect to Cursor / VS Code / ClaudeSearch and read these docs from your AI tool (MCP server)

MCP server URL

https://docs.evohub.io/mcp

Add to CursorAdd to VS Code

Claude Code

claude mcp add --transport http evohub-docs https://docs.evohub.io/mcp

Claude (claude.ai and Claude Desktop): Settings → Connectors → Add custom connector, and paste the URL above.

Claude Desktop — claude_desktop_config.json

{
  "mcpServers": {
    "evohub-docs": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://docs.evohub.io/mcp"
      ]
    }
  }
}

Cursor — ~/.cursor/mcp.json

{
  "mcpServers": {
    "evohub-docs": {
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

VS Code — .vscode/mcp.json

{
  "servers": {
    "evohub-docs": {
      "type": "http",
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

llms.txtllms-full.txt

EvoHub receives Sumo Logic monitor notifications through a webhook connection. The same body is used for the alert and the recovery payload; the recovery resolves the EvoHub alert.

Set it up

Create the integration

In EvoHub, go to On-Call → Integrations → + Add Integration, choose Sumo Logic, pick an Escalation Policy and click Create Integration. Copy the Webhook URL.

Create the connection

In Sumo Logic, go to Monitoring → Connections (Classic UI: Manage Data → Monitoring → Connections), add a connection and choose Webhook. Set URL to your webhook URL and paste the body below as both the Alert Payload and the Recovery Payload.

Use it in monitors

In each monitor, under Notifications, add the connection, select the trigger types to send and turn on Recovery.

{"id":"{{Id}}","name":"{{Name}}","description":"{{Description}}","trigger_type":"{{TriggerType}}","trigger_value":"{{TriggerValue}}","trigger_condition":"{{TriggerCondition}}","num_results":"{{NumQueryResults}}","query_url":"{{QueryURL}}","alert_url":"{{AlertResponseUrl}}"}

Leave a bare {{ResultsJson}} out of the body: Sumo Logic inserts it as raw JSON, and the empty result of a recovery would make the body unreadable.

Monitors with alert grouping

A monitor with alert grouping sends one notification per group (per host, say). With the body above all groups share one EvoHub alert, because the alert is identified by the monitor. To get one alert per group, add the grouping field to the body before the closing }:

,"group":"{{ResultsJson._sourceHost}}"

The alert is then identified by the monitor and the group, and a recovery resolves only its own group's alert. That needs the field in the Recovery Payload too: if it comes through empty there, the recovery cannot find the group's alert — leave group out and keep one alert per monitor.

What EvoHub reads

EvoHub alert Taken from
Title name (the monitor name).
Description description.
Labels monitor_id, group, trigger_type, trigger_value, trigger_condition, num_results, query_url, and url (the alert response page).

Severity

Trigger type EvoHub severity
Critical critical
Warning medium
Missing Data low
Normal high
ResolvedCritical, ResolvedWarning, ResolvedMissingData resolves the alert

Resolve and deduplication

An alert is identified by the monitor, or by the monitor and the group when the body has one. A repeat while it is open is recorded as Retriggered, and the recovery payload resolves it.

Last updated Powered by