使用说明

SumoLogic MCP服务器

用自然语言转换SumoLogic交互 -一种模型上下文协议（MCP）服务器，使SumoLogic操作像用简单的英语提问一样简单。

🚀 是什么让这个特别

这不仅仅是另一个API包装器。随着 语境意识 由...驱动 sumologic-context.json，您可以使用理解您的特定环境、资源和常见查询的自然语言与SumoLogic进行交互。

之前vs之后

之前（传统API）：

# Complex API calls with exact syntax
curl -X POST "https://api.sumologic.com/api/v1/search/jobs" \
  -H "Authorization: Basic <encoded>" \
  -d '{"query":"_sourceCategory=webapp | count by _sourceHost", "from":"2024-01-01T00:00:00", "to":"2024-01-01T23:59:59"}'

之后（自然语言与语境）：

"Show me error counts from our production web servers yesterday"
"Which collectors are having ingestion issues?"
"Create a dashboard for our new microservice deployment"

🎯 主要特点

🧠 情境智能

这 sumologic-context.json 配置将基本的API访问转换为智能助手，该助手知道：

您的特定收藏家及其目的
常见查询及其业务含义
资源关系和依赖关系
团队特定术语和工作流程

🔧 完成SumoLogic操作

连接管理：验证连接和健康状况
收藏家和来源：创建、管理和监视数据摄取
搜索和分析：使用自然语言执行复杂查询
监视器和警报：管理监控配置
仪表盘：创建和更新可视化

💬 自然语言接口

问以下问题：

“本周我们的支付服务的错误率是多少？”
“显示最近一小时缓慢的数据库查询”
“为我们的新Kubernetes集群创建一个收集器”
“有什么我应该知道的关键警报吗？”

🌟 sumologic-context.json的力量

什么是情境意识？

这 sumologic-context.json 档案是你的秘密武器。它教MCP服务器 您的特定SumoLogic环境，实现令人难以置信的直观交互。

真实世界上下文配置

{
  "version": "1.0",
  "organization": "acme-corp",
  "environments": {
    "production": {
      "applications": {
        "web-frontend": {
          "sourceCategory": "prod/web/frontend",
          "sourceName": "nginx-*",
          "description": "Production web frontend servers (Nginx)",
          "commonFilters": ["_sourceHost=web-prod-*"],
          "sampleQueries": [
            "_sourceCategory=\"prod/web/frontend\" | where status_code >= 400",
            "_sourceCategory=\"prod/web/frontend\" | timeslice 1m | count by status_code",
            "_sourceCategory=\"prod/web/frontend\" | json field=response_time | avg(response_time)"
          ]
        },
        "api-backend": {
          "sourceCategory": "prod/api/backend", 
          "sourceName": "api-server-*",
          "description": "Production API backend services",
          "commonFilters": ["_sourceHost=api-prod-*"],
          "sampleQueries": [
            "_sourceCategory=\"prod/api/backend\" error OR exception",
            "_sourceCategory=\"prod/api/backend\" | json field=response_time | avg(response_time) by endpoint",
            "_sourceCategory=\"prod/api/backend\" | where status_code = 500"
          ]
        },
        "mobile-app": {
          "sourceCategory": "prod/mobile/app",
          "sourceName": "mobile-api-*",
          "description": "Production mobile application backend",
          "commonFilters": ["_sourceHost=mobile-prod-*"],
          "sampleQueries": [
            "_sourceCategory=\"prod/mobile/app\" crash OR exception",
            "_sourceCategory=\"prod/mobile/app\" | json field=user_id | count by user_id"
          ]
        }
      },
      "infrastructure": {
        "database": {
          "sourceCategory": "prod/database/postgresql",
          "sourceName": "postgres-*",
          "description": "Production PostgreSQL database logs",
          "commonFilters": ["_sourceHost=db-prod-*"],
          "sampleQueries": [
            "_sourceCategory=\"prod/database/postgresql\" slow query",
            "_sourceCategory=\"prod/database/postgresql\" | where duration > 1000"
          ]
        },
        "kubernetes": {
          "sourceCategory": "prod/k8s/containers",
          "sourceName": "k8s-*",
          "description": "Production Kubernetes cluster logs",
          "commonFilters": ["_sourceHost=k8s-*"],
          "namespaces": ["default", "production", "monitoring", "ingress-nginx"]
        }
      }
    },
    "staging": {
      "applications": {
        "web-frontend": {
          "sourceCategory": "staging/web/frontend",
          "sourceName": "nginx-staging-*",
          "description": "Staging web frontend servers"
        },
        "api-backend": {
          "sourceCategory": "staging/api/backend", 
          "sourceName": "api-staging-*",
          "description": "Staging API backend services"
        }
      }
    }
  },
  "shortcuts": {
    "errors": {
      "description": "Find error messages and exceptions",
      "queryTemplate": "error OR exception OR fatal OR \"stack trace\" OR \"internal server error\"",
      "timeRange": "-15m"
    },
    "performance": {
      "description": "Performance monitoring with configurable threshold",
      "queryTemplate": "response_time OR duration OR latency | where ${metric} > ${threshold}",
      "defaultParams": {
        "metric": "response_time", 
        "threshold": "1000"
      },
      "timeRange": "-1h"
    },
    "security": {
      "description": "Security-related events and authentication failures",
      "queryTemplate": "authentication OR authorization OR \"access denied\" OR \"unauthorized\"",
      "timeRange": "-1h"
    },
    "database-slow": {
      "description": "Slow database queries",
      "queryTemplate": "\"slow query\" OR (duration > ${threshold}) OR \"query timeout\"",
      "defaultParams": {
        "threshold": "5000"
      },
      "timeRange": "-30m"
    }
  },
  "commonFields": {
    "timestamp_field": "@timestamp",
    "host_field": "_sourceHost",
    "service_field": "service_name",
    "environment_field": "environment",
    "log_level_field": "level"
  }
}

行动中的情境示例

有了这种复杂的上下文配置，看看这些交互变得多么自然和强大：

示例1：多环境误差分析

你问： “比较生产和测试web前端之间的错误率”

AI智能化：

识别 web-frontend 两者都 production 和 staging 环境
使用上下文感知查询：
- 生产： _sourceCategory="prod/web/frontend" | where status_code >= 400
- 分期： _sourceCategory="staging/web/frontend" | where status_code >= 400
应用适当的时间范围并提供比较分析
报告： “生产web前端：0.2%错误率（正常），暂存：1.1%错误率（升高-可能来自最近的部署测试）”

示例2：基础设施健康检查

你问： “我们的Kubernetes集群表现如何？”

AI自动：

将“Kubernetes集群”映射到 prod/k8s/containers 来源类别
跨配置的命名空间进行检查： default, production, monitoring, ingress-nginx
应用特定于基础架构的筛选器： _sourceHost=k8s-*
使用容器运行状况和资源使用情况的示例查询
回复： “K8s集群健康：247个Pod在4个命名空间中运行。在生产命名空间中未检测到资源约束。”

示例3：智能快捷方式使用

你问： “显示最近一小时缓慢的数据库查询”

AI利用快捷方式：

识别“慢速数据库查询”映射到 database-slow 捷径
应用模板： "slow query" OR (duration > 5000) OR "query timeout"
目标PostgreSQL日志： _sourceCategory="prod/database/postgresql"
使用默认阈值（5000ms）和自定义时间范围（-1h）
结果： “在过去一小时内发现12个慢速查询。平均持续时间：7.2秒。最常见的：用户身份验证查询。”

示例4：跨服务性能分析

你问： “是什么导致了移动应用程序性能问题？”

AI进行全面分析：

识别 mobile-app 应用上下文
运行特定于移动设备的查询： _sourceCategory="prod/mobile/app" crash OR exception
交叉引用 api-backend 演出 avg(response_time) by endpoint
检查 database 相关慢速查询的日志
综合研究结果： “移动应用程序显示崩溃率增加了15%。根本原因：由于数据库连接池耗尽，API端点/用户/配置文件的平均响应时间为3.2秒。”

示例5：安全事件响应

你问： “检查过去一小时内是否存在任何安全问题”

AI使用安全快捷方式：

适用于 security 跨所有生产应用程序的快捷方式模板
搜索： authentication OR authorization OR "access denied" OR "unauthorized"
同时扫描web前端、api后端和移动应用程序
跨服务关联调查结果
报告： “安全警报：从IP 192.168.1.100在API后端检测到47次未经授权的访问尝试。Web前端显示相应的403响应。"

📋 先决条件

Node.js 20+ （推荐LTS）
SumoLogic帐户 具有API访问权限
API证书 （访问ID和密钥）
码头工人 （可选，用于容器化部署）

⚡ 快速开始

1.安装

git clone https://github.com/greyaperez/mcp-sumologic.git
cd mcp-sumologic
npm install

2.配置

# Copy environment template
cp .env.example .env

编辑 .env 使用您的SumoLogic凭据：

SUMOLOGIC_ACCESS_ID=your_access_id
SUMOLOGIC_ACCESS_KEY=your_access_key
SUMOLOGIC_API_ENDPOINT=https://api.us2.sumologic.com/api
SUMOLOGIC_CONTEXT_CONFIG=./sumologic-context.json
SUMOLOGIC_DEFAULT_TIMEZONE=UTC

3.创建上下文文件

创建 sumologic-context.json 使用您的环境详细信息：

{
  "version": "1.0",
  "organization": "your-org",
  "environments": {
    "production": {
      "applications": {
        "web-frontend": {
          "sourceCategory": "prod/web/frontend",
          "sourceName": "nginx-*",
          "description": "Production web frontend servers",
          "commonFilters": ["_sourceHost=web-prod-*"],
          "sampleQueries": [
            "_sourceCategory=\"prod/web/frontend\" | where status_code >= 400"
          ]
        }
      },
      "infrastructure": {
        "database": {
          "sourceCategory": "prod/database/postgresql",
          "sourceName": "postgres-*", 
          "description": "Production PostgreSQL database logs",
          "commonFilters": ["_sourceHost=db-prod-*"]
        }
      }
    }
  },
  "shortcuts": {
    "errors": {
      "description": "Find error messages and exceptions",
      "queryTemplate": "error OR exception OR fatal",
      "timeRange": "-15m"
    }
  },
  "commonFields": {
    "timestamp_field": "@timestamp",
    "host_field": "_sourceHost",
    "service_field": "service_name"
  }
}

4.运行服务器

# Development mode
npm run dev

# Production mode
npm run build && npm start

🐳 Docker部署

构建并运行

# Build image
docker build -t mcp/sumologic .

# Run with environment variables
docker run -i --rm \
  -e SUMOLOGIC_ACCESS_ID="your_access_id" \
  -e SUMOLOGIC_ACCESS_KEY="your_access_key" \
  -e SUMOLOGIC_API_ENDPOINT="https://api.us2.sumologic.com/api" \
  -e SUMOLOGIC_CONTEXT_CONFIG="./sumologic-context.json" \
  -e SUMOLOGIC_DEFAULT_TIMEZONE="UTC" \
  mcp/sumologic

🔧 Claude桌面集成

添加到您的Claude Desktop配置中：

选项1：直接使用Node.js

{
  "mcpServers": {
    "sumologic": {
      "command": "node",
      "args": ["/path/to/mcp-sumologic/dist/index.js"],
      "env": {
        "SUMOLOGIC_ACCESS_ID": "your_access_id",
        "SUMOLOGIC_ACCESS_KEY": "your_access_key",
        "SUMOLOGIC_API_ENDPOINT": "https://api.us2.sumologic.com/api",
        "SUMOLOGIC_CONTEXT_CONFIG": "./sumologic-context.json",
        "SUMOLOGIC_DEFAULT_TIMEZONE": "UTC"
      }
    }
  }
}

选项2:Docker

{
  "mcpServers": {
    "sumologic": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "SUMOLOGIC_ACCESS_ID",
        "-e", "SUMOLOGIC_ACCESS_KEY",
        "-e", "SUMOLOGIC_API_ENDPOINT",
        "-e", "SUMOLOGIC_CONTEXT_CONFIG",
        "-e", "SUMOLOGIC_DEFAULT_TIMEZONE",
        "mcp/sumologic"
      ],
      "env": {
        "SUMOLOGIC_ACCESS_ID": "your_access_id",
        "SUMOLOGIC_ACCESS_KEY": "your_access_key",
        "SUMOLOGIC_API_ENDPOINT": "https://api.us2.sumologic.com/api",
        "SUMOLOGIC_CONTEXT_CONFIG": "./sumologic-context.json",
        "SUMOLOGIC_DEFAULT_TIMEZONE": "UTC"
      }
    }
  }
}

🛠️ 可用工具

工具	描述	上下文感知
`check_connection`	验证API连接	✅
`list_collectors`	列出所有具有业务背景的收集器	✅
`get_collector`	获取包含关系信息的收集器详细信息	✅
`create_hosted_collector`	使用智能默认值创建收集器	✅
`update_collector`	更新收集器属性	✅
`delete_collector`	删除带有影响分析的收集器	✅
`list_sources`	列出带有目的描述的来源	✅
`get_source`	通过上下文获取源详细信息	✅
`create_http_source`	使用模板创建HTTP源	✅
`start_search_job`	使用查询建议执行搜索	✅
`check_search_job_status`	检查搜索状态	✅
`get_search_job_results`	通过业务解释获得结果	✅
`list_monitors`	列出具有业务影响的监控器	✅
`get_monitor`	使用上下文获取监视器详细信息	✅

💡 上下文配置的最佳实践

1. 按环境和服务类型组织

{
  "environments": {
    "production": {
      "applications": {
        "web-frontend": {
          "sourceCategory": "prod/web/frontend",
          "description": "Production web frontend servers (Nginx)",
          "commonFilters": ["_sourceHost=web-prod-*"]
        }
      },
      "infrastructure": {
        "database": {
          "sourceCategory": "prod/database/postgresql", 
          "description": "Production PostgreSQL database logs"
        }
      }
    }
  }
}

2. 包含实SumoLogic查询

{
  "sampleQueries": [
    "_sourceCategory=\"prod/web/frontend\" | where status_code >= 400",
    "_sourceCategory=\"prod/api/backend\" | json field=response_time | avg(response_time) by endpoint"
  ]
}

3. 创建可重用的查询快捷方式

{
  "shortcuts": {
    "performance": {
      "description": "Performance monitoring with configurable threshold",
      "queryTemplate": "response_time OR duration OR latency | where ${metric} > ${threshold}",
      "defaultParams": {
        "metric": "response_time", 
        "threshold": "1000"
      },
      "timeRange": "-1h"
    }
  }
}

4. 规范字段映射

{
  "commonFields": {
    "timestamp_field": "@timestamp",
    "host_field": "_sourceHost", 
    "service_field": "service_name",
    "environment_field": "environment",
    "log_level_field": "level"
  }
}

5. 使用一致的命名模式

来源类别: {env}/{service-type}/{service-name}
源名称: {service}-{env}-* （例如。， nginx-prod-*)
主机筛选器: _sourceHost={service}-{env}-*

🔍 使用示例

环境感知查询

"Show me errors in production web frontend"
"Compare API performance between staging and production"  
"Check database health in all environments"

快捷方式驱动分析

"Run security check for the last hour"
"Find slow database queries with default threshold"
"Show performance issues with response time over 2000ms"

基础设施智能

"How is our Kubernetes cluster doing?"
"Check Redis cache hit rates in production"
"Show load balancer health across all environments"

跨服务关联

"Is the mobile app backend causing the database slowdown?"
"Compare error rates between web frontend and API backend"
"Show the full request flow from load balancer to database"

前瞻性管理

"Create a monitor for API response times over 1 second"
"Set up alerting for Kubernetes pod crashes"
"Monitor database connection pool exhaustion"

🤝 贡献

复刻仓库
创建要素分支(git checkout -b feature/amazing-feature)
提交您的更改(git commit -m 'Add amazing feature')
推到分支(git push origin feature/amazing-feature)
打开拉取请求

📄 许可证

此项目根据MIT许可证获得许可-请参阅许可证文件以获取详细信息。