SumoLogicStore — Sumo Logic cloud log management

SumoLogicStore — Sumo Logic cloud log management Overview Sumo Logic is a cloud log-management and analytics platform. Logs are ingested by POSTing to an HTTP Source collector URL, and searched with the Search Job API (create a job, then poll for status/messages). There is no SQL-shaped query surface, no row-level UPDATE/DELETE, and no identifier escaping, so Sumo Logic does not fit the SQL Dialect interface (src/dialects/dialect.ts). SumoLogicStore therefore implements the minimal NoSqlStore marker interface (src/nosql/store.ts) — connection lifecycle plus a getClient() escape hatch — and exposes Sumo's HTTP Source ingest and Search Job API (create job + fetch messages), plus field/collector metadata, directly. Identity: Property | Value | --------- | -------------- | name | 'sumologic' | library | 'fetch' | Two hosts — ingest vs API Ingest and search live on different hosts: ingest targets the per-source collectorURL, while search/metadata target the regional apiURL. The internal fetch client resolves absolute URLs verbatim, so push() posts to the full collector URL while the search/metadata methods use relative API paths against apiURL. No canonical driver — HTTP over fetch Sumo Logic has no single canonical npm client; it is an HTTP/JSON API. This store talks to it with the global fetch (so library is 'fetch'). When no client is injected, an internal client over fetch + apiURL is built at connect() time by createFetchClient(apiURL, headers) (its GET sends Accept: application/json). Injected client SumoLogicStoreOptions accepts a pre-built client implementing the SumoLogicHttpClient interface. When provided it is used verbatim and apiURL is ignored — this is how the test suite injects a mock (no network). Connection Option | Type | Purpose | -------------- | ------------------------ | -------------------------------------------------------------------------------- | apiURL | string | Base URL for the Search Job / metadata API. Defaults to https://api.sumologic.com. | collectorURL | string | Full HTTP Source collector URL that push() ingests to (required for push). | client | SumoLogicHttpClient | Pre-built HTTP client. When set, apiURL is ignored. | headers | Record<string, string> | Extra HTTP headers (e.g. basic-auth Authorization) sent with every request. | Injected-client form Methods Read methods route through an internal doGet, which wraps any client failure in a DatabaseError. Calling a method before connect() (or after disconnect()) throws a ConnectionError. Lifecycle Method | Signature | Behavior | ------------- | ----------------------------------- | -------------------------------------------------------------------------------------------------- | connect | connect(): Promise<void> | Uses an injected client if provided, otherwise builds a fetch client from apiURL. Idempotent. | disconnect | disconnect(): Promise<void> | Clears the client and connection state. | isConnected | isConnected(): boolean | true only when connected and a client is present. | getClient | getClient(): SumoLogicHttpClient | Returns the underlying (internal or injected) client. Throws ConnectionError if not connected. | Ingest / search / metadata Method | Signature | Endpoint | Behavior | ----------- | -------------------------------------------------------------------- | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | push | push(lines: string \| string[]): Promise<any> | POST <collectorURL> (text/plain) | Ingests raw log lines (a single string, or an array joined with newlines) to the configured HTTP Source. Throws DatabaseError if no collectorURL was configured. | query | query(q: string, options?: SumoLogicQueryOptions): Promise<any> | POST /api/v1/search/jobs | Creates a search job (JSON body). Returns the parsed response (typically { id }); use messages(id) once the job completes. timeZone defaults to 'UTC'. | messages | messages(jobId: string, offset?: number, limit?: number): Promise<any> | GET /api/v1/search/jobs/<id>/messages | Fetches messages for a completed job (default offset=0, limit=100; id URL-encoded). | jobStatus | jobStatus(jobId: string): Promise<any> | GET /api/v1/search/jobs/<id> | Fetches the status of a search job (id URL-encoded). | labels | labels(): Promise<any> | GET /api/v1/fields | Lists the configured fields. | streams | streams(): Promise<any> | GET /api/v1/collectors | Lists the collectors. | Option shape Example Verification status Unit / mock-verified only. The tests in tests/nosql/sumologic.test.ts are fully mock-driven: an in-memory SumoLogicHttpClient that records every request and returns canned responses is injected via SumoLogicStoreOptions.client. There is no live Sumo Logic account and no network in the test run. What this proves: push posts newline-joined lines as text/plain to the exact collectorURL, and throws DatabaseError when no collectorURL is configured. query posts the JSON query body to /api/v1/search/jobs and messages GETs the /messages sub-resource with offset/limit. labels/streams route to the fields/collectors endpoints. Lifecycle: idempotent connect(), getClient() returning the injected client, and ConnectionError before connect(). Error handling: client failures wrapped in DatabaseError. What this does not prove: live execution against a real Sumo Logic account. Request/response shapes are verified against Sumo's documented HTTP Source / Search Job contract, but end-to-end execution over the wire (including the create-job → poll → fetch-messages cycle) has not been exercised here. Related reading All data stores — the full catalogue, grouped by purpose Database types — where this sits among the 22 categories