create_monitor
Create a Sumo Logic monitor to track logs or metrics and trigger alerts when thresholds are exceeded.
Instructions
Create a new Sumo Logic monitor.
For simple threshold monitors, use threshold/trigger_type params. For complex monitors (anomaly, outlier, multiple triggers, webhook notifications), pass triggers_json and/or notifications_json with the full JSON arrays.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Monitor name | |
| query | Yes | Sumo Logic query for the monitor | |
| playbook | No | Runbook/playbook text | |
| parent_id | No | Folder ID to create in | |
| threshold | Yes | Trigger threshold value | |
| time_range | No | Evaluation window, e.g. '-15m', '-1h' | -15m |
| description | No | Monitor description | |
| is_disabled | No | Create in disabled state | |
| monitor_type | No | 'Logs' or 'Metrics' | Logs |
| trigger_type | No | Severity: 'Critical' or 'Warning' | Critical |
| triggers_json | No | Raw JSON triggers array — overrides threshold/threshold_type/time_range params | |
| threshold_type | No | Comparison operator: GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual | GreaterThan |
| evaluation_delay | No | Delay before evaluation, e.g. '5m' | 5m |
| notifications_json | No | Raw JSON notifications array — overrides notification_emails param | |
| notification_emails | No | Comma-separated notification emails |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |