From the start the Sales team was very good at understanding their product and getting a solutions architect on board early to help you understand the best ways of getting information from your logs. They are open to lots of dialog and willing to make sure you are in a good place to succeed. The ingestion tools are fairly simple and for us we defaulted most to the HTTP ingestion endpoint. Parsing is very robust and extracting fields from your logs can be done a number of different ways. The log-metrics ability was a real winner for us as we have a number of items that log metric information but aren't spitting them out as actual metrics endpoints. This basically allows you to do any custom metrics in a log line to work with. The query language is fairly robust and allows for things like joins, subqueries, aggregation and log reduction and time comparisons.

SumoLogic has all the features (and then some) that SMBs would need to complete log aggregation across infrastructure. Additionally, there are many pre-built search/parsing formats for common data types (like AWS access logs) that are very handy.

1- user friendly 2- ease to use 3- straight forward simple configuration