For reducing query costs we will not use wildcards in sourcecategory (i.e. _sourcecategory=rh_rhsm/* ) while creating SUMO queries. A specific source needs to be set (e.g. _sourcecategory=rh_rhsm/quarkus_service ).

The problem that the value for that field can be both springboot_server or quarkus_service depending on the service exporting that log.

We want every swatch service to export the same source type (e.g. "swatch")

Evaluate changing the value in the deployment file as a solution.

Acceptance criteria:

• Logs from services running different frameworks can be queried with the same "_sourcecategory" in SUMO
• Upon completion of searching in SUMO using _sourcecategory=rh_rhsm/swatch