DOCS-851 - Mobot Unstructured Logs support GA (HOLD) (#5439)

kimsauce · web-flow · commit 10f0b255a04f · 2025-11-11T13:54:04.000-08:00
* Copilot GA - Unstructured logs + multi-turn conversations

* space fix

* add release notes

* link fix

* DOCS-851 - Unstructured Logs support GA (Copilot)

* rename

* revert spacing

* updates

* Update docs/search/mobot.md
diff --git a/cid-redirects.json b/cid-redirects.json
@@ -4527,6 +4527,7 @@
   "/docs/search/logreduce/influence-the-logreduce-outcome": "/docs/search/behavior-insights/logreduce/influence-the-logreduce-outcome",
   "/docs/search/logreduce/understand-the-logreduce-relevance-column": "/docs/search/behavior-insights/logreduce/understand-the-logreduce-relevance-column",
   "/docs/search/behavior-insights/logreduce-values": "/docs/search/behavior-insights/logreduce/logreduce-values",
+  "/docs/search/copilot-unstructured-logs-beta": "/docs/search/mobot",
   "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-cloud-to-cloud-source-migration":"/docs/send-data/collect-from-other-data-sources/azure-monitoring/azure-event-hubs-source-migration",
   "/docs/manage/manage-subscription/upgrade-sumo-logic-credits-account": "/docs/manage/manage-subscription/upgrade-account/upgrade-sumo-logic-flex-account",
   "/docs/manage/manage-subscription/upgrade-cloud-flex-legacy-account": "/docs/manage/manage-subscription/upgrade-account/upgrade-cloud-flex-legacy-account",
diff --git a/docs/manage/manage-subscription/organization-usage-limits.md b/docs/manage/manage-subscription/organization-usage-limits.md
@@ -42,7 +42,7 @@ To manage the query size limit follow the below steps:
 
 :::info
 Sumo Logic defines scan as two types:
-  - **Foreground interactive search**. Search page UI, Copilot, and Dashboards.
+  - **Foreground interactive search**. Search page UI, Mobot, and Dashboards.
   - **Background search**. API, Scheduled Search, Monitor, Scheduled Views, and SLO. 
 :::
 
diff --git a/docs/manage/manage-subscription/scan-budgets.md b/docs/manage/manage-subscription/scan-budgets.md
@@ -42,7 +42,7 @@ To create the query size limit using the **Advanced** configuration:
     - **Only allow background query scans**. A warning message will be displayed if you run a query that exceeds the budget set. This will block the foreground searches but will not impact any background searches/automated queries.
     :::info
     Sumo Logic defines scan as two types:
-    - **Foreground interactive search**. Search page UI, Copilot, and Dashboards.
+    - **Foreground interactive search**. Search page UI, Mobot, and Dashboards.
     - **Background search**. API, Scheduled Search, Monitors, Scheduled Views, and SLO. 
     :::
 1. **Details**. Enter the name for the scan budget.<br/><img src={useBaseUrl('/img/manage/account/create-scan-budget.png')} alt="create-scan-budget" style={{border:'1px solid gray'}} width="650"/>
@@ -108,4 +108,3 @@ Each budget type (daily, weekly, monthly, or query) is treated independently, wi
 ### Usage attribution across multiple budget types
 
 As long as you are within the limits of each budget type, usage will be attributed independently to each budget type. If you exceed any one budget type, the action for that budget will be applied. But usage will still be reported to other budgets if they have available capacity. For example, if the daily limit and monthly limit is set to 100GB and 300GB respectively, and if you have used 50 GB of your daily limit, then this usage will be reported to both the daily and monthly budgets as long as they are within their capacity. The query budget only tracks the size in GB per query, so the user will still be within the query budget if the query size limit is not breached.
-
diff --git a/docs/search/get-started-with-search/build-search/intelliparse-beta.md b/docs/search/get-started-with-search/build-search/intelliparse-beta.md
@@ -0,0 +1,79 @@
+---
+id: intelliparse-beta
+title: Intelliparse Mode (Beta)
+description: Intelliparse mode extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+<head>
+  <meta name="robots" content="noindex" />
+</head>
+
+<p><a href="/docs/beta"><span className="beta">Beta</span></a></p>
+
+This feature is currently available to select customers. Contact your Sumo Logic account representative to request access.
+
+We've introduced a new Log Search parsing mode called Intelliparse. It extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON.
+
+## Available parsing modes
+
+You can now choose from three parsing options in the log search UI:
+
+* **Intelliparse (new)**. Combines JSON parsing with automatic parsing of unstructured logs using pre-discovered parsers.
+* **Auto Parse**. JSON blocks within logs are automatically parsed ([learn more](/docs/search/get-started-with-search/build-search/dynamic-parsing)).
+* **Manual**. No automatic parsing applied.
+
+<img src={useBaseUrl('img/search/get-started-search/build-search/log-search-parsing-modes.png')} alt="log-search-parsing-modes.png" style={{border: '1px solid gray'}} width="700"/>
+
+## How Intelliparse mode works
+
+When you enable Intelliparse mode:
+* Logs are parsed using a set of parsers discovered from your recently used dashboards.
+* Fields are extracted automatically from both structured and unstructured logs.
+* A hidden operator is applied to your query to power this functionality behind the scenes.
+
+## Benefits
+
+* **No Field Extraction Rules (FERs) required**. Get field-level insights without manual parsing.
+* **Works with your existing dashboards**. Parsers are derived from log panels in recently viewed or edited dashboards.
+* **Improved field visibility**. Fields parsed through Intelliparse mode appear in the Messages tab and can be used in queries, filters, and dashboards.
+
+## Example
+
+If your dashboard includes a query like:
+
+```sql
+_sourceCategory=cassandra "Dropped table"
+| parse "table '*' from database '*'" as db.table, db.name
+```
+
+Then any matching unstructured logs like:
+
+`2025-04-09 11:20:25 * Dropped table 'logins' from database 'auth'`
+
+will be parsed automatically in Intelliparse mode, extracting:
+
+* `db.table = "logins"`
+* `db.name = "auth"`
+
+:::info
+* Parsers are discovered automatically from dashboard content. No manual setup needed.
+* If a dashboard is modified, the associated parser will update. Deleted dashboards do not currently delete parsers.
+* Queries using Intelliparse mode include a hidden intelliparse operator, injected automatically.
+:::
+
+## How Mobot uses Intelliparse mode
+
+Even if you don’t manually enable Intelliparse mode, you may encounter it when using [Sumo Logic Mobot](/docs/search/mobot).
+
+Mobot uses Intelliparse mode in the background to:
+* Automatically parse unstructured logs for natural language queries.
+* Discover field names and values for more accurate suggestions and translations.
+* Generate search queries that include the hidden `intelliparse` operator.
+
+This integration allows Mobot to work with raw, unstructured log data; no setup required on your part.
+
+:::tip
+Want to learn more about Intelliparse mode? [See how it works in Log Search](/docs/search/mobot/#support-for-unstructured-logs).
+:::
diff --git a/docs/search/mobot.md b/docs/search/mobot.md
@@ -15,10 +15,6 @@ keywords:
 import Iframe from 'react-iframe';
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-:::note Name update
-We are renaming *Copilot* to *Mobot* across the product and docs. During this transition, some UI labels and screenshots may still show **Copilot**. Functionality is the same. We will update names and images as the rollout completes.
-:::
-
 Sumo Logic Mobot (formerly known as *Copilot*) is our AI-powered assistant that accelerates investigations and troubleshooting in logs by allowing you to ask questions in plain English and get contextual suggestions, helping first responders get to answers faster.
 
 With its intuitive interface, Mobot automatically generates log searches from natural language queries, helping you quickly investigate performance issues, anomalies, and security threats. It also guides you through investigations step-by-step with AI-derived suggestions to refine your results for faster, more accurate resolutions. Overall, Mobot enhances incident resolution with expert level insights.
@@ -28,7 +24,7 @@ If you prefer not to use Mobot, you can opt out by contacting [Support](https://
 :::
 
 :::sumo Micro Lesson: Introduction to Mobot
-This short video introduces Mobot (formerly known as *Copilot*) and how it can help you with log search and analysis—perfect for getting a quick overview before diving in.
+This short video introduces Mobot and how it can help you with log search and analysis—perfect for getting a quick overview before diving in.
 
 <Iframe url="https://fast.wistia.net/embed/iframe/o9uftxw012?web_component=true&seo=true&videoFoam=false"
   width="854px"
@@ -55,6 +51,26 @@ Mobot accelerates incident response by combining prebuilt contextual insights wi
 * **Log compatibility**. Mobot supports structured logs, semi-structured logs (partial JSON), and unstructured logs (e.g., Palo Alto Firewall) when Field Extraction Rules (FERs) are applied. This ensures valuable insights across a variety of log formats.
 * **Enhanced query experience**. Auto-complete to streamline natural language queries.
 
+<!-- Intelliparse is still on hold - don't include that
+* **Multi-turn conversations**. Ask follow-up questions without repeating yourself.
+
+## Support for unstructured logs
+
+we support unstructured logs (raw, text-based logs that don't follow a structured format) without requiring Field Extraction Rules (FERs). This enhancement enables Mobot to analyze and derive insights from a broader range of log data using natural language, even if the logs aren't pre-parsed. If your logs are already visualized in dashboards, Mobot automatically parses them and delivers insights using natural language.
+
+This update builds on Mobot’s AI-assisted search capabilities and is available to all customers using the new Sumo Logic UI. 
+
+Mobot now supports unstructured logs, including raw text logs with no predefined fields or Field Extraction Rules (FERs). If these logs are already visualized in dashboards, Mobot automatically parses them and surfaces insights using natural language queries.
+
+This capability is powered by [Intelliparse mode (Beta)](/docs/search/get-started-with-search/build-search/intelliparse-beta), which infers structure from patterns already used in your dashboards. Behind the scenes, Mobot injects the `intelliparse` operator into queries to extract fields on the fly—no FER setup required.
+
+Here are some use cases:
+* Explore raw logs without defined fields
+* Triage errors and detect patterns
+* Investigate anomalies in security dashboards
+
+Mobot does not currently interpret all unstructured logs. It prioritizes those already visualized in dashboards to ensure the most relevant and accurate insights. Unlike structured logs, which contain clearly defined fields, unstructured logs require Mobot to infer structure at query time using AI and pattern recognition.  -->
+
 ## Security and compliance
 
 Sumo Logic Mobot leverages foundational models provided by Amazon Bedrock, inheriting their robust compliance and security posture. For detailed information, refer to the following Amazon Bedrock security and compliance resources:
@@ -83,7 +99,7 @@ Mobot is ideal for users of all skill levels:
 In this section, you'll learn the recommended workflow for using Mobot effectively, along with best practices to maximize its benefits.
 
 :::sumo Micro Lesson: Using Mobot
-See Mobot (formerly known as *Copilot*) in action with a hands-on walkthrough of the UI and prompt-based search.
+See Mobot in action with a hands-on walkthrough of the UI and prompt-based search.
 
 <Iframe url="https://fast.wistia.net/embed/iframe/t67ovt9hqj?web_component=true&seo=true&videoFoam=false"
   width="854px"
@@ -102,9 +118,9 @@ See Mobot (formerly known as *Copilot*) in action with a hands-on walkthrough of
 
 To start using Mobot:
 
-From the [**New UI**](/docs/get-started/sumo-logic-ui), click **Copilot** (or **Mobot**) in the left nav.
+From the [**New UI**](/docs/get-started/sumo-logic-ui), click **Mobot** in the left nav.
 
-From the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic), click the **Copilot** (or **Mobot**) tab.
+From the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic), click the **Mobot** tab.
 
 ### Step 2: Review and adjust the auto-selected source
 
@@ -350,6 +366,9 @@ Mobot is an AI assistant integrated into the Sumo Logic Log Analytics Platform.
 <summary>Can I use Mobot to analyze unstructured logs?</summary>
 
 Yes, Mobot can extract relevant insights from unstructured logs, provided Field Extraction Rules (FERs) are applied. It also supports semi-structured logs (JSON + unstructured payloads).
+
+<!-- get clarification - can Mobot parse raw logs without FERs? -->
+
 </details>
 
 <details>
