|
| 1 | +--- |
| 2 | +id: intelliparse |
| 3 | +title: Intelliparse Mode (Beta) |
| 4 | +description: Intelliparse mode extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON. |
| 5 | +--- |
| 6 | + |
| 7 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 8 | + |
| 9 | +<head> |
| 10 | + <meta name="robots" content="noindex" /> |
| 11 | +</head> |
| 12 | + |
| 13 | +<p><a href="/docs/beta"><span className="beta">Beta</span></a></p> |
| 14 | + |
| 15 | +This feature is currently available to select customers. Contact your Sumo Logic account representative to request access. |
| 16 | + |
| 17 | +We've introduced a new parsing mode in the Log Search UI: Intelliparse mode. It extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON. |
| 18 | + |
| 19 | +<!-- link to Copilot unstructured logs doc --> |
| 20 | + |
| 21 | +## Available parsing modes |
| 22 | + |
| 23 | +You can now choose from three parsing options in the log search UI: |
| 24 | + |
| 25 | +* **Intelliparse (new)**. Combines JSON parsing with automatic parsing of unstructured logs using pre-discovered parsers. |
| 26 | +* [**Auto Parse**](/docs/search/get-started-with-search/build-search/dynamic-parsing). JSON blocks within logs are automatically parsed. |
| 27 | +* **Manual**. No automatic parsing applied. |
| 28 | + |
| 29 | +<img src={useBaseUrl('img/search/get-started-search/build-search/log-search-parsing-modes.png')} alt="log-search-parsing-modes.png" style={{border: '1px solid gray'}} width="700"/> |
| 30 | + |
| 31 | +## How Intelliparse mode works |
| 32 | + |
| 33 | +When you enable Intelliparse mode: |
| 34 | +* Logs are parsed using a set of parsers discovered from your recently used dashboards. |
| 35 | +* Fields are extracted automatically from both structured and unstructured logs. |
| 36 | +* A hidden operator is applied to your query to power this functionality behind the scenes. |
| 37 | + |
| 38 | +## Benefits |
| 39 | + |
| 40 | +* **No Field Extraction Rules (FERs) required**. Get field-level insights without manual parsing. |
| 41 | +* **Works with your existing dashboards**. Parsers are derived from log panels in recently viewed or edited dashboards. |
| 42 | +* **Improved field visibility**. Fields parsed through Intelliparse mode appear in the Messages tab and can be used in queries, filters, and dashboards. |
| 43 | + |
| 44 | +## Example |
| 45 | + |
| 46 | +If your dashboard includes a query like: |
| 47 | + |
| 48 | +```sql |
| 49 | +_sourceCategory=cassandra "Dropped table" |
| 50 | +| parse "table '*' from database '*'" as db.table, db.name |
| 51 | +``` |
| 52 | + |
| 53 | +Then any matching unstructured logs like: |
| 54 | + |
| 55 | +`2025-04-09 11:20:25 * Dropped table 'logins' from database 'auth'` |
| 56 | + |
| 57 | +will be parsed automatically in Intelliparse mode, extracting: |
| 58 | + |
| 59 | +* `db.table = "logins"` |
| 60 | +* `db.name = "auth"` |
| 61 | + |
| 62 | +:::info |
| 63 | +* Parsers are discovered automatically from dashboard content. No manual setup needed. |
| 64 | +* If a dashboard is modified, the associated parser will update. Deleted dashboards do not currently delete parsers. |
| 65 | +* Queries using Intelliparse mode include a hidden intelliparse operator, injected automatically. |
| 66 | +::: |
| 67 | + |
| 68 | +## How Copilot uses Intelliparse mode |
| 69 | + |
| 70 | +Even if you don’t manually enable Intelliparse mode, you may encounter it when using [Sumo Logic Copilot](/docs/search/copilot). |
| 71 | + |
| 72 | +Copilot uses Intelliparse mode in the background to: |
| 73 | +* Automatically parse unstructured logs for natural language queries. |
| 74 | +* Discover field names and values for more accurate suggestions and translations. |
| 75 | +* Generate search queries that include the hidden `intelliparse` operator. |
| 76 | + |
| 77 | +This integration allows Copilot to work with raw, unstructured log data; no setup required on your part. |
| 78 | + |
| 79 | +<!-- When Copilot - Unstructured Logs (Beta) doc has been published, crosslink from there... |
| 80 | +Want to learn more about Intelliparse mode? See how it works in Log Search |
| 81 | +https://sumologic.atlassian.net/browse/DOCS-752 |
| 82 | +---> |
0 commit comments