Skip to content

Commit 47e056e

Browse files
committed
updates per CP
1 parent d24d9e6 commit 47e056e

File tree

1 file changed

+11
-46
lines changed

1 file changed

+11
-46
lines changed

docs/search/copilot-unstructured-logs.md

Lines changed: 11 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -13,54 +13,35 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
1313

1414
<p><a href="/docs/beta"><span className="beta">Beta</span></a></p>
1515

16-
This feature is in Beta. To participate, contact your Sumo Logic account executive or [enroll here](https://forms.gle/LozrrAppM9FM94tS9).
16+
This feature is in Beta. For more information, contact your Sumo Logic account executive.
1717

1818
Unstructured Logs Support for [Sumo Logic Copilot](/docs/search/copilot), our AI assistant, enables it to understand and provide insights from raw, text-based logs, even if they don't follow a structured format like JSON. This means you can ask questions in plain English and get meaningful results from nearly any log data, without requiring Field Extraction Rules (FERs).
1919

2020
## What's new
2121

2222
Currently, [Copilot works best on structured (JSON) logs](/docs/search/copilot/#compatible-log-formats). With this beta update, Copilot automatically applies parsing logic to unstructured logs, even if no FERs are configured. This allows Copilot to interpret logs from many popular data sources out-of-the-box and enables support for a broader range of log types.
2323

24-
Copilot learns from usage patterns; if a log source is already used in dashboards or commonly queried, it’s more likely to produce accurate, actionable results.
25-
2624
* **Broader coverage**. Copilot now parses and generates insights from unstructured log formats, even without FERs, making it useful for environments that include custom or inconsistent log types.
2725
* **Improved usability**. Ask questions in natural language. Copilot interprets your intent and suggests relevant searches, even for raw, non-JSON logs.
2826
* **Performance and reliability**. Response times and suggestion accuracy are consistent with Copilot’s structured log experience.
2927
* **Security and compliance**. The same strict data handling and privacy standards apply. Unstructured Logs Support builds on Copilot’s secure foundation.
3028

31-
<!---
32-
### Powered by Intelliparse mode
29+
<!-- Publish after https://sumologic.atlassian.net/browse/DOCS-832
3330
34-
Behind the scenes, Copilot now uses [Intelliparse Mode](/docs/search/get-started-with-search/build-search/intelliparse) to automatically extract fields from unstructured logs. This new parsing engine discovers and applies parsing logic based on your existing dashboards—allowing Copilot to work with logs that don’t follow a consistent format.
31+
### Powered by Intelliparse mode
3532
36-
You’ll see more meaningful results from raw logs without needing to create Field Extraction Rules (FERs) or define parsing logic manually.
33+
Copilot now uses [Intelliparse Mode](/docs/search/get-started-with-search/build-search/intelliparse) to extract fields from unstructured logs. This new parsing engine automatically applies parsing logic based on logs already used in your dashboards, allowing Copilot to work with raw logs that don’t follow a consistent format.
3734
38-
Copilot uses a hidden operator called `intelliparse`, which is automatically injected into queries when needed. You won't see it in the UI, but it’s what powers field extraction in unstructured logs.
35+
You’ll get more meaningful results from logs that are already powering visualizations and queries without needing to manually define parsing logic or create Field Extraction Rules (FERs).
3936
40-
Example, let’s say you ask Copilot: `Show me the top failed login attempts from nginx logs.`
41-
42-
If your nginx logs are unstructured, Copilot will:
43-
1. Identify relevant parsers from your dashboards
44-
2. Use the hidden `intelliparse` operator to apply those parsers
45-
3. Extract fields like `status`, `username`, or `ip_address`
46-
4. Return insights based on those parsed fields
47-
-->
37+
Copilot uses a hidden `intelliparse` operator behind the scenes. It’s injected into relevant queries to extract fields, making unstructured logs easier to work with—no UI changes required.-->
4838

4939
### Common use cases
5040

51-
* **Keyword-based search**. Search for IP addresses, error codes, or other patterns without needing a predefined schema.
52-
* **Error triage**. Quickly identify the most common error messages in raw logs to speed up troubleshooting.
53-
* **Threat hunting**. Detect suspicious activity, failed logins, or unusual patterns in plain-text logs.
54-
* **Smarter prioritization**. Frequently used data sources (such as those in dashboards or frequent queries) are prioritized for deeper insights.
55-
56-
## Tips and best practices
57-
58-
* Start with common natural language queries, like:
59-
- “Show failed login attempts for the past 24 hours”
60-
- “Find logs with IP 192.0.2.0”
61-
- “What are the top 5 errors from nginx logs today?”
62-
* Use dashboards to monitor your log sources. Copilot performs better when logs are part of existing queries and visualizations.
63-
* Logs with consistent formats, clear timestamps, and standard separators (like commas or tabs) yield better results.
41+
* **General log exploration**. Ask questions about logs used in your dashboards—even if they don’t have predefined structure.
42+
* **Error triage**. Identify frequent errors in raw logs that already support visualizations in your environment.
43+
* **Security insights**. Surface signs of failed logins or anomalies from frequently queried log sources.
44+
* **Smarter prioritization**. Copilot focuses on unstructured logs that are already actively used, helping maximize relevance and value.
6445

6546
## Related updates
6647

@@ -72,29 +53,13 @@ These recent Copilot enhancements make it even easier to work with unstructured
7253

7354
## FAQ
7455

75-
**Does this replace Field Extraction Rules (FERs)?**<br/>
76-
No. Copilot works with or without FERs. While FERs are useful for structured analysis, they're no longer required for Copilot to interpret unstructured logs.
77-
7856
**Will Copilot interpret all my logs?**<br/>
7957
Copilot prioritizes data sources that are already used in dashboards or frequent queries. This improves the relevance of insights and helps focus on high-value logs.
8058

8159
**How is this different from structured log support?**<br/>
8260
Structured logs have predefined fields, allowing Copilot to map queries directly. For unstructured logs, Copilot uses AI and parsing techniques to infer structure on the fly.
8361

84-
<!--
62+
<!-- Publish after https://sumologic.atlassian.net/browse/DOCS-832
8563
**How is Copilot able to understand unstructured logs?**<br/>
8664
Copilot uses a new parsing engine called [Intelliparse mode](/docs/search/get-started-with-search/build-search/intelliparse). It automatically extracts fields from raw logs using parsers discovered from your dashboards, so you don’t have to define parsing logic or FERs manually.
87-
https://sumologic.atlassian.net/browse/DOCS-752
8865
-->
89-
90-
## Feedback and support
91-
92-
We’re actively looking for customers to participate in the beta and provide feedback. Ideal participants:
93-
94-
* Use dashboards for monitoring across most of their data sources
95-
* Have some hands-on experience with Copilot
96-
* Are willing to provide detailed feedback during the beta
97-
98-
👉 [Click here to enroll](https://forms.gle/LozrrAppM9FM94tS9)
99-
100-
To report issues or share feedback, reach out through your Sumo Logic account team.

0 commit comments

Comments
 (0)