You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This feature is in Beta. To participate, contact your Sumo Logic account executive or [enroll here](https://forms.gle/LozrrAppM9FM94tS9).
16
+
This feature is in Beta. For more information, contact your Sumo Logic account executive.
17
17
18
18
Unstructured Logs Support for [Sumo Logic Copilot](/docs/search/copilot), our AI assistant, enables it to understand and provide insights from raw, text-based logs, even if they don't follow a structured format like JSON. This means you can ask questions in plain English and get meaningful results from nearly any log data, without requiring Field Extraction Rules (FERs).
19
19
20
20
## What's new
21
21
22
22
Currently, [Copilot works best on structured (JSON) logs](/docs/search/copilot/#compatible-log-formats). With this beta update, Copilot automatically applies parsing logic to unstructured logs, even if no FERs are configured. This allows Copilot to interpret logs from many popular data sources out-of-the-box and enables support for a broader range of log types.
23
23
24
-
Copilot learns from usage patterns; if a log source is already used in dashboards or commonly queried, it’s more likely to produce accurate, actionable results.
25
-
26
24
***Broader coverage**. Copilot now parses and generates insights from unstructured log formats, even without FERs, making it useful for environments that include custom or inconsistent log types.
27
25
***Improved usability**. Ask questions in natural language. Copilot interprets your intent and suggests relevant searches, even for raw, non-JSON logs.
28
26
***Performance and reliability**. Response times and suggestion accuracy are consistent with Copilot’s structured log experience.
29
27
***Security and compliance**. The same strict data handling and privacy standards apply. Unstructured Logs Support builds on Copilot’s secure foundation.
30
28
31
-
<!---
32
-
### Powered by Intelliparse mode
29
+
<!-- Publish after https://sumologic.atlassian.net/browse/DOCS-832
33
30
34
-
Behind the scenes, Copilot now uses [Intelliparse Mode](/docs/search/get-started-with-search/build-search/intelliparse) to automatically extract fields from unstructured logs. This new parsing engine discovers and applies parsing logic based on your existing dashboards—allowing Copilot to work with logs that don’t follow a consistent format.
31
+
### Powered by Intelliparse mode
35
32
36
-
You’ll see more meaningful results from raw logs without needing to create Field Extraction Rules (FERs) or define parsing logic manually.
33
+
Copilot now uses [Intelliparse Mode](/docs/search/get-started-with-search/build-search/intelliparse) to extract fields from unstructured logs. This new parsing engine automatically applies parsing logic based on logs already used in your dashboards, allowing Copilot to work with raw logs that don’t follow a consistent format.
37
34
38
-
Copilot uses a hidden operator called `intelliparse`, which is automatically injected into queries when needed. You won't see it in the UI, but it’s what powers field extraction in unstructured logs.
35
+
You’ll get more meaningful results from logs that are already powering visualizations and queries without needing to manually define parsing logic or create Field Extraction Rules (FERs).
39
36
40
-
Example, let’s say you ask Copilot: `Show me the top failed login attempts from nginx logs.`
41
-
42
-
If your nginx logs are unstructured, Copilot will:
43
-
1. Identify relevant parsers from your dashboards
44
-
2. Use the hidden `intelliparse` operator to apply those parsers
45
-
3. Extract fields like `status`, `username`, or `ip_address`
46
-
4. Return insights based on those parsed fields
47
-
-->
37
+
Copilot uses a hidden `intelliparse` operator behind the scenes. It’s injected into relevant queries to extract fields, making unstructured logs easier to work with—no UI changes required.-->
48
38
49
39
### Common use cases
50
40
51
-
***Keyword-based search**. Search for IP addresses, error codes, or other patterns without needing a predefined schema.
52
-
***Error triage**. Quickly identify the most common error messages in raw logs to speed up troubleshooting.
53
-
***Threat hunting**. Detect suspicious activity, failed logins, or unusual patterns in plain-text logs.
54
-
***Smarter prioritization**. Frequently used data sources (such as those in dashboards or frequent queries) are prioritized for deeper insights.
55
-
56
-
## Tips and best practices
57
-
58
-
* Start with common natural language queries, like:
59
-
- “Show failed login attempts for the past 24 hours”
60
-
- “Find logs with IP 192.0.2.0”
61
-
- “What are the top 5 errors from nginx logs today?”
62
-
* Use dashboards to monitor your log sources. Copilot performs better when logs are part of existing queries and visualizations.
63
-
* Logs with consistent formats, clear timestamps, and standard separators (like commas or tabs) yield better results.
41
+
***General log exploration**. Ask questions about logs used in your dashboards—even if they don’t have predefined structure.
42
+
***Error triage**. Identify frequent errors in raw logs that already support visualizations in your environment.
43
+
***Security insights**. Surface signs of failed logins or anomalies from frequently queried log sources.
44
+
***Smarter prioritization**. Copilot focuses on unstructured logs that are already actively used, helping maximize relevance and value.
64
45
65
46
## Related updates
66
47
@@ -72,29 +53,13 @@ These recent Copilot enhancements make it even easier to work with unstructured
72
53
73
54
## FAQ
74
55
75
-
**Does this replace Field Extraction Rules (FERs)?**<br/>
76
-
No. Copilot works with or without FERs. While FERs are useful for structured analysis, they're no longer required for Copilot to interpret unstructured logs.
77
-
78
56
**Will Copilot interpret all my logs?**<br/>
79
57
Copilot prioritizes data sources that are already used in dashboards or frequent queries. This improves the relevance of insights and helps focus on high-value logs.
80
58
81
59
**How is this different from structured log support?**<br/>
82
60
Structured logs have predefined fields, allowing Copilot to map queries directly. For unstructured logs, Copilot uses AI and parsing techniques to infer structure on the fly.
83
61
84
-
<!--
62
+
<!-- Publish after https://sumologic.atlassian.net/browse/DOCS-832
85
63
**How is Copilot able to understand unstructured logs?**<br/>
86
64
Copilot uses a new parsing engine called [Intelliparse mode](/docs/search/get-started-with-search/build-search/intelliparse). It automatically extracts fields from raw logs using parsers discovered from your dashboards, so you don’t have to define parsing logic or FERs manually.
87
-
https://sumologic.atlassian.net/browse/DOCS-752
88
65
-->
89
-
90
-
## Feedback and support
91
-
92
-
We’re actively looking for customers to participate in the beta and provide feedback. Ideal participants:
93
-
94
-
* Use dashboards for monitoring across most of their data sources
95
-
* Have some hands-on experience with Copilot
96
-
* Are willing to provide detailed feedback during the beta
97
-
98
-
👉 [Click here to enroll](https://forms.gle/LozrrAppM9FM94tS9)
99
-
100
-
To report issues or share feedback, reach out through your Sumo Logic account team.
0 commit comments