You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copilot now supports multi-turn conversations, allowing you to ask follow-up questions without repeating your original search context. This enhancement enables more natural, iterative investigations. Copilot keeps track of your query history so you can refine searches, dig deeper into results, and troubleshoot faster.
14
+
15
+
This feature is available in the new Sumo Logic UI for all users with Copilot access. [Learn more](/docs/search/copilot/).
title: Sumo Logic Copilot - Unstructured Logs Support (Beta)
4
+
description: Streamline your log analysis with Sumo Logic Copilot, our AI-based assistant that simplifies log analysis by letting you ask questions in plain English, even for logs without a well-defined structure.
This feature is in Beta. For more information, contact your Sumo Logic account executive.
16
+
17
+
Unstructured Logs Support for [Sumo Logic Copilot](/docs/search/copilot), our AI assistant, enables it to understand and provide insights from raw, text-based logs, even if they don't follow a structured format like JSON. This means you can ask questions in plain English and get meaningful results from nearly any log data, without requiring Field Extraction Rules (FERs).
18
+
19
+
## What's new
20
+
21
+
Currently, [Copilot works best on structured (JSON) logs](/docs/search/copilot/#compatible-log-formats). With this beta update, Copilot automatically applies parsing logic to unstructured logs, even if no FERs are configured.
22
+
23
+
At this stage, Copilot prioritizes unstructured logs that are already used in dashboards, allowing it to surface insights from high-value log sources out-of-the-box. This means it won’t interpret all raw logs yet, but we’re actively working to broaden this support beyond dashboards.
24
+
25
+
***Broader coverage**. Copilot now parses and generates insights from unstructured log formats, even without FERs, making it useful for environments that include custom or inconsistent log types.
26
+
***Improved usability**. Ask questions in natural language. Copilot interprets your intent and suggests relevant searches, even for raw, non-JSON logs.
27
+
***Performance and reliability**. Response times and suggestion accuracy are consistent with Copilot’s structured log experience.
28
+
***Security and compliance**. The same strict data handling and privacy standards apply. Unstructured Logs Support builds on Copilot’s secure foundation.
29
+
30
+
<!---No need to call it out until GA
31
+
### Powered by Intelliparse mode
32
+
Unstructured Logs Support is powered by [Intelliparse mode (Beta)](/docs/search/get-started-with-search/build-search/intelliparse-beta), a new parsing engine that automatically extracts fields from raw logs based on patterns already used in your dashboards. This eliminates the need for manual Field Extraction Rules (FERs) and allows Copilot to surface insights from unstructured logs out-of-the-box. Behind the scenes, Copilot injects a hidden `intelliparse` operator into relevant queries to make unstructured logs easier to work with.
33
+
-->
34
+
35
+
### Common use cases
36
+
37
+
***General log exploration**. Ask questions about unstructured logs that are already used in your dashboards, even if they lack predefined fields.
38
+
***Error triage**. Investigate frequently visualized log data to surface patterns and recurring issues in unstructured formats.
39
+
***Security insights**. Detect anomalies or signs of failed logins by querying raw logs already powering security dashboards.
40
+
***Smarter prioritization**. Copilot focuses on unstructured logs that are visualized in dashboards, helping you get meaningful insights from high-value data sources.
41
+
42
+
## FAQ
43
+
44
+
**Will Copilot interpret all my logs?**<br/>
45
+
Copilot prioritizes unstructured logs that are already used in dashboards. This improves the relevance of insights and helps focus on high-value logs.
46
+
47
+
**How is this different from structured log support?**<br/>
48
+
Structured logs have predefined fields, allowing Copilot to map queries directly. For unstructured logs, Copilot uses AI and parsing techniques to infer structure on the fly.
***Enhanced query experience**. Auto-complete to streamline natural language queries.
52
52
***Multi-turn conversations**. Ask follow-up questions without repeating yourself.
53
53
54
-
## Support for unstructured logs
55
-
56
-
Copilot now supports unstructured logs, including raw text logs with no predefined fields or Field Extraction Rules (FERs). If these logs are already visualized in dashboards, Copilot automatically parses them and surfaces insights using natural language queries.
57
-
58
-
This capability is powered by [Intelliparse mode (Beta)](/docs/search/get-started-with-search/build-search/intelliparse-beta), which infers structure from patterns already used in your dashboards. Behind the scenes, Copilot injects the `intelliparse` operator into queries to extract fields on the fly—no FER setup required.
59
-
60
-
Here are some use cases:
61
-
* Explore raw logs without defined fields
62
-
* Triage errors and detect patterns
63
-
* Investigate anomalies in security dashboards
64
-
65
-
Copilot does not currently interpret all unstructured logs. It prioritizes those already visualized in dashboards to ensure the most relevant and accurate insights. Unlike structured logs, which contain clearly defined fields, unstructured logs require Copilot to infer structure at query time using AI and pattern recognition.
66
-
67
54
## Security and compliance
68
55
69
56
Sumo Logic Copilot leverages foundational models provided by Amazon Bedrock, inheriting their robust compliance and security posture. For detailed information, refer to the following Amazon Bedrock security and compliance resources:
@@ -225,8 +212,7 @@ To save space, you can use the **Hide Log Query** icon to collapse the log query
225
212
226
213
#### Compatible Log Formats
227
214
228
-
***Supported**. JSON, partial JSON, unstructured logs (with or without FERs).
229
-
***Not supported**. Metrics or trace telemetry.
215
+
Copilot querying is compatible with JSON logs, partial JSON logs, and unstructured logs with Field Extraction Rules. It cannot be used to query metrics or trace telemetry.
230
216
231
217
To retrieve a list of `_sourceCategories` with JSON data, use the following query:
232
218
@@ -357,7 +343,7 @@ Sumo Logic Copilot (also referred to as Sumo Logic Mo Copilot) is an AI assistan
357
343
<details>
358
344
<summary>Can I use Copilot to analyze unstructured logs?</summary>
359
345
360
-
Yes. Copilot can parse raw logs without FERs. It also supports semi-structured logs (JSON + unstructured payloads).
346
+
Yes, Copilot can extract relevant insights from unstructured logs, provided Field Extraction Rules (FERs) are applied. It also supports semi-structured logs (JSON + unstructured payloads).
361
347
</details>
362
348
363
349
<details>
@@ -434,6 +420,7 @@ Each major capability added to Copilot undergoes legal, compliance, and applicat
434
420
If you prefer not to use Sumo Logic Copilot, please contact our [support team](https://support.sumologic.com/support/s/). Your account will be updated accordingly.
435
421
</details>
436
422
423
+
437
424
## Feedback
438
425
439
426
We want your feedback! Let us know what you think by clicking the thumbs up or thumbs down icon and entering the context of your query.
0 commit comments