-
Notifications
You must be signed in to change notification settings - Fork 228
Intelliparse Log Search mode (beta) #5290
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit
Hold shift + click to select a range
96a1702
Intelliparse Log Search mode (beta)
kimsauce 721306b
Merge branch 'main' into DOCS-832
kimsauce f762e03
Merge branch 'main' into DOCS-832
kimsauce 2f37215
Update docs/search/get-started-with-search/build-search/intelliparse.md
kimsauce bad84c2
Update docs/search/get-started-with-search/build-search/intelliparse.md
kimsauce bcfb923
Merge branch 'DOCS-832' of github.com:SumoLogic/sumologic-documentati…
kimsauce 688cef6
Intelliparse - Beta rm release note
kimsauce File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| --- | ||
| title: Intelliparse - Beta (Search) | ||
| image: https://help.sumologic.com/img/sumo-square.png | ||
| keywords: | ||
| - log-search | ||
| - search | ||
| - copilot | ||
| hide_table_of_contents: true | ||
| --- | ||
|
|
||
| We’ve introduced a new Log Search parsing mode called Intelliparse mode, which extends automatic parsing to unstructured logs. | ||
|
|
||
| Highlights: | ||
|
|
||
| * Automatically parses unstructured log messages using parsers discovered from your existing dashboards | ||
| * Extracted fields are available in search queries, filters, dashboards, and alerts | ||
| * No need for Field Extraction Rules (FERs) or manual parsing logic | ||
| * Powers [Copilot](/docs/search/copilot)'s ability to understand and generate insights from raw, unstructured log data | ||
|
|
||
| To try it out, contact your Sumo Logic account team to request beta access. [Learn more](/docs/search/get-started-with-search/build-search/intelliparse). |
82 changes: 82 additions & 0 deletions
82
docs/search/get-started-with-search/build-search/intelliparse.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| --- | ||
| id: intelliparse | ||
| title: Intelliparse Mode (Beta) | ||
| description: Intelliparse mode extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON. | ||
| --- | ||
|
|
||
| import useBaseUrl from '@docusaurus/useBaseUrl'; | ||
|
|
||
| <head> | ||
| <meta name="robots" content="noindex" /> | ||
| </head> | ||
|
|
||
| <p><a href="/docs/beta"><span className="beta">Beta</span></a></p> | ||
|
|
||
| This feature is currently available to select customers. Contact your Sumo Logic account representative to request access. | ||
|
|
||
| We've introduced a new parsing mode in the Log Search UI: Intelliparse mode. It extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON. | ||
|
|
||
| <!-- link to Copilot unstructured logs doc --> | ||
|
|
||
| ## Available parsing modes | ||
|
|
||
| You can now choose from three parsing options in the log search UI: | ||
|
|
||
| * **Intelliparse (new)**. Combines JSON parsing with automatic parsing of unstructured logs using pre-discovered parsers. | ||
| * [**Auto Parse**](/docs/search/get-started-with-search/build-search/dynamic-parsing). JSON blocks within logs are automatically parsed. | ||
| * **Manual**. No automatic parsing applied. | ||
|
|
||
| <img src={useBaseUrl('img/search/get-started-search/build-search/log-search-parsing-modes.png')} alt="log-search-parsing-modes.png" width="700"/> | ||
|
|
||
| ## How Intelliparse mode works | ||
|
|
||
| When you enable Intelliparse mode: | ||
| * Logs are parsed using a set of parsers discovered from your recently used dashboards. | ||
| * Fields are extracted automatically from both structured and unstructured logs. | ||
| * A hidden operator is applied to your query to power this functionality behind the scenes. | ||
|
|
||
| ## Benefits | ||
|
|
||
| * **No Field Extraction Rules (FERs) required**. Get field-level insights without manual parsing. | ||
| * **Works with your existing dashboards**. Parsers are derived from log panels in recently viewed or edited dashboards. | ||
| * **Improved field visibility**. Fields parsed through Intelliparse mode appear in the Messages tab and can be used in queries, filters, and dashboards. | ||
|
|
||
| ## Example | ||
|
|
||
| If your dashboard includes a query like: | ||
|
|
||
| ```sql | ||
| _sourceCategory=cassandra "Dropped table" | ||
| | parse "table '*' from database '*'" as db.table, db.name | ||
| ``` | ||
|
|
||
| Then any matching unstructured logs like: | ||
|
|
||
| `2025-04-09 11:20:25 * Dropped table 'logins' from database 'auth'` | ||
|
|
||
| will be parsed automatically in Intelliparse mode, extracting: | ||
|
|
||
| * `db.table = "logins"` | ||
| * `db.name = "auth"` | ||
|
|
||
| :::info | ||
| * Parsers are discovered automatically from dashboard content. No manual setup needed. | ||
| * If a dashboard is modified, the associated parser will update. Deleted dashboards do not currently delete parsers. | ||
| * Queries using Intelliparse mode include a hidden intelliparse operator, injected automatically. | ||
| ::: | ||
|
|
||
| ## How Copilot uses Intelliparse mode | ||
|
|
||
| Even if you don’t manually enable Intelliparse mode, you may encounter it when using [Sumo Logic Copilot](/docs/search/copilot). | ||
|
|
||
| Copilot uses Intelliparse mode in the background to: | ||
| * Automatically parse unstructured logs for natural language queries | ||
| * Discover field names and values for more accurate suggestions and translations | ||
| * Generate search queries that include the hidden `intelliparse` operator | ||
kimsauce marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| This integration allows Copilot to work with raw, unstructured log data; no setup required on your part. | ||
|
|
||
| <!-- When Copilot - Unstructured Logs (Beta) doc has been published, crosslink from there... | ||
| Want to learn more about Intelliparse mode? See how it works in Log Search | ||
| https://sumologic.atlassian.net/browse/DOCS-752 | ||
| ---> | ||
Binary file added
BIN
+75.4 KB
static/img/search/get-started-search/build-search/log-search-parsing-modes.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.