diff --git a/blog-service/2025-04-30-copilot.md b/blog-service/2025-04-30-copilot.md new file mode 100644 index 0000000000..952b488a69 --- /dev/null +++ b/blog-service/2025-04-30-copilot.md @@ -0,0 +1,17 @@ +--- +title: Now in Beta - Copilot Supports Unstructured Logs (Copilot) +image: https://help.sumologic.com/img/sumo-square.png +keywords: + - copilot + - log-search + - search +hide_table_of_contents: true +--- + +You can now use Copilot to analyze raw, unstructured log data, even if it’s not in JSON or lacks Field Extraction Rules (FERs). This Beta expands Copilot’s reach to custom, legacy, and inconsistent log formats with no setup required. + +* Ask questions in plain English—no schema or FERs needed. +* Works with raw logs like firewalls, syslog, and homegrown formats. +* Ideal for error triage, threat hunting, and exploratory analysis. + +[Learn more](/docs/search/copilot-unstructured-logs). diff --git a/docs/search/copilot-unstructured-logs.md b/docs/search/copilot-unstructured-logs.md new file mode 100644 index 0000000000..fbe69a2a12 --- /dev/null +++ b/docs/search/copilot-unstructured-logs.md @@ -0,0 +1,65 @@ +--- +id: copilot-unstructured-logs +title: Sumo Logic Copilot - Unstructured Logs Support (Beta) +description: Streamline your log analysis with Sumo Logic Copilot, our AI-based assistant that simplifies log analysis by letting you ask questions in plain English, even for logs without a well-defined structure. +--- + +import Iframe from 'react-iframe'; +import useBaseUrl from '@docusaurus/useBaseUrl'; + + + + + +

Beta

+ +This feature is in Beta. For more information, contact your Sumo Logic account executive. + +Unstructured Logs Support for [Sumo Logic Copilot](/docs/search/copilot), our AI assistant, enables it to understand and provide insights from raw, text-based logs, even if they don't follow a structured format like JSON. This means you can ask questions in plain English and get meaningful results from nearly any log data, without requiring Field Extraction Rules (FERs). + +## What's new + +Currently, [Copilot works best on structured (JSON) logs](/docs/search/copilot/#compatible-log-formats). With this beta update, Copilot automatically applies parsing logic to unstructured logs, even if no FERs are configured. This allows Copilot to interpret logs from many popular data sources out-of-the-box and enables support for a broader range of log types. + +* **Broader coverage**. Copilot now parses and generates insights from unstructured log formats, even without FERs, making it useful for environments that include custom or inconsistent log types. +* **Improved usability**. Ask questions in natural language. Copilot interprets your intent and suggests relevant searches, even for raw, non-JSON logs. +* **Performance and reliability**. Response times and suggestion accuracy are consistent with Copilot’s structured log experience. +* **Security and compliance**. The same strict data handling and privacy standards apply. Unstructured Logs Support builds on Copilot’s secure foundation. + + + +### Common use cases + +* **General log exploration**. Ask questions about logs used in your dashboards, even if they don’t have predefined structure. +* **Error triage**. Identify frequent errors in raw logs that already support visualizations in your environment. +* **Security insights**. Surface signs of failed logins or anomalies from frequently queried log sources. +* **Smarter prioritization**. Copilot focuses on unstructured logs that are already actively used, helping maximize relevance and value. + +## Related updates + +These recent Copilot enhancements make it even easier to work with unstructured logs: + +* **Dynamic conversation titles**. Your queries are automatically titled for easy organization and retrieval. +* **"Open in Copilot" for alerts**. Investigate alerts directly in Copilot without losing context. +* **Suggestion pinning**. Pin suggestions inside a conversation to revisit them later. + +## FAQ + +**Will Copilot interpret all my logs?**
+Copilot prioritizes unstructured logs that are already used in dashboards. This improves the relevance of insights and helps focus on high-value logs. + +**How is this different from structured log support?**
+Structured logs have predefined fields, allowing Copilot to map queries directly. For unstructured logs, Copilot uses AI and parsing techniques to infer structure on the fly. + + diff --git a/docs/search/copilot.md b/docs/search/copilot.md index c8b9d5e2c9..0d16f9fcf0 100644 --- a/docs/search/copilot.md +++ b/docs/search/copilot.md @@ -315,6 +315,24 @@ To summarize, you conclude there is malicious activity originating from certain Role Based Access Control is not supported for contextual suggestions and autocompletions. It is possible for a user who is blocked by [log search RBAC](/docs/manage/users-roles/roles/construct-search-filter-for-role/) to view suggestions or completions for unpermitted source expressions. However, they will not be executed by the search. +## Search behavior and data tier access + +Copilot follows the same search behavior as standard log search and respects your account’s data configuration, whether you're on classic tiered pricing or Flex pricing. + +### Flex pricing + +For customers on [Flex pricing](/docs/manage/partitions/flex), all data is stored in a single intelligent layer and pricing is based on the volume of data scanned. + +### Tiered pricing (legacy) + +If you're on [classic tiered pricing](/docs/manage/partitions/data-tiers/searching-data-tiers/), Copilot by default searches across continuous data tiers only, unless otherwise specified. + +To direct Copilot to search the Infrequent tier, for example, use: + +```sql +_dataTier=Infrequent +``` + ## FAQ
@@ -421,4 +439,4 @@ You can also leave feedback on specific errors. * [Designing Sumo Logic Mo Copilot for success](https://www.sumologic.com/blog/designing-mo-copilot-success/) * [Differentiating Sumo Logic Mo Copilot using Amazon Bedrock](https://www.sumologic.com/blog/copilot-amazon-bedrock/) * Brief: [Sumo Logic's Mo Copilot speeds up response](https://www.sumologic.com/brief/sumo-logics-mo-copilot-speeds-up-response/) -* Webinar: [Revolutionizing Incident Management with AI: Meet Mo Copilot](https://www.sumologic.com/webinar/revolutionizing-incident-management-with-ai-meet-mo-copilot/) \ No newline at end of file +* Webinar: [Revolutionizing Incident Management with AI: Meet Mo Copilot](https://www.sumologic.com/webinar/revolutionizing-incident-management-with-ai-meet-mo-copilot/)