Skip to content
Merged
1 change: 1 addition & 0 deletions cid-redirects.json
Original file line number Diff line number Diff line change
Expand Up @@ -4527,6 +4527,7 @@
"/docs/search/logreduce/influence-the-logreduce-outcome": "/docs/search/behavior-insights/logreduce/influence-the-logreduce-outcome",
"/docs/search/logreduce/understand-the-logreduce-relevance-column": "/docs/search/behavior-insights/logreduce/understand-the-logreduce-relevance-column",
"/docs/search/behavior-insights/logreduce-values": "/docs/search/behavior-insights/logreduce/logreduce-values",
"/docs/search/copilot-unstructured-logs-beta": "/docs/search/mobot",
"/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/azure-event-hubs-cloud-to-cloud-source-migration":"/docs/send-data/collect-from-other-data-sources/azure-monitoring/azure-event-hubs-source-migration",
"/docs/manage/manage-subscription/upgrade-sumo-logic-credits-account": "/docs/manage/manage-subscription/upgrade-account/upgrade-sumo-logic-flex-account",
"/docs/manage/manage-subscription/upgrade-cloud-flex-legacy-account": "/docs/manage/manage-subscription/upgrade-account/upgrade-cloud-flex-legacy-account",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ To manage the query size limit follow the below steps:

:::info
Sumo Logic defines scan as two types:
- **Foreground interactive search**. Search page UI, Copilot, and Dashboards.
- **Foreground interactive search**. Search page UI, Mobot, and Dashboards.
- **Background search**. API, Scheduled Search, Monitor, Scheduled Views, and SLO.
:::

Expand Down
3 changes: 1 addition & 2 deletions docs/manage/manage-subscription/scan-budgets.md
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ To create the query size limit using the **Advanced** configuration:
- **Only allow background query scans**. A warning message will be displayed if you run a query that exceeds the budget set. This will block the foreground searches but will not impact any background searches/automated queries.
:::info
Sumo Logic defines scan as two types:
- **Foreground interactive search**. Search page UI, Copilot, and Dashboards.
- **Foreground interactive search**. Search page UI, Mobot, and Dashboards.
- **Background search**. API, Scheduled Search, Monitors, Scheduled Views, and SLO.
:::
1. **Details**. Enter the name for the scan budget.<br/><img src={useBaseUrl('/img/manage/account/create-scan-budget.png')} alt="create-scan-budget" style={{border:'1px solid gray'}} width="650"/>
Expand Down Expand Up @@ -108,4 +108,3 @@ Each budget type (daily, weekly, monthly, or query) is treated independently, wi
### Usage attribution across multiple budget types

As long as you are within the limits of each budget type, usage will be attributed independently to each budget type. If you exceed any one budget type, the action for that budget will be applied. But usage will still be reported to other budgets if they have available capacity. For example, if the daily limit and monthly limit is set to 100GB and 300GB respectively, and if you have used 50 GB of your daily limit, then this usage will be reported to both the daily and monthly budgets as long as they are within their capacity. The query budget only tracks the size in GB per query, so the user will still be within the query budget if the query size limit is not breached.

Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
---
id: intelliparse-beta
title: Intelliparse Mode (Beta)
description: Intelliparse mode extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON.
---

import useBaseUrl from '@docusaurus/useBaseUrl';

<head>
<meta name="robots" content="noindex" />
</head>

<p><a href="/docs/beta"><span className="beta">Beta</span></a></p>

This feature is currently available to select customers. Contact your Sumo Logic account representative to request access.

We've introduced a new Log Search parsing mode called Intelliparse. It extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON.

## Available parsing modes

You can now choose from three parsing options in the log search UI:

* **Intelliparse (new)**. Combines JSON parsing with automatic parsing of unstructured logs using pre-discovered parsers.
* **Auto Parse**. JSON blocks within logs are automatically parsed ([learn more](/docs/search/get-started-with-search/build-search/dynamic-parsing)).
* **Manual**. No automatic parsing applied.

<img src={useBaseUrl('img/search/get-started-search/build-search/log-search-parsing-modes.png')} alt="log-search-parsing-modes.png" style={{border: '1px solid gray'}} width="700"/>

## How Intelliparse mode works

When you enable Intelliparse mode:
* Logs are parsed using a set of parsers discovered from your recently used dashboards.
* Fields are extracted automatically from both structured and unstructured logs.
* A hidden operator is applied to your query to power this functionality behind the scenes.

## Benefits

* **No Field Extraction Rules (FERs) required**. Get field-level insights without manual parsing.
* **Works with your existing dashboards**. Parsers are derived from log panels in recently viewed or edited dashboards.
* **Improved field visibility**. Fields parsed through Intelliparse mode appear in the Messages tab and can be used in queries, filters, and dashboards.

## Example

If your dashboard includes a query like:

```sql
_sourceCategory=cassandra "Dropped table"
| parse "table '*' from database '*'" as db.table, db.name
```

Then any matching unstructured logs like:

`2025-04-09 11:20:25 * Dropped table 'logins' from database 'auth'`

will be parsed automatically in Intelliparse mode, extracting:

* `db.table = "logins"`
* `db.name = "auth"`

:::info
* Parsers are discovered automatically from dashboard content. No manual setup needed.
* If a dashboard is modified, the associated parser will update. Deleted dashboards do not currently delete parsers.
* Queries using Intelliparse mode include a hidden intelliparse operator, injected automatically.
:::

## How Mobot uses Intelliparse mode

Even if you don’t manually enable Intelliparse mode, you may encounter it when using [Sumo Logic Mobot](/docs/search/mobot).

Mobot uses Intelliparse mode in the background to:
* Automatically parse unstructured logs for natural language queries.
* Discover field names and values for more accurate suggestions and translations.
* Generate search queries that include the hidden `intelliparse` operator.

This integration allows Mobot to work with raw, unstructured log data; no setup required on your part.

:::tip
Want to learn more about Intelliparse mode? [See how it works in Log Search](/docs/search/mobot/#support-for-unstructured-logs).
:::
35 changes: 27 additions & 8 deletions docs/search/mobot.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,6 @@ keywords:
import Iframe from 'react-iframe';
import useBaseUrl from '@docusaurus/useBaseUrl';

:::note Name update
We are renaming *Copilot* to *Mobot* across the product and docs. During this transition, some UI labels and screenshots may still show **Copilot**. Functionality is the same. We will update names and images as the rollout completes.
:::

Sumo Logic Mobot (formerly known as *Copilot*) is our AI-powered assistant that accelerates investigations and troubleshooting in logs by allowing you to ask questions in plain English and get contextual suggestions, helping first responders get to answers faster.

With its intuitive interface, Mobot automatically generates log searches from natural language queries, helping you quickly investigate performance issues, anomalies, and security threats. It also guides you through investigations step-by-step with AI-derived suggestions to refine your results for faster, more accurate resolutions. Overall, Mobot enhances incident resolution with expert level insights.
Expand All @@ -28,7 +24,7 @@ If you prefer not to use Mobot, you can opt out by contacting [Support](https://
:::

:::sumo Micro Lesson: Introduction to Mobot
This short video introduces Mobot (formerly known as *Copilot*) and how it can help you with log search and analysis—perfect for getting a quick overview before diving in.
This short video introduces Mobot and how it can help you with log search and analysis—perfect for getting a quick overview before diving in.

<Iframe url="https://fast.wistia.net/embed/iframe/o9uftxw012?web_component=true&seo=true&videoFoam=false"
width="854px"
Expand All @@ -55,6 +51,26 @@ Mobot accelerates incident response by combining prebuilt contextual insights wi
* **Log compatibility**. Mobot supports structured logs, semi-structured logs (partial JSON), and unstructured logs (e.g., Palo Alto Firewall) when Field Extraction Rules (FERs) are applied. This ensures valuable insights across a variety of log formats.
* **Enhanced query experience**. Auto-complete to streamline natural language queries.

<!-- Intelliparse is still on hold - don't include that
* **Multi-turn conversations**. Ask follow-up questions without repeating yourself.

## Support for unstructured logs

we support unstructured logs (raw, text-based logs that don't follow a structured format) without requiring Field Extraction Rules (FERs). This enhancement enables Mobot to analyze and derive insights from a broader range of log data using natural language, even if the logs aren't pre-parsed. If your logs are already visualized in dashboards, Mobot automatically parses them and delivers insights using natural language.

This update builds on Mobot’s AI-assisted search capabilities and is available to all customers using the new Sumo Logic UI.

Mobot now supports unstructured logs, including raw text logs with no predefined fields or Field Extraction Rules (FERs). If these logs are already visualized in dashboards, Mobot automatically parses them and surfaces insights using natural language queries.

This capability is powered by [Intelliparse mode (Beta)](/docs/search/get-started-with-search/build-search/intelliparse-beta), which infers structure from patterns already used in your dashboards. Behind the scenes, Mobot injects the `intelliparse` operator into queries to extract fields on the fly—no FER setup required.

Here are some use cases:
* Explore raw logs without defined fields
* Triage errors and detect patterns
* Investigate anomalies in security dashboards

Mobot does not currently interpret all unstructured logs. It prioritizes those already visualized in dashboards to ensure the most relevant and accurate insights. Unlike structured logs, which contain clearly defined fields, unstructured logs require Mobot to infer structure at query time using AI and pattern recognition. -->

## Security and compliance

Sumo Logic Mobot leverages foundational models provided by Amazon Bedrock, inheriting their robust compliance and security posture. For detailed information, refer to the following Amazon Bedrock security and compliance resources:
Expand Down Expand Up @@ -83,7 +99,7 @@ Mobot is ideal for users of all skill levels:
In this section, you'll learn the recommended workflow for using Mobot effectively, along with best practices to maximize its benefits.

:::sumo Micro Lesson: Using Mobot
See Mobot (formerly known as *Copilot*) in action with a hands-on walkthrough of the UI and prompt-based search.
See Mobot in action with a hands-on walkthrough of the UI and prompt-based search.

<Iframe url="https://fast.wistia.net/embed/iframe/t67ovt9hqj?web_component=true&seo=true&videoFoam=false"
width="854px"
Expand All @@ -102,9 +118,9 @@ See Mobot (formerly known as *Copilot*) in action with a hands-on walkthrough of

To start using Mobot:

From the [**New UI**](/docs/get-started/sumo-logic-ui), click **Copilot** (or **Mobot**) in the left nav.
From the [**New UI**](/docs/get-started/sumo-logic-ui), click **Mobot** in the left nav.

From the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic), click the **Copilot** (or **Mobot**) tab.
From the [**Classic UI**](/docs/get-started/sumo-logic-ui-classic), click the **Mobot** tab.

### Step 2: Review and adjust the auto-selected source

Expand Down Expand Up @@ -350,6 +366,9 @@ Mobot is an AI assistant integrated into the Sumo Logic Log Analytics Platform.
<summary>Can I use Mobot to analyze unstructured logs?</summary>

Yes, Mobot can extract relevant insights from unstructured logs, provided Field Extraction Rules (FERs) are applied. It also supports semi-structured logs (JSON + unstructured payloads).

<!-- get clarification - can Mobot parse raw logs without FERs? -->

</details>

<details>
Expand Down