diff --git a/docs/search/get-started-with-search/build-search/intelliparse.md b/docs/search/get-started-with-search/build-search/intelliparse.md new file mode 100644 index 0000000000..0ec11c017e --- /dev/null +++ b/docs/search/get-started-with-search/build-search/intelliparse.md @@ -0,0 +1,82 @@ +--- +id: intelliparse +title: Intelliparse Mode (Beta) +description: Intelliparse mode extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + + + + + +

Beta

+ +This feature is currently available to select customers. Contact your Sumo Logic account representative to request access. + +We've introduced a new parsing mode in the Log Search UI: Intelliparse mode. It extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON. + + + +## Available parsing modes + +You can now choose from three parsing options in the log search UI: + +* **Intelliparse (new)**. Combines JSON parsing with automatic parsing of unstructured logs using pre-discovered parsers. +* [**Auto Parse**](/docs/search/get-started-with-search/build-search/dynamic-parsing). JSON blocks within logs are automatically parsed. +* **Manual**. No automatic parsing applied. + +log-search-parsing-modes.png + +## How Intelliparse mode works + +When you enable Intelliparse mode: +* Logs are parsed using a set of parsers discovered from your recently used dashboards. +* Fields are extracted automatically from both structured and unstructured logs. +* A hidden operator is applied to your query to power this functionality behind the scenes. + +## Benefits + +* **No Field Extraction Rules (FERs) required**. Get field-level insights without manual parsing. +* **Works with your existing dashboards**. Parsers are derived from log panels in recently viewed or edited dashboards. +* **Improved field visibility**. Fields parsed through Intelliparse mode appear in the Messages tab and can be used in queries, filters, and dashboards. + +## Example + +If your dashboard includes a query like: + +```sql +_sourceCategory=cassandra "Dropped table" +| parse "table '*' from database '*'" as db.table, db.name +``` + +Then any matching unstructured logs like: + +`2025-04-09 11:20:25 * Dropped table 'logins' from database 'auth'` + +will be parsed automatically in Intelliparse mode, extracting: + +* `db.table = "logins"` +* `db.name = "auth"` + +:::info +* Parsers are discovered automatically from dashboard content. No manual setup needed. +* If a dashboard is modified, the associated parser will update. Deleted dashboards do not currently delete parsers. +* Queries using Intelliparse mode include a hidden intelliparse operator, injected automatically. +::: + +## How Copilot uses Intelliparse mode + +Even if you don’t manually enable Intelliparse mode, you may encounter it when using [Sumo Logic Copilot](/docs/search/copilot). + +Copilot uses Intelliparse mode in the background to: +* Automatically parse unstructured logs for natural language queries. +* Discover field names and values for more accurate suggestions and translations. +* Generate search queries that include the hidden `intelliparse` operator. + +This integration allows Copilot to work with raw, unstructured log data; no setup required on your part. + + diff --git a/static/img/search/get-started-search/build-search/log-search-parsing-modes.png b/static/img/search/get-started-search/build-search/log-search-parsing-modes.png new file mode 100644 index 0000000000..19b54af485 Binary files /dev/null and b/static/img/search/get-started-search/build-search/log-search-parsing-modes.png differ