diff --git a/blog-service/2024/12-31.md b/blog-service/2024/12-31.md index 44a904fb50..aa9e75efdf 100644 --- a/blog-service/2024/12-31.md +++ b/blog-service/2024/12-31.md @@ -149,7 +149,7 @@ We're excited to announce the release of our new cloud-to-cloud source for Trust #### Sumo Logic Copilot -We're excited to introduce Copilot, an AI-powered assistant that accelerates log investigations and troubleshooting. With natural language query capabilities and contextual suggestions, Copilot helps security first responders and on-call engineers resolve incidents quickly and efficiently. [Learn more](/docs/search/copilot). +We're excited to introduce Copilot, an AI-powered assistant that accelerates log investigations and troubleshooting. With natural language query capabilities and contextual suggestions, Copilot helps security first responders and on-call engineers resolve incidents quickly and efficiently. [Learn more](/docs/search/mobot). * Ask questions in plain English to generate actionable log insights. * Get tailored suggestions relevant to your troubleshooting and investigation context. @@ -157,7 +157,7 @@ We're excited to introduce Copilot, an AI-powered assistant that accelerates log * Auto-visualize charts from search results and add them directly to dashboards. * Use auto-complete for natural language queries to access insights faster. -Copilot UI with the query Analyze the geographic distribution of requests by source IP +Copilot UI with the query Analyze the geographic distribution of requests by source IP ### December 02, 2024 (Apps) diff --git a/blog-service/2025-03-03-copilot-search.md b/blog-service/2025-03-03-copilot-search.md index 78b25d5fb4..11eef16c27 100644 --- a/blog-service/2025-03-03-copilot-search.md +++ b/blog-service/2025-03-03-copilot-search.md @@ -38,4 +38,4 @@ Now you can pin Copilot suggestions for easy reference. Just hover over a sugges * **Quick access**. Keep important suggestions handy for ongoing investigations. * **Improved workflow**. No need to scroll back to find key recommendations. -[Learn more](/docs/search/copilot). +[Learn more](/docs/search/mobot). diff --git a/blog-service/2025-08-31-apps.md b/blog-service/2025-08-31-apps.md new file mode 100644 index 0000000000..1abc776cbd --- /dev/null +++ b/blog-service/2025-08-31-apps.md @@ -0,0 +1,35 @@ +--- +title: Apps, Solutions, and Collection Integrations - August Release +image: https://help.sumologic.com/img/reuse/rss-image.jpg +keywords: + - apps + - august-release +hide_table_of_contents: true +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + + + +### New release + +We’re excited to announce the release of the new Azure Event Hubs app and OpenTelemetry Collector Insights app for Sumo Logic. + +- **Azure Event Hubs**. The Azure Event Hubs app helps monitor data plane operations, such as sending or receiving events, and tracks performance metrics, including consumer lag, throughput, and active connections. [Learn more](/docs/integrations/microsoft-azure/azure-event-hubs/). +- **OpenTelemetry Collector Insights**. The OpenTelemetry Collector Insights app provides end-to-end monitoring for your OpenTelemetry Collector instances, enabling you to track performance, data flow, and resource utilization. Use preconfigured dashboards and alerts to troubleshoot issues and ensure your telemetry pipeline runs smoothly and efficiently. [Learn more](/docs/integrations/sumo-apps/opentelemetry-collector-insights/). + +### Enhancements + +- **Azure Virtual Machine**. Automated Metric Rule creation during app install. [Learn more](/docs/integrations/microsoft-azure/azure-virtual-machine/#installing-the-azure-virtual-machine-app). +- **CircleCI Integration**. Updated the CircleCI integration to handle the BLOCKED job state. +- **AWS Serverless Application Model (SAM)**. Released the following SAM: + - `sumologic-app-utils` - SemanticVersion 2.0.21 + - `sumologic-s3-logging-auto-enable` - SemanticVersion 1.0.18 + - `sumologic-guardduty-benchmark` - SemanticVersion 1.0.18 + - `sumologic-aws-cloudtrail-benchmark` - SemanticVersion 1.0.21 +- **Windows ST**. A flag to prevent the collector from shutting down when it fails to open the event log channel; instead, it logs a warning. + +### Bug Fixes + +- **Groovy script of Jenkins plugin**. The Groovy script used in the Jenkins plugin has been updated to automate input handling with the correct data type. +- **Jenkins plugin**. Released with dependency upgrades and vulnerability fixes. diff --git a/blog-service/2025-09-03-search.md b/blog-service/2025-09-03-search.md deleted file mode 100644 index d715181b52..0000000000 --- a/blog-service/2025-09-03-search.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Copilot Multi-Turn Conversations - Beta (Search) -image: https://help.sumologic.com/img/sumo-square.png -keywords: - - copilot - - log-search - - search -hide_table_of_contents: true ---- - -import useBaseUrl from '@docusaurus/useBaseUrl'; - -Copilot now supports multi-turn conversations, allowing you to ask follow-up questions without repeating your original search context. This makes investigations more natural and iterative: refine queries, adjust units or percentiles, dig deeper into results, and explore related suggestions. Enhancements include: - -* **Clarifications when needed**. If your request is ambiguous, Copilot may ask a follow-up question to narrow intent. -* **Smarter error handling**. Contextual error messages explain why a query failed and suggest fixes. -* **Guided exploration**. Intent cards summarize your goal, while suggestion cards offer refinements with a click. -* **Conversation pane**. See your prompts, refinements, and results in one place, with history you can revisit or branch from. -* **Dashboard-aware translations via RAG**. Copilot references recent dashboard queries (last 90 days) to improve accuracy. - -This feature is in Beta. To participate, contact your Sumo Logic account executive or our Support Team. [Learn more](/docs/search/copilot-multiturn-beta). diff --git a/cid-redirects.json b/cid-redirects.json index 63753822a3..fa2c30b5c8 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -574,6 +574,8 @@ "/Search/Search-Query-Language": "/docs/search/search-query-language", "/docs/search/search-syntax": "/docs/search/search-query-language", "/docs/search/search-query-language/operators/eval": "/docs/metrics/metrics-operators/eval", + "/docs/search/search-query-language/search-operators/eval": "/docs/metrics/metrics-operators/eval", + "/docs/search/search-query-language/search-operators/eval-operator": "/docs/metrics/metrics-operators/eval", "/Search/Search-Query-Language/Search-Operators/join": "/docs/search/search-query-language/search-operators/join", "/05Search/Search-Query-Language/Search-Operators/length": "/docs/search/search-query-language/search-operators/length", "/05Search/Search-Query-Language/Search-Operators/limit": "/docs/search/search-query-language/search-operators/limit", @@ -1416,7 +1418,8 @@ "/Send_Data": "/docs/send-data", "/Send_Data/Collector_Management_API/Sumo_Logic_Endpoints": "/docs/api/collector-management", "/Send_Data/Collector_Management_API/About_the_Collector_Management_API": "/docs/api/collector-management", - "/Send_Data/Collector_FAQs/How_to_Ingest_Old_or_Historical_Data": "/docs/send-data/opentelemetry-collector/faq", + "/Send_Data/Collector_FAQs/How_to_Ingest_Old_or_Historical_Data": "/docs/send-data/collector-faq", + "/Send_Data/Collector_FAQs/How_to_tell_which_version_of_the_Collector_is_installed": "/docs/send-data/collector-faq", "/APIs/General-API-Information/Sumo-Logic-Endpoints-by-Deployment-and-Firewall-Security": "/docs/api/about-apis/getting-started", "/APIs/General-API-Information/Sumo-Logic-Endpoints-and-Firewall-Security": "/docs/api/about-apis/getting-started", "/APIs/Partition_Management_API": "/docs/api/partition-management", @@ -1466,6 +1469,7 @@ "/Dashboards-and-Alerts/Dashboards/Chart-Panel-Types": "/docs/dashboards/panels", "/Dashboards-and-Alerts/Dashboards/Chart-Panel-Types/Area-Charts": "/docs/dashboards/panels/area-charts", "/Dashboards_and_Alerts/Dashboards/Chart_Panel_Types/Line_Charts": "/docs/dashboards/panels/line-charts", + "/Dashboards_and_Alerts/Dashboards/Troubleshoot_Dashboards/Why_can't_I_view_a_search_from_a_Dashboard": "/docs/dashboards", "/Dashboards-and-Alerts/Dashboards/Edit-Dashboards-and-Panels/Change-Gridlines-on-the-Y-Axis": "/docs/dashboards/panels", "/Dashboards-and-Alerts/Dashboards/Edit-Dashboards-and-Panels/Change-the-Color-of-a-Chart-by-Value-Range-on-the-Search-Page": "/docs/dashboards", "/Dashboards-and-Alerts/Dashboards/Edit-Dashboards-and-Panels/Change-the-Color-of-a-Chart": "/docs/dashboards", @@ -1586,8 +1590,8 @@ "/cid/1000": "/docs/send-data/installed-collectors/sources/local-file-source", "/cid/100000": "/docs/manage/deletion-requests", "/cid/100001": "/docs/search/get-started-with-search/build-search/search-templates", - "/cid/100002": "/docs/search/copilot", - "/cid/100003": "/docs/search/copilot-multiturn-beta", + "/cid/100002": "/docs/search/mobot", + "/cid/100003": "/docs/search/mobot-multiturn-beta", "/cid/100004": "/docs/search/get-started-with-search/build-search/keyword-search-expressions", "/cid/100005": "/docs/get-started/sign-up", "/cid/100006": "/docs/get-started/library", @@ -3052,6 +3056,7 @@ "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/00Insight_Generation_Process": "/docs/cse/get-started-with-cloud-siem/insight-generation-process", "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/05Set_Insight_Generation_Window_and_Threshold": "/docs/cse/records-signals-entities-insights/set-insight-generation-window-threshold", "/docs/cse/records-signals-entities-insights/signal-index-migration-faq": "/docs/cse/records-signals-entities-insights/search-cse-records-in-sumo", + "/docs/cse/records-signals-entities-insights/signals-overview": "/docs/cse/records-signals-entities-insights", "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/07Entity_Criticality": "/docs/cse/records-signals-entities-insights/entity-criticality", "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/11Create_a_Custom_Entity_Type": "/docs/cse/records-signals-entities-insights/create-custom-entity-type", "/Cloud_SIEM_Enterprise/Records%2C_Signals%2C_Entities%2C_and_Insights/13Using_Tags_with_Insights%2C_Signals%2C_Entities%2C_and_Rules": "/docs/cse/records-signals-entities-insights/tags-insights-signals-entities-rules", @@ -3633,11 +3638,13 @@ "/Send_Data/Sources": "/docs/send-data", "/Send_Data/Sources/01Sources_for_Installed_Collectors/Preconfigure_a_Machine_to_Collect_Remote_Windows_Events": "/docs/send-data/installed-collectors/sources/preconfigure-machine-collect-remote-windows-events", "/Send_Data/Sources/01Sources_for_Installed_Collectors/Script_Action": "/docs/send-data/installed-collectors/sources/script-action", + "/Send_Data/Sources/01Sources_for_Installed_Collectors/Script_Source/Calling_PowerShell_from_a_Sumo_Logic_Script_Source": "/docs/send-data/installed-collectors/sources/script-source", "/Send_Data/Sources/01Sources_for_Installed_Collectors/Syslog_Source": "/docs/send-data/hosted-collectors/cloud-syslog-source", "/Send_Data/Sources/01Sources_for_Installed_Collectors/Local_File_Source": "/docs/send-data/installed-collectors/sources/local-file-source", "/Send_Data/Sources/01Sources_for_Installed_Collectors/Local_File_Source/Define_Boundary_Regex_for_Multiline_Messages": "/docs/send-data/installed-collectors/sources/define-boundary-regex-multiline-messages", "/Search/Search-FAQs/Compare-Log-Messages-by-Day-of-the-Week": "/docs/search/faq", "/Search/Search-FAQs/Export-the-Results-of-a-Saved-File": "/docs/search/faq", + "/Search/Search_FAQs/How_to_reference_a_field_name_that_contains_a_special_character": "/docs/search/faq", "/Search/Search_Cheat_Sheets/Search-Operators-Cheat-Sheet": "/docs/search/search-cheat-sheets", "/Search/Search_Cheat_Sheets/Search_Operators_Cheat_Sheet": "/docs/search/search-cheat-sheets", "/Search/Search_Job_API/Search_Job_API": "/docs/api/search-job", @@ -3895,6 +3902,7 @@ "/Beta": "/docs/beta", "/Beta/APIs": "/docs/api", "/Beta/APIs/APIs": "/docs/api", + "/Beta/Audit_Event_Index": "/docs/manage/security/audit-indexes/audit-event-index", "/Beta/AWS_Kinesis_Firehose_for_Logs_Source": "/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source", "/Beta/AWS_Lambda_-_Python_function_instrumentation_with_Sumo_Logic_tracing": "/docs/apm/traces/get-started-transaction-tracing/opentelemetry-instrumentation/python", "/Beta/AWS_Lambda_-_Java_function_instrumentation_with_Sumo_Logic_tracing": "/docs/apm/traces/get-started-transaction-tracing/opentelemetry-instrumentation/aws-lambda/java", @@ -3930,6 +3938,7 @@ "/Beta/Saved_beta_content/Beta---Library/Apps_in_Sumo_Logic/01_Sumo_Logic_Apps": "/docs/integrations", "/Beta/SLO_Reliability_Management": "/docs/observability/reliability-management-slo", "/Beta/SLO_Reliability_Management/Access_and_Create_SLOs": "/docs/observability/reliability-management-slo", + "/Beta/Traces/HTTP_Traces_Source": "/docs/send-data/hosted-collectors/http-source/traces", "/Beta/Workday/Collect_Logs_for_the_Workday_App": "/docs/integrations/saas-cloud/workday", "/docs/beta/search-log-level": "/docs/search/get-started-with-search/search-page/log-level", "/docs/search/get-started-with-search/search-page/event-analytics/": "/docs/search/get-started-with-search/search-page", @@ -4018,15 +4027,18 @@ "/Search/Search-Query-Language/Search-Operators/format": "/docs/search/search-query-language/search-operators/formatdate", "/Search/Search_Query_Language/Search_Operators/Geo_Lookup": "/docs/search/search-query-language/search-operators/geo-lookup-map", "/Search/Search-Query-Language/Search-Operators/Geo-Lookup-(Map)": "/docs/search/search-query-language/search-operators/geo-lookup-map", + "/Search/Search_Query_Language/Search_Operators/ipv4ToNumber": "/docs/search/search-query-language/search-operators/ipv4tonumber", "/Search/Search_Query_Language/Search_Operators/num": "/docs/search/search-query-language/search-operators/num", "/Search/Search-Query-Language/Search-Operators/sessionize": "/docs/search/search-query-language/search-operators/sessionize", "/Search/Search_Query_Language/Search_Operators/outlier": "/docs/search/search-query-language/search-operators/outlier", "/Search/Search_Query_Language/Search_Operators/where": "/docs/search/search-query-language/search-operators/where", "/Search/Search_Query_Language/Transaction_Analytics": "/docs/search/search-query-language/transaction-analytics", + "/Search/Search_Query_Language/Transaction_Analytics/Merge_Operator": "/docs/search/search-query-language/transaction-analytics/merge-operator", "/Search/Search_Query_Language/Search_Operators/join": "/docs/search/search-query-language/search-operators/join", "/Search/Search_Query_Language/Search_Operators/lookup": "/docs/search/search-query-language/search-operators/lookup", "/Search/Search_Query_Language/Search_Operators/smooth": "/docs/search/search-query-language/search-operators/smooth", "/Search/Search_Query_Language/Search_Operators/toLowerCase_and_toUpperCase": "/docs/search/search-query-language/search-operators/tolowercase-touppercase", + "/Search/Search_Query_Language/Search_Operators/timeslice": "/docs/search/search-query-language/search-operators/timeslice", "/Search/Search-Cheat-Sheets/General-Search-Examples-Cheat-Sheet": "/docs/search/search-cheat-sheets/general-search-examples", "/Search/Search-Cheat-Sheets/Log-Operators-Cheat-Sheet": "/docs/search/search-cheat-sheets/log-operators", "/Search/Search-Query-Language/01-Parse-Operators": "/docs/search/search-query-language/parse-operators", @@ -4037,6 +4049,7 @@ "/Search/Search-Query-Language/01-Parse-Operators/07-Parse-XML-Formatted-Logs": "/docs/search/search-query-language/parse-operators/parse-xml-formatted-logs", "/Search/Search-Query-Language/aaGroup/count,-count-distinct,-and-count-frequent": "/docs/search/search-query-language/group-aggregate-operators/count-count-distinct-and-count-frequent", "/Search/Search-Query-Language/aaGroup/fillmissing": "/docs/search/search-query-language/search-operators/fillmissing", + "/Search/Search-Query-Language/aaGroup/standard-deviation": "/docs/search/search-query-language/group-aggregate-operators/stddev", "/Search/Search-Query-Language/aaGroup/sum": "/docs/search/search-query-language/group-aggregate-operators/sum", "/Search/Search-Query-Language/Search-Operators": "/docs/search/search-query-language/search-operators", "/Search/Search-Query-Language/Search-Operators/lookup": "/docs/search/search-query-language/search-operators/lookup", @@ -4111,6 +4124,7 @@ "/Send-Data/Applications-and-Other-Data-Sources/AWS-Lambda": "/docs/integrations/amazon-aws/lambda", "/Send-Data/Applications-and-Other-Data-Sources/AWS-CloudTrail/04-Set-Up-Admin-Access-for-CloudTrail": "/docs/integrations/amazon-aws/cloudtrail", "/Send-Data/Applications-and-Other-Data-Sources/AWS-Elastic-Load-Balancing-ULM-Application/Collect-Logs-and-Metrics-for-AWS-Elastic-Load-Balancing-ULM-Application": "/docs/integrations/amazon-aws/classic-load-balancer", + "/Send-Data/Applications-and-Other-Data-Sources/AWS-Elastic-Load-Balancing-ULM-CLB/Collect-Logs-and-Metrics-for-AWS-Elastic-Load-Balancing-ULM-CLB": "/docs/integrations/amazon-aws/classic-load-balancer", "/Send-Data/Applications-and-Other-Data-Sources/Azure_Active_Directory": "/docs/integrations/microsoft-azure/active-directory-azure", "/Send-Data/Applications-and-Other-Data-Sources/Azure_Active_Directory/Collect_Logs_for_Azure_Active_Directory": "/docs/integrations/microsoft-azure/active-directory-azure", "/Send-Data/Applications-and-Other-Data-Sources/Azure_Active_Directory/Install_the_Azure_Active_Directory_App_and_View_the_Dashboards": "/docs/integrations/microsoft-azure/active-directory-azure", @@ -4455,5 +4469,7 @@ "/docs/manage/manage-subscription/manage-org-settings": "/docs/manage/manage-subscription/create-and-manage-orgs/manage-org-settings", "/docs/integrations/amazon-aws/elastic-load-balancing": "/docs/integrations/amazon-aws/classic-load-balancer", "/docs/integrations/microsoft-azure/microsoft-defender-for-cloud": "/docs/integrations/microsoft-azure/azure-security-defender-for-cloud", - "/docs/integrations/azure": "/docs/integrations/microsoft-azure" + "/docs/integrations/azure": "/docs/integrations/microsoft-azure", + "/docs/search/copilot": "/docs/search/mobot", + "/docs/search/copilot-unstructured-logs-beta": "/docs/search/mobot-unstructured-logs-beta" } diff --git a/docs/alerts/monitors/alert-response.md b/docs/alerts/monitors/alert-response.md index 0083acb183..0cb07b2bda 100644 --- a/docs/alerts/monitors/alert-response.md +++ b/docs/alerts/monitors/alert-response.md @@ -139,7 +139,10 @@ The following images and lists describe alert element on the page.
![top of * **L**. The query of the monitor.
labels * **M**. A chart that visualizes the trend of the metric that was tracked as part of the alert condition of the monitor. The visualization tracks the *before* and *during* trends of the metric. * **N**. A table with the raw data that triggered the alert. -* **O**. The **Open in Copilot** button lets you troubleshoot alerts directly in [Copilot](/docs/search/copilot) while preserving alert context, making investigations seamless. This enables faster root cause analysis by allowing you to jump into Copilot instantly and perform context-aware troubleshooting while maintaining alert details.
open in copilot button on alert response page + + + +* **O**. The **Open in Copilot** button lets you troubleshoot alerts directly in [Copilot](/docs/search/mobot) while preserving alert context, making investigations seamless. This enables faster root cause analysis by allowing you to jump into Copilot instantly and perform context-aware troubleshooting while maintaining alert details.
open in copilot button on alert response page :::info Limitations * The alert visualization, labeled **M**, is only shown for alerts less than 30 days old.  diff --git a/docs/get-started/ai-machine-learning.md b/docs/get-started/ai-machine-learning.md index 87ce04b2b0..aae7d06649 100644 --- a/docs/get-started/ai-machine-learning.md +++ b/docs/get-started/ai-machine-learning.md @@ -41,11 +41,11 @@ Sumo Logic AI for Observability functionality equips developers and SREs with po Through comprehensive discovery, monitoring, diagnosis, recovery, and prevention capabilities, we ensure minimized downtime, reduced false positives, faster incident resolution, and proactive issue prevention, all aimed at enhancing the overall health and performance of your applications and services. These capabilities include discovering app, service, and infrastructure stack relationships; utilizing M.E.L.T. telemetry to minimize detection time and false positives; diagnosing incidents swiftly; accelerating recovery times; and preventing future incidents. -### Copilot +### Mobot -Copilot is our AI-based assistant designed that simplifies log analysis by allowing you to ask questions in plain English and provides search suggestions without the need to write log queries. Through plain English queries and automatic log query generation, Copilot simplifies the investigation process, allowing even users without extensive log analysis expertise to pinpoint anomalies and potential threats efficiently. +Mobot is our AI-based assistant designed that simplifies log analysis by allowing you to ask questions in plain English and provides search suggestions without the need to write log queries. Through plain English queries and automatic log query generation, Mobot simplifies the investigation process, allowing even users without extensive log analysis expertise to pinpoint anomalies and potential threats efficiently. -With Copilot, you can effortlessly investigate complex issues without writing intricate log queries manually. Its intuitive interface guides users through each step of the investigation, refining queries based on AI prompts and feedback. This streamlined approach accelerates the identification of security threats, empowering users to make informed decisions rapidly and proactively detect potential risks. [Learn more](/docs/search/copilot). +With Mobot, you can effortlessly investigate complex issues without writing intricate log queries manually. Its intuitive interface guides users through each step of the investigation, refining queries based on AI prompts and feedback. This streamlined approach accelerates the identification of security threats, empowering users to make informed decisions rapidly and proactively detect potential risks. [Learn more](/docs/search/mobot). ### LogReduce diff --git a/docs/search/copilot-multiturn-beta.md b/docs/search/copilot-multiturn-beta.md deleted file mode 100644 index 556a2c0755..0000000000 --- a/docs/search/copilot-multiturn-beta.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -id: copilot-multiturn-beta -title: Sumo Logic Copilot Multi-turn Conversations (Beta) ---- - -import useBaseUrl from '@docusaurus/useBaseUrl'; - - - - - -

Beta

- -:::info -This feature is in Beta. For more information, contact your Sumo Logic account executive. -::: - -Our new conversational experience in Sumo Logic Copilot lets you interact with queries the way you would with a chat assistant. You ask a question and can refine it with follow-ups, change units, and see the updated query and visualization without starting over. Copilot maintains your intent across turns, surfaces helpful suggestions, and makes it easy to explore related angles. - -This guide explains what's new in the UI, how the multi-turn flow works, and shows example workflows. The examples, such as refining a latency query for an SLO or counting warning events, are illustrative. You can apply the same interaction pattern to any log data you care about. - -## What's new in Beta - -* **Multi-turn conversations**. Refine queries through natural, conversational follow-up questions without losing context. -* **Improved accuracy**. Translations to Sumo Query Language are more reliable, especially for data sources with active dashboards. -* **Clarifications when needed**. If your request is ambiguous, Copilot may ask a follow-up question to narrow intent. -* **Smarter error handling**. Instead of generic errors, Copilot provides clearer messages and fallback suggestions for next steps. -* **Dashboard-aware translations (via RAG)**. Copilot leverages queries from dashboards opened in your org in the last 90 days to better understand intent. -* **Guided exploration**. Intent cards summarize your current goal, and suggestion cards offer refinements you can apply with a click. -* **Integrated workflow**. A conversation pane shows your prompts and refinements, with queries rendered directly in the editor, live results, and the ability to branch or revisit past conversations. - -## Example workflow - -In the below example, we'll use the following key concepts: - -* **Multi-turn conversation**. A sequence of related instructions that retains context and incrementally updates the query and output. -* **Intent card**. Visual summary of what you're asking Copilot to do in this session. -* **Suggestion cards**. Recommended refinements or adjacent analyses you can apply with a click. - -This workflow demonstrate the multi-turn interaction pattern; you can apply the same steps to other logs, events, or dimensions. - -### Step 1: Ask your initial question - -Start broad when you set a goal: `Show failed login attempts in the last 24 hours`. An intent card appears at the top, summarizing your goal. Copilot also surfaces suggestion cards with related refinements you can click, and gives you the option to open the query in Log Search. - -Copilot multi-turn conversation showing initial query, failed login attempts in the last 24 hours - -### Step 2: Narrow the scope - -The top reason in the table is `FailedScheduling`, so we'll select a follow-up suggestion, `Show failed scheduling events`. Copilot refreshes the results and updates the intent card and query to reflect the new focus. - -Copilot multi-turn conversation showing refinement, failed scheduling events - -Now, refine further by typing: `Break down failed scheduling events by namespace` - -Copilot multi-turn conversation showing refinement, failed scheduling events by namespace - -Copilot adjusts the query, applies the refinements, and renders a visual chart. - -### Step 3: Drill into causes - -Next, type `Add error messages`. Copilot translates this into: `Add error messages to the breakdown of failed scheduling events by namespace`. The intent card expands to include the new scope, and results now show error message details. - -Copilot multi-turn conversation showing error messages - -### Step 4: Request a trend over time - -Finally, type: `Show the trend over 24 hours`. Copilot translates this into: `Show the trend of failed scheduling events by namespace with error messages over 24 hours`. The query applies a timeslice (for example, one-hour buckets) to group results over time. - -Copilot multi-turn conversation showing trend over time - -Copilot also presents new suggestion cards to help you pivot into related questions, such as analyzing trends of event reasons or identifying top namespaces. - -### Next steps - -As with legacy Copilot, you can adjust the [time range](/docs/search/copilot/#time-range), switch to a different [chart type](/docs/search/copilot/#chart-type), or make other refinements. For example, in the previous step, where the results appear in a table view, you can change the visualization to a time-series chart (for example, line or area) to see the trend more clearly over time. - -You can also [edit the query logic](/docs/search/copilot/#edit-query-code), [open in Log Search](/docs/search/copilot/#step-4-open-in-log-search), or start over with a [new chat](/docs/search/copilot/#new-conversation). - -## Best practices - -* **Talk to it like a conversation**. Layer refinements instead of rewriting the whole question. -* **Be specific**. Combine filters, units, and percentiles in clear language. -* **Ask about data tied to dashboards**. Copilot works best when you reference data sources that already have dashboards built on them. -* **Use suggestions**. Leverage the surfaced cards to pivot or drill down without manual query construction. -* **Reuse history**. Open prior conversations to compare or branch analyses. - -## FAQ - -
-Is any user or org data sent outside our environment? - -No. All processing happens within your region's cluster. RAG context is scoped to dashboards in your own org—no cross-org data leakage. -
- -
-What's the impact on query latency? - -Typical end-to-end response time remains under 2 seconds for most queries. Very large result sets or percentile calculations over broad ranges may take up to 5 seconds. During Beta, full query generation may take 6 to 7 seconds, but Copilot streams the first token (intent interpretation) within 2 seconds. -
- -
-How do I debug a failed translation? - -If a translation fails, Copilot generates a contextual error message tailored to the situation. The message includes the generated query, explains why it failed, and suggests how to fix it (for example, `Try narrowing your time window` or `Simplify your filter expression`). - -Here are some common cases: - -* **No or delayed results**. Give Copilot a few seconds to process complex refinements. -* **Output too broad**. Add more context (for example, specify a client or namespace). -* **Unexpected numbers**. If results look off, be more explicit. For example, ask `show in milliseconds` or `convert to seconds` to adjust units, or say `show P90` / `switch back to P50 over 1 minute` to refine percentiles. -
- -
-What are the current limitations? - -* For dashboard-aware translations via RAG, support is limited to the `sourceCategory` filter (selection in the source picker) at launch. Other expressions like `_index=` or `_sourceHost=` are not yet supported. -* RAG only considers dashboards that have been opened in the last 90 days when interpreting your query. -* Very large or highly complex queries may time out or trigger structured fallback responses. -* Multi-turn Copilot is available for log-based searches only. Metrics and Metric Searches are not supported in this Beta. -
- -## Additional resources - -* [Copilot](/docs/search/copilot) -* [Search Query Language](/docs/search/search-query-language) -* [Dashboards](/docs/dashboards) diff --git a/docs/search/copilot-unstructured-logs-beta.md b/docs/search/copilot-unstructured-logs-beta.md deleted file mode 100644 index 4399d1d31c..0000000000 --- a/docs/search/copilot-unstructured-logs-beta.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -id: copilot-unstructured-logs-beta -title: Sumo Logic Copilot - Unstructured Logs Support (Beta) -description: Streamline your log analysis with Sumo Logic Copilot, our AI-based assistant that simplifies log analysis by letting you ask questions in plain English, even for logs without a well-defined structure. ---- - -import useBaseUrl from '@docusaurus/useBaseUrl'; - - - - - -

Beta

- - - -This feature is in Beta. For more information, contact your Sumo Logic account executive. - -Unstructured Logs Support for [Sumo Logic Copilot](/docs/search/copilot), our AI assistant, enables it to understand and provide insights from raw, text-based logs, even if they don't follow a structured format like JSON. This means you can ask questions in plain English and get meaningful results from nearly any log data, without requiring Field Extraction Rules (FERs). - -## What's new - -Currently, [Copilot works best on structured (JSON) logs](/docs/search/copilot/#compatible-log-formats). With this beta update, Copilot automatically applies parsing logic to unstructured logs, even if no FERs are configured. - -At this stage, Copilot prioritizes unstructured logs that are already used in dashboards, allowing it to surface insights from high-value log sources out-of-the-box. This means it won’t interpret all raw logs yet, but we’re actively working to broaden this support beyond dashboards. - -* **Broader coverage**. Copilot now parses and generates insights from unstructured log formats, even without FERs, making it useful for environments that include custom or inconsistent log types. -* **Improved usability**. Ask questions in natural language. Copilot interprets your intent and suggests relevant searches, even for raw, non-JSON logs. -* **Performance and reliability**. Response times and suggestion accuracy are consistent with Copilot’s structured log experience. -* **Security and compliance**. The same strict data handling and privacy standards apply. Unstructured Logs Support builds on Copilot’s secure foundation. - - - -### Common use cases - -* **General log exploration**. Ask questions about unstructured logs that are already used in your dashboards, even if they lack predefined fields. -* **Error triage**. Investigate frequently visualized log data to surface patterns and recurring issues in unstructured formats. -* **Security insights**. Detect anomalies or signs of failed logins by querying raw logs already powering security dashboards. -* **Smarter prioritization**. Copilot focuses on unstructured logs that are visualized in dashboards, helping you get meaningful insights from high-value data sources. - -## FAQ - -**Will Copilot interpret all my logs?**
-Copilot prioritizes unstructured logs that are already used in dashboards. This improves the relevance of insights and helps focus on high-value logs. - -**How is this different from structured log support?**
-Structured logs have predefined fields, allowing Copilot to map queries directly. For unstructured logs, Copilot uses AI and parsing techniques to infer structure on the fly. diff --git a/docs/search/get-started-with-search/build-search/intelliparse-beta.md b/docs/search/get-started-with-search/build-search/intelliparse-beta.md index dc8aa88ce3..36d7e4c22d 100644 --- a/docs/search/get-started-with-search/build-search/intelliparse-beta.md +++ b/docs/search/get-started-with-search/build-search/intelliparse-beta.md @@ -65,17 +65,17 @@ will be parsed automatically in Intelliparse mode, extracting: * Queries using Intelliparse mode include a hidden intelliparse operator, injected automatically. ::: -## How Copilot uses Intelliparse mode +## How Mobot uses Intelliparse mode -Even if you don’t manually enable Intelliparse mode, you may encounter it when using [Sumo Logic Copilot](/docs/search/copilot). +Even if you don’t manually enable Intelliparse mode, you may encounter it when using [Mobot](/docs/search/mobot) (formerly known as Copilot). -Copilot uses Intelliparse mode in the background to: +Mobot uses Intelliparse mode in the background to: * Automatically parse unstructured logs for natural language queries. * Discover field names and values for more accurate suggestions and translations. * Generate search queries that include the hidden `intelliparse` operator. -This integration allows Copilot to work with raw, unstructured log data; no setup required on your part. +This integration allows Mobot to work with raw, unstructured log data; no setup required on your part. :::tip -Want to learn more about Intelliparse mode? [See how it works in Log Search](/docs/search/copilot-unstructured-logs-beta). +Want to learn more about Intelliparse mode? [See how it works in Log Search](/docs/search/mobot-unstructured-logs-beta). ::: diff --git a/docs/search/index.md b/docs/search/index.md index cad7562d99..108ef5b43c 100644 --- a/docs/search/index.md +++ b/docs/search/index.md @@ -25,8 +25,8 @@ In this section, we'll introduce the following concepts:
- icon

Copilot

 -

Accelerate log investigations and troubleshooting with Sumo Logic Copilot, our AI-powered assistant that enables you to ask natural language questions and get contextual suggestions, helping first responders get to answers faster.

+ icon

Mobot

 +

Accelerate log investigations and troubleshooting with Sumo Logic Mobot, our AI-powered assistant that enables you to ask natural language questions and get contextual suggestions, helping first responders get to answers faster.

diff --git a/docs/search/mobot-multiturn-beta.md b/docs/search/mobot-multiturn-beta.md new file mode 100644 index 0000000000..2a98f9cd88 --- /dev/null +++ b/docs/search/mobot-multiturn-beta.md @@ -0,0 +1,127 @@ +--- +id: mobot-multiturn-beta +title: Sumo Logic Mobot Multi-turn Conversations (Beta) +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + + + + + +

Beta

+ +:::info +This feature is in Beta. For more information, contact your Sumo Logic account executive. +::: + +Our new conversational experience in Sumo Logic Mobot (formerly known as Copilot) lets you interact with queries the way you would with a chat assistant. You ask a question and can refine it with follow-ups, change units, and see the updated query and visualization without starting over. Mobot maintains your intent across turns, surfaces helpful suggestions, and makes it easy to explore related angles. + +This guide explains what's new in the UI, how the multi-turn flow works, and shows example workflows. The examples, such as refining a latency query for an SLO or counting warning events, are illustrative. You can apply the same interaction pattern to any log data you care about. + +## What's new in Beta + +* **Multi-turn conversations**. Refine queries through natural, conversational follow-up questions without losing context. +* **Improved accuracy**. Translations to Sumo Query Language are more reliable, especially for data sources with active dashboards. +* **Clarifications when needed**. If your request is ambiguous, Mobot may ask a follow-up question to narrow intent. +* **Smarter error handling**. Instead of generic errors, Mobot provides clearer messages and fallback suggestions for next steps. +* **Dashboard-aware translations (via RAG)**. Mobot leverages queries from dashboards opened in your org in the last 90 days to better understand intent. +* **Guided exploration**. Intent cards summarize your current goal, and suggestion cards offer refinements you can apply with a click. +* **Integrated workflow**. A conversation pane shows your prompts and refinements, with queries rendered directly in the editor, live results, and the ability to branch or revisit past conversations. + +## Example workflow + +In the below example, we'll use the following key concepts: + +* **Multi-turn conversation**. A sequence of related instructions that retains context and incrementally updates the query and output. +* **Intent card**. Visual summary of what you're asking Mobot to do in this session. +* **Suggestion cards**. Recommended refinements or adjacent analyses you can apply with a click. + +This workflow demonstrate the multi-turn interaction pattern; you can apply the same steps to other logs, events, or dimensions. + +### Step 1: Ask your initial question + +Start broad when you set a goal: `Show failed login attempts in the last 24 hours`. An intent card appears at the top, summarizing your goal. Mobot also surfaces suggestion cards with related refinements you can click, and gives you the option to open the query in Log Search. + +Mobot multi-turn conversation showing initial query, failed login attempts in the last 24 hours + +### Step 2: Narrow the scope + +The top reason in the table is `FailedScheduling`, so we'll select a follow-up suggestion, `Show failed scheduling events`. Mobot refreshes the results and updates the intent card and query to reflect the new focus. + +Mobot multi-turn conversation showing refinement, failed scheduling events + +Now, refine further by typing: `Break down failed scheduling events by namespace` + +Mobot multi-turn conversation showing refinement, failed scheduling events by namespace + +Mobot adjusts the query, applies the refinements, and renders a visual chart. + +### Step 3: Drill into causes + +Next, type `Add error messages`. Mobot translates this into: `Add error messages to the breakdown of failed scheduling events by namespace`. The intent card expands to include the new scope, and results now show error message details. + +Mobot multi-turn conversation showing error messages + +### Step 4: Request a trend over time + +Finally, type: `Show the trend over 24 hours`. Mobot translates this into: `Show the trend of failed scheduling events by namespace with error messages over 24 hours`. The query applies a timeslice (for example, one-hour buckets) to group results over time. + +Mobot multi-turn conversation showing trend over time + +Mobot also presents new suggestion cards to help you pivot into related questions, such as analyzing trends of event reasons or identifying top namespaces. + +### Next steps + +As with legacy Mobot, you can adjust the [time range](/docs/search/mobot/#time-range), switch to a different [chart type](/docs/search/mobot/#chart-type), or make other refinements. For example, in the previous step, where the results appear in a table view, you can change the visualization to a time-series chart (for example, line or area) to see the trend more clearly over time. + +You can also [edit the query logic](/docs/search/mobot/#edit-query-code), [open in Log Search](/docs/search/mobot/#step-4-open-in-log-search), or start over with a [new chat](/docs/search/mobot/#new-conversation). + +## Best practices + +* **Talk to it like a conversation**. Layer refinements instead of rewriting the whole question. +* **Be specific**. Combine filters, units, and percentiles in clear language. +* **Ask about data tied to dashboards**. Mobot works best when you reference data sources that already have dashboards built on them. +* **Use suggestions**. Leverage the surfaced cards to pivot or drill down without manual query construction. +* **Reuse history**. Open prior conversations to compare or branch analyses. + +## FAQ + +
+Is any user or org data sent outside our environment? + +No. All processing happens within your region's cluster. RAG context is scoped to dashboards in your own org—no cross-org data leakage. +
+ +
+What's the impact on query latency? + +Typical end-to-end response time remains under 2 seconds for most queries. Very large result sets or percentile calculations over broad ranges may take up to 5 seconds. During Beta, full query generation may take 6 to 7 seconds, but Mobot streams the first token (intent interpretation) within 2 seconds. +
+ +
+How do I debug a failed translation? + +If a translation fails, Mobot generates a contextual error message tailored to the situation. The message includes the generated query, explains why it failed, and suggests how to fix it (for example, `Try narrowing your time window` or `Simplify your filter expression`). + +Here are some common cases: + +* **No or delayed results**. Give Mobot a few seconds to process complex refinements. +* **Output too broad**. Add more context (for example, specify a client or namespace). +* **Unexpected numbers**. If results look off, be more explicit. For example, ask `show in milliseconds` or `convert to seconds` to adjust units, or say `show P90` / `switch back to P50 over 1 minute` to refine percentiles. +
+ +
+What are the current limitations? + +* For dashboard-aware translations via RAG, support is limited to the `sourceCategory` filter (selection in the source picker) at launch. Other expressions like `_index=` or `_sourceHost=` are not yet supported. +* RAG only considers dashboards that have been opened in the last 90 days when interpreting your query. +* Very large or highly complex queries may time out or trigger structured fallback responses. +* Multi-turn Mobot is available for log-based searches only. Metrics and Metric Searches are not supported in this Beta. +
+ +## Additional resources + +* [Mobot](/docs/search/mobot) +* [Search Query Language](/docs/search/search-query-language) +* [Dashboards](/docs/dashboards) diff --git a/docs/search/mobot-unstructured-logs-beta.md b/docs/search/mobot-unstructured-logs-beta.md new file mode 100644 index 0000000000..22447e6671 --- /dev/null +++ b/docs/search/mobot-unstructured-logs-beta.md @@ -0,0 +1,50 @@ +--- +id: mobot-unstructured-logs-beta +title: Sumo Logic Mobot - Unstructured Logs Support (Beta) +description: Streamline your log analysis with Sumo Logic Mobot, our AI-based assistant that simplifies log analysis by letting you ask questions in plain English, even for logs without a well-defined structure. +--- + +import useBaseUrl from '@docusaurus/useBaseUrl'; + + + + + +

Beta

+ + + +This feature is in Beta. For more information, contact your Sumo Logic account executive. + +Unstructured Logs Support for [Sumo Logic Mobot](/docs/search/mobot), our AI assistant, enables it to understand and provide insights from raw, text-based logs, even if they don't follow a structured format like JSON. This means you can ask questions in plain English and get meaningful results from nearly any log data, without requiring Field Extraction Rules (FERs). + +## What's new + +Currently, [Mobot works best on structured (JSON) logs](/docs/search/mobot/#compatible-log-formats). With this beta update, Mobot automatically applies parsing logic to unstructured logs, even if no FERs are configured. + +At this stage, Mobot prioritizes unstructured logs that are already used in dashboards, allowing it to surface insights from high-value log sources out-of-the-box. This means it won’t interpret all raw logs yet, but we’re actively working to broaden this support beyond dashboards. + +* **Broader coverage**. Mobot now parses and generates insights from unstructured log formats, even without FERs, making it useful for environments that include custom or inconsistent log types. +* **Improved usability**. Ask questions in natural language. Mobot interprets your intent and suggests relevant searches, even for raw, non-JSON logs. +* **Performance and reliability**. Response times and suggestion accuracy are consistent with Mobot’s structured log experience. +* **Security and compliance**. The same strict data handling and privacy standards apply. Unstructured Logs Support builds on Mobot’s secure foundation. + + + +### Common use cases + +* **General log exploration**. Ask questions about unstructured logs that are already used in your dashboards, even if they lack predefined fields. +* **Error triage**. Investigate frequently visualized log data to surface patterns and recurring issues in unstructured formats. +* **Security insights**. Detect anomalies or signs of failed logins by querying raw logs already powering security dashboards. +* **Smarter prioritization**. Mobot focuses on unstructured logs that are visualized in dashboards, helping you get meaningful insights from high-value data sources. + +## FAQ + +**Will Mobot interpret all my logs?**
+Mobot prioritizes unstructured logs that are already used in dashboards. This improves the relevance of insights and helps focus on high-value logs. + +**How is this different from structured log support?**
+Structured logs have predefined fields, allowing Mobot to map queries directly. For unstructured logs, Mobot uses AI and parsing techniques to infer structure on the fly. diff --git a/docs/search/copilot.md b/docs/search/mobot.md similarity index 56% rename from docs/search/copilot.md rename to docs/search/mobot.md index 51da5f57fb..b2abd773f2 100644 --- a/docs/search/copilot.md +++ b/docs/search/mobot.md @@ -1,10 +1,11 @@ --- -id: copilot -title: Sumo Logic Copilot -sidebar_label: Copilot 🤖 -description: Streamline your log analysis with Sumo Logic Copilot, our AI-based assistant designed to simplify log analysis by allowing you to ask questions in plain English and providing search suggestions without the need to write log queries. +id: mobot +title: Sumo Logic Mobot +sidebar_label: Mobot 🤖 +description: Streamline your log analysis with Sumo Logic Mobot, our AI-based assistant designed to simplify log analysis by allowing you to ask questions in plain English and providing search suggestions without the need to write log queries. keywords: - copilot + - mobot - artificial intelligence - ai - machine learning @@ -14,16 +15,16 @@ keywords: import Iframe from 'react-iframe'; import useBaseUrl from '@docusaurus/useBaseUrl'; -:::info -If you prefer not to use Copilot, you can opt out by contacting [Support](https://support.sumologic.com/support/s/). -::: +Sumo Logic Mobot (formerly known as Copilot) is our AI-powered assistant that accelerates investigations and troubleshooting in logs by allowing you to ask questions in plain English and get contextual suggestions, helping first responders get to answers faster. -Sumo Logic Copilot is our AI-powered assistant that accelerates investigations and troubleshooting in logs by allowing you to ask questions in plain English and get contextual suggestions, helping first responders get to answers faster. +With its intuitive interface, Mobot automatically generates log searches from natural language queries, helping you quickly investigate performance issues, anomalies, and security threats. It also guides you through investigations step-by-step with AI-derived suggestions to refine your results for faster, more accurate resolutions. Overall, Mobot enhances incident resolution with expert level insights. -With its intuitive interface, Copilot automatically generates log searches from natural language queries, helping you quickly investigate performance issues, anomalies, and security threats. It also guides you through investigations step-by-step with AI-derived suggestions to refine your results for faster, more accurate resolutions. Overall, Copilot enhances incident resolution with expert level insights. +:::info +If you prefer not to use Mobot, you can opt out by contacting [Support](https://support.sumologic.com/support/s/). +::: -:::sumo Micro Lesson: Introduction to Copilot -This short video introduces Copilot and how it can help you with log search and analysis—perfect for getting a quick overview before diving in. +:::sumo Micro Lesson: Introduction to Mobot +This short video introduces Mobot (formerly known as Copilot) and how it can help you with log search and analysis—perfect for getting a quick overview before diving in.