diff --git a/cid-redirects.json b/cid-redirects.json index 17d92dfb85..de2c7f53b9 100644 --- a/cid-redirects.json +++ b/cid-redirects.json @@ -385,6 +385,7 @@ "/05Search/Get-Started-with-Search/How-to-Build-a-Search/Best-Practices%3A-Search-Rules-to-Live-By": "/docs/search/get-started-with-search/build-search/best-practices-search", "/05Search/Get-Started-with-Search/How-to-Build-a-Search/Dynamic_Parsing": "/docs/search/get-started-with-search/build-search/dynamic-parsing", "/05Search/Get-Started-with-Search/How-to-Build-a-Search/Keyword-Search-Expressions": "/docs/search/get-started-with-search/build-search/keyword-search-expressions", + "/docs/search/get-started-with-search/build-search/intelliparse-beta": "/docs/search/get-started-with-search/build-search/dynamic-parsing", "/05Search/Get-Started-with-Search/How-to-Build-a-Search/Search-Syntax-Overview": "/docs/search/get-started-with-search/build-search/search-syntax-overview", "/05Search/Get-Started-with-Search/How-to-Build-a-Search/Search-Templates": "/docs/search/get-started-with-search/build-search/search-templates", "/05Search/Get-Started-with-Search/How-to-Build-a-Search/Set-the-Time-Range": "/docs/search/get-started-with-search/build-search/set-time-range", diff --git a/docs/search/get-started-with-search/build-search/dynamic-parsing.md b/docs/search/get-started-with-search/build-search/dynamic-parsing.md index e047383fa2..8f1e32d5f1 100644 --- a/docs/search/get-started-with-search/build-search/dynamic-parsing.md +++ b/docs/search/get-started-with-search/build-search/dynamic-parsing.md @@ -6,18 +6,6 @@ description: Dynamic Parsing (Auto Parse Mode) allows you to configure automatic import useBaseUrl from '@docusaurus/useBaseUrl'; - - Dynamic Parsing (Auto Parse Mode) allows automatic field extraction from your JSON log messages when you run a search. This allows you to view fields from JSON logs without having to manually specify parsing logic. ## How Dynamic Parsing works @@ -59,7 +47,7 @@ To optimize search performance you can manually set up Dynamic Parsing by defin Run Time FERs have a scope, exactly like an Ingest Time FER, that defines which searches are applicable to Dynamic Parsing **Auto Parse Mode**. For Dynamic Parsing to work your query needs to have a scope that is defined in a Run Time FER, otherwise **Auto Parse Mode** will not be applicable. -1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. +1. [**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu select **Data Management**, and then under **Logs** select **Field Extraction Rules**. You can also click the **Go To...** menu at the top of the screen and select **Field Extraction Rules**.
[**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Logs > Field Extraction Rules**. 1. Click **+ Add** at top right of the table to create an FER.
![Create Field extraction rule with dynamic parsing.png](/img/search/get-started-search/build-search/dynamic-parsing/create-FER-dynamic-parsing.png) 1. Enter the following options: * **Rule Name**. Type a name that makes it easy to identify the rule. @@ -108,7 +96,7 @@ The [field browser](/docs/search/get-started-with-search/search-page/field-brows ## Using Manual mode -When **Auto Parse Mode** is disabled, you'll be in manual mode, meaning: +When **Auto Parse Mode** is disabled, you'll be in manual parsing mode, meaning: * Fields won't be parsed automatically unless defined by an Ingest-Time FER. * You'll need to add parsing logic manually. * This mode is best suited for advanced users who want full control and optimized performance. diff --git a/docs/search/get-started-with-search/build-search/intelliparse-beta.md b/docs/search/get-started-with-search/build-search/intelliparse-beta.md deleted file mode 100644 index a2879983a2..0000000000 --- a/docs/search/get-started-with-search/build-search/intelliparse-beta.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -id: intelliparse-beta -title: Intelliparse Mode (Beta) -description: Intelliparse mode extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON. ---- - -import useBaseUrl from '@docusaurus/useBaseUrl'; - - - - - -

Beta

- - - -This feature is currently available to select customers. Contact your Sumo Logic account representative to request access. - -We've introduced a new Log Search parsing mode called Intelliparse. It extends automatic parsing to unstructured logs, allowing you to search and filter logs even when they don’t follow a consistent format like JSON. - -## Available parsing modes - -You can now choose from three parsing options in the log search UI: - -* **Intelliparse (new)**. Combines JSON parsing with automatic parsing of unstructured logs using pre-discovered parsers. -* **Auto Parse**. JSON blocks within logs are automatically parsed ([learn more](/docs/search/get-started-with-search/build-search/dynamic-parsing)). -* **Manual**. No automatic parsing applied. - -log-search-parsing-modes.png - -## How Intelliparse mode works - -When you enable Intelliparse mode: -* Logs are parsed using a set of parsers discovered from your recently used dashboards. -* Fields are extracted automatically from both structured and unstructured logs. -* A hidden operator is applied to your query to power this functionality behind the scenes. - -## Benefits - -* **No Field Extraction Rules (FERs) required**. Get field-level insights without manual parsing. -* **Works with your existing dashboards**. Parsers are derived from log panels in recently viewed or edited dashboards. -* **Improved field visibility**. Fields parsed through Intelliparse mode appear in the Messages tab and can be used in queries, filters, and dashboards. - -## Example - -If your dashboard includes a query like: - -```sql -_sourceCategory=cassandra "Dropped table" -| parse "table '*' from database '*'" as db.table, db.name -``` - -Then any matching unstructured logs like: - -`2025-04-09 11:20:25 * Dropped table 'logins' from database 'auth'` - -will be parsed automatically in Intelliparse mode, extracting: - -* `db.table = "logins"` -* `db.name = "auth"` - -:::info -* Parsers are discovered automatically from dashboard content. No manual setup needed. -* If a dashboard is modified, the associated parser will update. Deleted dashboards do not currently delete parsers. -* Queries using Intelliparse mode include a hidden intelliparse operator, injected automatically. -::: - -## How Mobot uses Intelliparse mode - -Even if you don’t manually enable Intelliparse mode, you may encounter it when using [Mobot](/docs/search/mobot) (formerly known as *Copilot*). - -Mobot uses Intelliparse mode in the background to: -* Automatically parse unstructured logs for natural language queries. -* Discover field names and values for more accurate suggestions and translations. -* Generate search queries that include the hidden `intelliparse` operator. - -This integration allows Mobot to work with raw, unstructured log data; no setup required on your part. - -:::tip -Want to learn more about Intelliparse mode? [See how it works in Log Search](/docs/search/mobot-unstructured-logs-beta). -::: diff --git a/docs/search/get-started-with-search/build-search/use-receipt-time.md b/docs/search/get-started-with-search/build-search/use-receipt-time.md index f22d0b91a3..faf455d6ec 100644 --- a/docs/search/get-started-with-search/build-search/use-receipt-time.md +++ b/docs/search/get-started-with-search/build-search/use-receipt-time.md @@ -6,18 +6,6 @@ description: Enable the Use Receipt Time feature to display search results in th import useBaseUrl from '@docusaurus/useBaseUrl'; - - By default, log searches run by Message time. Enable the **Use Receipt Time** setting to run the search by Receipt time, which is the timestamp when a log message hits the Sumo Logic receivers. To search data based on the order that Collectors received the messages use **Receipt Time**. This option has the search reference the [metadata](../search-basics/built-in-metadata.md) field `_receiptTime` instead of `_messageTime`, giving you the ability to view the difference in the parsed [timestamp](/docs/send-data/reference-information/time-reference) (`_messageTime`) and receipt time (`_receiptTime`) to pinpoint Sources that may be parsing the message's timestamps incorrectly. diff --git a/docs/search/mobot-unstructured-logs-beta.md b/docs/search/mobot-unstructured-logs-beta.md index 22447e6671..dfc99b6e97 100644 --- a/docs/search/mobot-unstructured-logs-beta.md +++ b/docs/search/mobot-unstructured-logs-beta.md @@ -29,11 +29,6 @@ At this stage, Mobot prioritizes unstructured logs that are already used in dash * **Performance and reliability**. Response times and suggestion accuracy are consistent with Mobot’s structured log experience. * **Security and compliance**. The same strict data handling and privacy standards apply. Unstructured Logs Support builds on Mobot’s secure foundation. - - ### Common use cases * **General log exploration**. Ask questions about unstructured logs that are already used in your dashboards, even if they lack predefined fields.