Falcon LogScale Documentation

Fixed a bug where read-only dashboards allowed dragging/resizing widgets. (#1274)

The scale-out implementation is improved in several ways. Most significantly, functionality adding a node to a cluster has been added. Contact us for more detail if relevant.

For UI queries (and those using the queryjob API) the limit on the result set is lowered to 1.0 rows/events. This avoids the UI freezing in cases where a very large result set is generated. To get more than 1.0 results the query HTTP endpoint has to be used. (#1281, #960)

Humio can optionally use re2j (google's regex implementation), which is slightly slower than the default Java version, but avoids some strange corner cases that can sometimes cause stackoverflow. Controlled with >USE_JAVA_REGEX. Defaults to true.

While running a query, the UI will now indicate progress 0-.0%. (#1262)

Timecharts with span=1d now uses the browser's timezone to determine day boundary. (#1250)

In certain cases, live queries producing a warning would add the same warning repeatedly for every poll. (#1255)

The event details view has been improved in various ways: remember height, new buttons for 'groupby attribute' and 'filter without'. (#1277)

Add parameters unit and buckets to timeChart(). The parameter buckets allows users to specify a specific number of buckets (maximum 1.0) to split the query interval into, as an alternative to the span parameter which has issues when resizing the query interval. The unit parameter lets you convert rates by e.g. passing unit="bytes/bucket to Mibytes/hour". As the bucket (or span) value changes, the output is converted to the given output unit. (#1295)