Humio Server 1.12.0 Stable (2020-06-09)
|Version||Type||Release Date||End of Support||Upgrades From||Data Migration||Config. Changes|
Export to Bucket,
selfJoin(), Emergency User Sub-System This
release promotes the 1.11 releases from preview to stable. To
see more details go through the individual 1.11.x release notes
(links in the changelog).
selfJoin() query function allows
selecting log lines that share an identifier; for which there
exists (separate) log lines that match a certain filtering
criteria; such as "all log lines with a given userid for which
there exists a successful and an
findTimestamp() query function will try
to find and parse timestamps in incoming data. The function
should be used in parsers and support automatic detection of
timestamps. It can be used instead of making regular expressions
specifying where to find the timestamp and parsing it with
parseTimestamp(). Checkout the
findTimestamp() for details.
As an alternative to downloading streaming queries directly, Humio can now upload them to an S3 or GCS bucket from which the user can download the data. See Buckets and Archive Storage.
If there are issues with the identity provider that Humio is configured to use, it might not be possible to log in to Humio. To mitigate this, Humio now provides emergency users that can be created locally within the Humio cluster. See Enabling Emergency Access.
Fluent Bit users might need to change the Fluent Bit configuration. To ensure compatibility with the newest Beats clients, the Elastic Bulk API has been changed to always return the full set of status information for all operations, as it is done in the official Elastic API. This can however cause problems when using Fluent Bit to ingest data into Humio.
Fluent Bit in default configuration uses a small buffer (4KB) for responses from the Elastic Bulk API, which causes problems when enough operations are bulked together. The response will then be larger than the response buffer as it contains the status for each individual operation. Make sure the response buffer is large enough, otherwise Fluent Bit will stop shipping data. See: https://github.com/fluent/fluent-bit/issues/2156 and https://docs.fluentbit.io/manual/pipeline/outputs/elasticsearch
Other changes: (see 1.11.1 release notes)
Major changes: (see 1.11.0 release notes)