Full Release Notes Index

This section contains a single page with all release notes on the same page.

Humio Server 1.68.0 Preview (2022-12-06)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.68.0Preview2022-12-062023-12-061.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • Deprecation

    • The query function holtwinters() is now deprecated and will be removed along with the release of future version 1.73; therefore, its usage in alerts is not recommended.

  • Falcon Data Replicator

    • Enforcing S3 file size limits (30MB) in FDR feeds. Files will not be ingested if they are above the limit.

  • UI Changes

    • Introduced the Social Login Settings feature: all customers with access to the organization identity providers page can now change social login settings in the UI. See Identity Providers for details.

    • No longer possible to add a color to roles. Existing role colors removed from the UI.

  • Automation and Alerts

    • Improved performance when storing alert errors and trigger times in global.

  • Configuration

    • Set dynamic configuration BucketStorageWriteVersion to 3. This sets the format for files written to bucket storage to use a format that allows files larger than 2GB and incurs less memory pressure when decrypting files during download from the bucket. The new format is supported since 1.44.0 only.

    • Changed the default value for AUTHENTICATION_METHOD from none to single-user.

      To set username and password, use the environment variables:

      See SINGLE_USER_USERNAME and SINGLE_USER_PASSWORD documentation for more details on these variables.

    • Set minimum version for the cluster to be 1.44.0.

  • Other

    • New metric global-operation-time: tracks local time spent processing each kind of message received on the global events topic.

    • Audit logging has been improved.

Bug Fixes

  • UI Changes

    • The warning about unsaved changes being lost on an edited dashboard will now only show when actual changes have been made.

  • Other

    • Fixed an issue where LogScale could log secrets to the debug log when configured to use LDAP or when configured to use SSL for Kafka.

    • Fixed a bug in decryption code used when decrypting downloaded files from bucket storage when version-for-bucket-writes=3. The bug did not allow to decrypt files larger than 2GB.

Humio Server 1.67.0 Preview (2022-11-29)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.67.0Preview2022-11-292023-11-291.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • Functions

    • A new query function named createEvents() has been released. This function creates events from strings and is used for testing queries.

Bug Fixes

  • UI Changes

    • IP Location drilldowns now correctly use lat and lon field names instead of latitude and longitude .

    • URL paths with repository name and no trailing /search resolved to Not Found. The URL /repoName will now again show the search page for the repoName repository.

  • Functions

    • Bugs fixed for the collect() function, where:

      • The function mistakenly warned about exceeding its limit if the number of collected values was equal to the limit.

      • The limit parameter was not applied correctly.

Humio Server 1.66.0 Preview (2022-11-22)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.66.0Preview2022-11-222023-11-221.30NoYes

Bug fixes and updates.

Improvements, new features and functionality

  • Configuration

  • Other

    • Make adjustments to the HostsCleanerJob. It will now remove references to missing hosts in fewer writes, and will stop immediately if a host rejoins the cluster.

Bug Fixes

  • Functions

    • Fixed a bug seen in version 1.65 where groupBy() on multiple fields would sometimes produce multiple rows for the same combination of keys.

  • Other

    • Fixed a race where unavailable segments, due to nodes going away, would not become available again after nodes returning.

    • Fixed an issue that could cause repeated unnecessary updates of currentHosts for some segments.

    • Fixed an issue that could cause the error message Object is missing required member 'replicationFactor' when downgrading from current versions to older versions. The error message is only a nuisance, since the object failing deserialization isn't in use in released code yet.

  • Packages

    • Fixed an issue where deleting a parser through an update or uninstall of a package could fail in an unexpected way if the parser was used by an ingest listener or an Fdr feed. Now, a proper error message will be shown.

Humio Server 1.65.0 Preview (2022-11-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.65.0Preview2022-11-152023-11-151.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • Security

    • The version of Jackson has been upgraded to address CVE-2022-42003 vulnerability.

  • UI Changes

    • A new UI for event forwarders located under Organisation Settings now allows you to configure your event forwarders. See Event Forwarders for details.

    • The Repository icon has been changed to match the new look and feel.

  • Automation and Alerts

    • Added a query editor warning (yellow wavy lines) for joins in alerts.

  • Configuration

    • Added a new dynamic configuration UndersizedMergingRetentionPercentage, with a default value of 20. This configuration value is used when selecting undersized segments to merge, this setting controls how wide a time span can be merged together.

      The setting is interpreted as a percentage of the repository's retention by time setting. A reasonable range is 0 through to 90.

  • Other

    • Docker images have been upgraded to Java 17.0.5.

    • Increased the limits for bucket. The maximum number of series has been raised from 50 to 500 and the maximum number of output events has been raised from 10,000 to 100,000.

    • Reduce the scope of a precondition for a particular write to global. This should reduce unnecessary transaction rejections when such writes are bulked together.

    • Audit logging for s3 archiving which tracks when it is enabled, disabled, configured, and restarted.

    • Avoid writing some messages to global if we can tell up-front that the message is unnecessary.

Bug Fixes

  • Configuration

    • Fix some issues with the workings of the BUCKET_STORAGE_MULTIPLE_ENDPOINTS and S3_STORAGE_ENDPOINT_BASE configurations.

      The intent of this configuration is to allow users to configure buckets in multiple bucket services, for instance to allow migrating from AWS bucket storage to a local S3 service. When true, each bucket in global can have a separate endpoint configuration, as defined in S3_STORAGE_ENDPOINT_BASE and similar configurations. This allows an existing cluster running against AWS S3 to begin uploading segments to an on-prem S3 by switching the endpoint base, while still keeping access to existing segments in AWS.

      When false (default), the endpoint base configuration is applied to all existing buckets on boot. This is intended for cases where the base URL needs to be changed for all bucket, for instance due to the introduction of a proxy.

      The issue was that we were not consistently looking up endpoint urls in global for the relevant bucket, but instead simply used whichever endpoint url happened to be defined in configuration at the time. This has been fixed.

  • Other

    • Fixed a minor desynchronization issue related to idle datasources.

    • When a host is removed from global, a job tries to clean up any references to it from other places in global, such as segments. Fixed a bug in this job that meant it didn't clean up references on segments that were tombstoned but not yet gone from global. This issue could block cleanup of those segments.

    • Fixed a bug where interaction context menus did not update the query editor in Safari.

    • The SAML login to Humio using deeplinks now works correctly.

Humio Server 1.64.0 Preview (2022-11-01)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.64.0Preview2022-11-012023-11-011.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • Configuration

    • Added new dynamic configuration for MaxIngestRequestSize to allow limiting size of ingest requests after content-encoding has been applied. The default can be set using the new configuration variable MAX_INGEST_REQUEST_SIZE, or applied via the dynamic configuration.

  • Dashboards and Widgets

    • It is now possible to specify a dashboard by name in the URL. It is also possible to have dashboard ID as a parameter in order to have permanent links.

  • Functions

    • The query function split() now allows splitting arrays that contain arrays. For example, the event a[0][0]=1, a[1][0]=2 can now be split using split(a) produces two events: _index=0, a[0]=1' and '_index=1, a[0]=2.

    • The query function in() has been improved w.r.t. performance when searching in tag fields.

    • Improved memory allocation for the query function split().

    • The query function join() now provides information to optimize the query.

    • Removed the restriction that case and match expressions cannot be used in subqueries.

  • Other

    • In the internal request log, include decoded size of the request body after content-encoding has been applied in new field decodedContentLength. This allows inspecting compression ratio of incoming requests and range of values seen. Requests without compression have contentLength in this new field too.

Bug Fixes

  • UI Changes

    • Fixed a bug where a disabled item in the main menu could be clicked on and which would redirect to the homepage.

    • The Copy menu in the event Inspection Panel now copies text correctly again.

  • Functions

  • Other

    • Fixed an issue that could cause merged segments to appear to be missing after a restart, due to the datasource going idle.

Humio Server 1.63.2 Stable (2022-11-30)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.63.2Stable2022-11-302023-11-301.30.0NoNo
JAR ChecksumValue
MD54b6142d1443af26cbe05f794f8fb65ec
SHA12d21db39a7d4de74df05aea99baab1ad5d5def35
SHA256fe66c9be4aab6b027a5ebc5711fedaeee0aea088c7a20981dfdca07739325f1a
SHA512efb7e6aaa4dbbfd1662552fb3f07b6895bcb2220b69da34a6deb228bd13b286a38ac470f436a0378fa24701d13094da3d3524ebd0f9580a9a599ca5c
Docker ImageSHA256 Checksum
humio-core-dev2f52662a0191e3723c65ac344b8aedb8a0b4a31f324823857fc2dcd13262c5e4
humio-devdd063817c4b302708422213deaa45ac8c799dfc199ae9dc8e80c18a12f882c28
kafka-devcfc1d3f130db496dff29c8c8bf3897253615b03521584bd1f3e17da7a398b67f
zookeeper-dev3d485ef41d36cbc71b583bee7153f75d660c2d1bf42c88fa6dbc21557eac0123

Bug fixes and updates.

Bug Fixes

  • UI Changes

    • URL paths with repository name and no trailing /search resolved to Not Found. The URL /repoName will now again show the search page for the repoName repository.

Humio Server 1.63.1 Stable (2022-11-14)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.63.1Stable2022-11-142023-11-141.30NoNo

Bug fixes and updates.

Deprecation

These items have been deprecated and may be removed in a future release:

  • Deprecated feature removal: the file-based backup feature was deprecated in 1.42.0 and is now removed from Humio. The following configs are no longer supported and will do nothing if set: BACKUP_NAME BACKUP_DIR BACKUP_KEY The DELETE_BACKUP_AFTER_MILLIS config is still supported, as it is used for configuring the delay between a file being marked for deletion in Humio, and that file being removed from bucket storage.

Improvements, new features and functionality

  • Security

    • The version of Jackson has been upgraded to address CVE-2022-42003 vulnerability.

  • Falcon Data Replicator

    • Added the new fileDownloadParallelism setting for FDR feeds to download files from the same SQS message in parallel. See Adjust Polling Nodes Per Feed for all the details.

  • UI Changes

    • Add Falcon LogScale announcement on login and signup pages.

    • Parsing JSON arrays in drill-down context menus no longer adds a trailing dot to the prefix field name.

    • Change missing @timestamp field to give a warning instead of an error in functions tail(), head(), bucket(), and timeChart().

    • Following its name change, mentions of Humio have been changed to Falcon LogScale.

    • The Single Value widget has updated properties:

      • New design for the toggle switch: it is now bigger and has a green/gray color profile instead of blue/gray.

      • The color profile of the displayed value by trend is now customizable.

    • Humio is now a Falcon product. The Humio owl logo and icons are therefore replaced by beautiful falcons.

    • Contextual drill-down menus for field interactions have been introduced, see Fields Interactions. In particular:

      • Fields in the event Inspection panel are now provided with Drill down and Copy context menu items, replacing the former + - GroupBy buttons, see updates at Inspecting Events.

      • The Fields Panel on the left-hand side of the User Interface is now provided with Drill down and Copy context menu items, replacing the former drill-down buttons in the field details flyout (when clicking a field in the fields menu). See updates at Displaying Fields.

      • Fields that have JSON, URL and Timestamps content will have a Parse drill-down option which will parse the field as a LogScale field.

        Parsing JSON will automatically use the field name as prefix for the new field name.

      • Fields containing numbers (currently JSON only) will have Sum, Max, Min, Max values, and Percentiles drill-down options.

    • Interactions on JSON data now enabled for JSON arrays in the Event List.

    • Change Humio logo to Falcon LogScale on login and signup pages.

  • Automation and Alerts

    • Added two new message templates to actions, {query_start_s} and {query_end_s}. See Message Templates and Variables for details.

    • Self-hosted only: the old implementation of how alert queries are run has been removed. As a consequence, the dynamic configuration UseLegacyAlertJob has also been removed.

  • GraphQL API

    • Added new createDashboardFromTemplateV2 mutation with input parameters aligned with the rest of the create from template mutations.

  • Dashboards and Widgets

    • JSON in Log Line and JSON formats columns in Event List widgets now have fields underlined on hover and are clickable. This allows drill-downs and copying values easily.

  • Functions

    • QueryAPI — executionModeHint renamed to executionMode.

    • QueryAPI — Added staticMetaData property to QueryJobStartedResult. At the moment it only contains the property executionMode, which can be used to communicate hints about the way the backend executes the query to the front-end.

    • Introduced new valid array syntax in array:contains() and array:regex() functions:

      • Changed the expected format of the array parameter.

      • Changed these functions to no longer be experimental.

  • Other

    • New background task that runs at startup. It verifies the checksums present in local segment files, traversing the most recently updated segment files on the local disk, using the timestamps they have when Humio status. If a file has invalid checksum it will be renamed to crc-error.X where X is the ID of the segment. An error will be logged as well.

    • Added a new dynamic config UndersizedMergingRetentionPercentage, with a default value of 20. This configuration value is used when selecting undersized segments to merge, this setting controls how wide a time span can be merged together.

      The setting is interpreted as a percentage of the repository's retention by time setting. A reasonable range is 0 through to 90.

    • Created new test function for event forwarders, which takes as input an event forwarder configuration and tests whether it is possible to connect to the Kafka server. The current test function which takes an ID as input and tests an existing event forwarder by ID, is now marked as deprecated.

    • Added a new ingest endpoint for receiving metrics and traces via OpenTelemetry OTLP/http. See OpenTelemetry for all the details.

    • When selecting a parser test case, the selected test case is highlighted in the UI, so you can see what is selected.

    • Added use of the HTTP Proxy Setup, if configured, in a lot of places. If you are running Humio self-hosted and authenticate using Authenticating with OpenID Connect and are using an HTTP Proxy, if Humio should not call the OIDC server through the HTTP Proxy, you need to set the environment variable OIDC_USE_HTTP_PROXY to false.

    • Use latest version of Java 17 in Docker images.

    • It's now possible to expand multiple bell notifications.

    • Add a script in the tarball distribution's bin directory to check the execution environment, checking common permission issues and other requirements for an environment suitable for running Logscale.

    • Empty datasource directories will be now removed from the local file system while starting the server.

    • Add an additional validation check when uploading files to S3-like bucket storage. Humio will now perform a HEAD request for the file's final location in the bucket to verify that the upload succeeded.

Bug Fixes

  • Dashboards and Widgets

    • Bug fixed in Scatter Chart widget tooltip, so that the description of the actual point only is shown in the tooltip when hovering the mouse over one point, instead of multiple points.

    • Fixed a bug where query result containing no valid results was handled incorrectly in visualisation.

  • Functions

    • Improved the format() function as follows.

      • Fixed an issue where the format() function would output the wrong amount of left padded zeros for decimal conversions.

      • Formatting large positive numbers as hex no longer causes a loss of bits for integers less than 2^63.

      • Formatting negative numbers as hex no longer produces unintelligible strings.

      • Fixed an issue where adding the # flag would not display the correct formatting string.

      • Fixed an issue where specifying the time/date modifier N would fail to parse.

      • Fixed an issue where supplying multiple fields required you to specify the index of the last field as an argument specifier.

      • Added a length specifier to allow for outputting fields as 32-bit integers instead of 64-bits.

      • Using the type specifier %F now tries to format the specified field as a floating point.

      See the format() reference documentation page for all the above mentioned updates on the supported formatting syntax.

    • Fixed an issue where match() would sometimes give errors when ignoreCase=true and events contained latin1 encoded characters.

    • Fixed an issue where NaN values could cause groupBy() queries to fail.

    • Fixed a bug where the selfJoin() function would not apply the postfilter parameter.

  • Other

    • Fix an issue that could cause event redaction tasks to fail to complete, if a segment having events redacted was deleted due to retention.

    • Fixed an issue where nothing was displayed on the average ingest chart in case only one datapoint is present.

    • Fix an issue causing a content-length check for bucket uploads to fail when encryption was enabled. The content-length check is not normally enabled, so this should only affect clusters that have disabled ETag-based validation.

    • Fixed a regression causing a reflective method lookup to fail when Humio is running on a Java prior to 13.

    • When selecting a parser test case, the selected test case is highlighted in the UI, so you can see what is selected.

    • When a host is removed from global, a job tries to clean up any references to it from other places in global, such as segments. Fixed a bug in this job that meant it didn't clean up references on segments that were tombstoned but not yet gone from global. This could block cleanup of those segments.

    • It is now possible for a user to use the same personal invite token after the user has been transferred to another organization.

Humio Server 1.63.0 Preview (2022-10-25)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.63.0Preview2022-10-252022-11-141.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • GraphQL API

    • Added enableEventForwarder and disableEventForwarder mutations to enable/disable event forwarders.

  • Log Collector

    • LogScale Collector download page has moved into the new top level tab Log Collector Fleet Management (Cloud-only).

    • New FleetOverview functionality for the LogScale Collector 1.2.0 is available.

    • Humio Log Collector is now Falcon LogScale Collector.

  • Functions

    • The holtwinters() query function will be deprecated with the release of future version 1.68. From then, it cannot be expected to work in alerts, and it will be removed entirely with the release of version 1.72.

    • The base64Decode() query function now accepts non-canonical encodings.

    • The parseCsv() function has improved its performance, in particular in terms of memory pressure.

  • Other

    • Close all segments a node is working on when shutting down. This should help start later in Kafka after reboots.

Bug Fixes

  • Other

    • Fixed a race condition where the segment top offset wasn't removed when a datasource went idle due to a race. This could result in event redaction not running for such segments.

      • Fixed an issue with validations when creating a new Ingest Listener as Netflow/UDP.

      • The form validation for Ingest Listener will now clearly tell the user that the parser needs to be selected when you change between different protocols.

Humio Server 1.62.0 Preview (2022-10-18)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.62.0Preview2022-10-182022-11-141.30NoNo

Updates.

Improvements, new features and functionality

  • UI Changes

    • Add Falcon LogScale announcement on login and signup pages.

    • Parsing JSON arrays in drill-down context menus no longer adds a trailing dot to the prefix field name.

    • Following its name change, mentions of Humio have been changed to Falcon LogScale.

    • Change Humio logo to Falcon LogScale on login and signup pages.

  • Functions

    • Introduced new valid array syntax in array:contains() and array:regex() functions:

      • Changed the expected format of the array parameter.

      • Changed these functions to no longer be experimental.

  • Other

    • Added a new ingest endpoint for receiving metrics and traces via OpenTelemetry OTLP/http. See OpenTelemetry for all the details.

    • Add a script in the tarball distribution's bin directory to check the execution environment, checking common permission issues and other requirements for an environment suitable for running Logscale.

Humio Server 1.61.0 Preview (2022-10-11)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.61.0Preview2022-10-112022-11-141.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • Falcon Data Replicator

    • Added the new fileDownloadParallelism setting for FDR feeds to download files from the same SQS message in parallel. See Adjust Polling Nodes Per Feed for all the details.

  • UI Changes

    • Interactions on JSON data now enabled for JSON arrays in the Event List.

  • Functions

    • QueryAPI — executionModeHint renamed to executionMode.

    • QueryAPI — Added staticMetaData property to QueryJobStartedResult. At the moment it only contains the property executionMode, which can be used to communicate hints about the way the backend executes the query to the front-end.

Bug Fixes

  • Functions

    • Fixed a bug where the selfJoin() function would not apply the postfilter parameter.

  • Other

    • Fix an issue that could cause event redaction tasks to fail to complete, if a segment having events redacted was deleted due to retention.

    • Fixed an issue where nothing was displayed on the average ingest chart in case only one datapoint is present.

    • Fixed a regression causing a reflective method lookup to fail when Humio is running on a Java prior to 13.

Humio Server 1.60.0 Preview (2022-10-04)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.60.0Preview2022-10-042022-11-141.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • UI Changes

    • Contextual drill-down menus for field interactions have been introduced, see Fields Interactions. In particular:

      • Fields in the event Inspection panel are now provided with Drill down and Copy context menu items, replacing the former + - GroupBy buttons, see updates at Inspecting Events.

      • The Fields Panel on the left-hand side of the User Interface is now provided with Drill down and Copy context menu items, replacing the former drill-down buttons in the field details flyout (when clicking a field in the fields menu). See updates at Displaying Fields.

      • Fields that have JSON, URL and Timestamps content will have a Parse drill-down option which will parse the field as a LogScale field.

        Parsing JSON will automatically use the field name as prefix for the new field name.

      • Fields containing numbers (currently JSON only) will have Sum, Max, Min, Max values, and Percentiles drill-down options.

  • GraphQL API

    • Added new createDashboardFromTemplateV2 mutation with input parameters aligned with the rest of the create from template mutations.

  • Dashboards and Widgets

    • JSON in Log Line and JSON formats columns in Event List widgets now have fields underlined on hover and are clickable. This allows drill-downs and copying values easily.

  • Other

    • New background task that runs at startup. It verifies the checksums present in local segment files, traversing the most recently updated segment files on the local disk, using the timestamps they have when Humio status. If a file has invalid checksum it will be renamed to crc-error.X where X is the ID of the segment. An error will be logged as well.

    • Use latest version of Java 17 in Docker images.

    • It's now possible to expand multiple bell notifications.

Bug Fixes

  • Dashboards and Widgets

    • Fixed a bug where query result containing no valid results was handled incorrectly in visualisation.

  • Functions

    • Fixed an issue where NaN values could cause groupBy() queries to fail.

Humio Server 1.59.0 Preview (2022-09-27)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.59.0Preview2022-09-272022-11-141.30NoNo

Updates.

Improvements, new features and functionality

  • UI Changes

    • The Single Value widget has updated properties:

      • New design for the toggle switch: it is now bigger and has a green/gray color profile instead of blue/gray.

      • The color profile of the displayed value by trend is now customizable.

  • Automation and Alerts

Humio Server 1.58.0 Preview (2022-09-20)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.58.0Preview2022-09-202022-11-141.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • UI Changes

    • Humio is now a Falcon product. The Humio owl logo and icons are therefore replaced by beautiful falcons.

    • Change missing @timestamp field to give a warning instead of an error in functions tail(), head(), bucket(), and timeChart().

  • Other

    • Empty datasource directories will be now removed from the local file system while starting the server.

    • Add an additional validation check when uploading files to S3-like bucket storage. Humio will now perform a HEAD request for the file's final location in the bucket to verify that the upload succeeded.

Bug Fixes

  • Functions

    • Improved the format() function as follows.

      • Fixed an issue where the format() function would output the wrong amount of left padded zeros for decimal conversions.

      • Formatting large positive numbers as hex no longer causes a loss of bits for integers less than 2^63.

      • Formatting negative numbers as hex no longer produces unintelligible strings.

      • Fixed an issue where adding the # flag would not display the correct formatting string.

      • Fixed an issue where specifying the time/date modifier N would fail to parse.

      • Fixed an issue where supplying multiple fields required you to specify the index of the last field as an argument specifier.

      • Added a length specifier to allow for outputting fields as 32-bit integers instead of 64-bits.

      • Using the type specifier %F now tries to format the specified field as a floating point.

      See the format() reference documentation page for all the above mentioned updates on the supported formatting syntax.

  • Other

    • Fix an issue causing a content-length check for bucket uploads to fail when encryption was enabled. The content-length check is not normally enabled, so this should only affect clusters that have disabled ETag-based validation.

    • Fix a regression introduced in 1.46.0 that can cause Humio to fail to properly replay data from Kafka when a node is restarted.

Humio Server 1.57.0 Preview (2022-09-13)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.57.0Preview2022-09-132022-11-141.30NoNo

Bug fixes and updates.

Deprecation

These items have been deprecated and may be removed in a future release:

  • Deprecated feature removal: the file-based backup feature was deprecated in 1.42.0 and is now removed from Humio. The following configs are no longer supported and will do nothing if set: BACKUP_NAME BACKUP_DIR BACKUP_KEY The DELETE_BACKUP_AFTER_MILLIS config is still supported, as it is used for configuring the delay between a file being marked for deletion in Humio, and that file being removed from bucket storage.

Improvements, new features and functionality

  • UI Changes

    • Humio is now a Falcon product. The Humio owl logo and icons are therefore replaced by beautiful falcons.

  • Other

    • Created new test function for event forwarders, which takes as input an event forwarder configuration and tests whether it is possible to connect to the Kafka server. The current test function which takes an ID as input and tests an existing event forwarder by ID, is now marked as deprecated.

    • When selecting a parser test case, the selected test case is highlighted in the UI, so you can see what is selected.

    • Added use of the HTTP Proxy Setup, if configured, in a lot of places. If you are running Humio self-hosted and authenticate using Authenticating with OpenID Connect and are using an HTTP Proxy, if Humio should not call the OIDC server through the HTTP Proxy, you need to set the environment variable OIDC_USE_HTTP_PROXY to false.

Bug Fixes

  • Dashboards and Widgets

    • Bug fixed in Scatter Chart widget tooltip, so that the description of the actual point only is shown in the tooltip when hovering the mouse over one point, instead of multiple points.

  • Functions

    • Fixed an issue where match() would sometimes give errors when ignoreCase=true and events contained latin1 encoded characters.

  • Other

    • Fixed an issue where the HTTP threads (Akka pool) could get blocked while sending ingest requests to Kafka, which could result in Humio HTTP endpoints not responding.

    • When selecting a parser test case, the selected test case is highlighted in the UI, so you can see what is selected.

    • It is now possible for a user to use the same personal invite token after the user has been transferred to another organization.

Humio Server 1.56.3 Stable (2022-10-05)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.56.3Stable2022-10-052023-10-051.30.0NoNo
JAR ChecksumValue
MD5f58e3b5944609cb3331a54277b4bf9d6
SHA148c6bf3339693489e073cbac67ba799fbe48661f
SHA2560273a18b354b2844a48175b16fd88f02b1522281a94850a3cc6815430d9efea5
SHA5129ba1ef1ffc2f9d5d1a366b11f724bf24489e9f97c456104399b31d02b4da2903b6c1ac3903ecab862b305e530c19d12400748657cf096f35838ebab978b045e2
Docker ImageSHA256 Checksum
humio-core-dev7a15c633a82db8246a9d4a2e51bd3f802f11f7e08c53d88cb0f79a4886fd12ab
humio-dev6de3bd848774503be64bc0ff6301afa5544bf379e58a8f485703d139ff13c2e1
kafka-deve12d028592c8f92fc23413fc5c9eef903690d3f164b571d05cba3f6319101ceb
zookeeper-devf2e3390dd8552af9830c711f39c409f2ef668a457d377b38610e77d03f42cb2c

Bug fixes and updates.

Bug Fixes

  • Security

    • Update Scala to address CVE-2022-36944.

Humio Server 1.56.2 Stable (2022-09-26)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.56.2Stable2022-09-262023-09-261.30NoNo
JAR ChecksumValue
MD5954f0d64fe9405b757c522a34c28c1cc
SHA114a5afe64517155bc6f7dd1da5d8a94ed42155a0
SHA256cd02dbf3ced3c551e13b1a39d621949770f4ade27b1c5c7f233791b339fd5aa5
SHA512a26172900cb29b89702bf2b61020850d6a24e739de046fc486e5b49b2b06296757086f00984a22d3950d70a0967105408acf8ce003bf5b8e7e2db9f8a0ba3b64
Docker ImageSHA256 Checksum
humio-core-devb13a27d6d39436469033fb8f69f5a6945283a71468ea2248c2902cb38c842501
humio-dev3d47b95b292f61d31e491ed7682d540675b62dda8693ed0a23b39a6dd55fdbba
kafka-deveecc82f9fb8ad2cb7e890650ff8e20538905a33fa53da4272c0582b68d11937e
zookeeper-dev0ab597706043240b1591e412a0b85b03737f583254148cd33bf5443039b368ad

Bug fixes and updates.

Improvements, new features and functionality

  • Falcon Data Replicator

    • The feature flag for FDR feeds has been removed. FDR feeds are now generally available.

  • UI Changes

    • The event lists column header menus have been redesigned to be simpler:

      • You can now click the border between columns header in the event to fit the column to the content.

      • The Event List column Format Panel has been updated to make it easier to manage columns.

      See Formatting Columns.

    • Humio is now a Falcon product. The Humio owl logo and icons are therefore replaced by beautiful falcons.

    • It is now possible to scroll to the selected event on the Search page.

    • It is now possible to interact directly with the JSON properties and values in the EventList.

    • The Log line format type in the Event List will now render fully expanded JSON when a JSON structure starts with a square bracket or curly bracket followed by a newline.

    • In the Event List you can assign data types to a column field. You can now make the setting the default for a fields and the setting is remembered when even the field is added to the Event List, e.g. from the fields panel on the Search page. The button for assigning default data type to a field can be found in the Data type dropdown menu in the column headers of the event list widget. See Fields Data Types.

  • Documentation

  • Automation and Alerts

    • A major change has been made to how alert queries are run in order to better reuse live queries when nodes are restarted in a Humio cluster. Find more details at Alerts.

    • When you create or edit an action it will now show a warning dialog if you have unsaved changes.

    • When creating new Actions, the new name will now stay when you change the Action Type without getting cleared. This also works when you want to change the New Action name while creating a New Action.

  • GraphQL API

    • Deprecates the defaultSharedTimeIsLive input field on the updateDashboard GraphQL mutation, in favor of updateFrequency.

  • Configuration

    • New dynamic configuration MinimumHumioVersion, default value is 0.0.0, that allows setting a minimum Humio version that this cluster will accept starting on. This allows protecting against inadvertently later rolling back too far for some other feature to be turned on, that has an implied minimum version for support of that feature.

    • Added environment variable ENABLE_SANDBOXES to make it possible to enable and disable sandbox repositories.

    • On cloud: added a configuration on dynamic identity providers to configure if users are allowed to be lazily created.

  • Dashboards and Widgets

    • Implemented support for widgets with a fixed time interval on dashboards.

  • Functions

    • Query functions selectFromMin() and selectFromMax() are now generally available for use.

    • BREAKING CHANGE: Changes to the serialization format of the Intermediate Language representation of queries.

      Description: The serialization format used to serialize the intermediate language representation of queries has changed to a JSON format. This has multiple consequences for on-prem customers. During upgrades to this version and rollbacks from this version you can expect the following:

      • Queries can be slower than usual initially as the query cache clears itself.

      • Queries may cause deserialization errors if they are run during upgrade and two or more nodes have different versions. It is recommended to block all queries upon upgrade and downgrade to and from this version and have all nodes upgrade at the same time.

    • Improved warning message when using groupBy() with limit=max and the limit is exceeded.

  • Other

    • When searching for queries using the Query Monitor in Cluster Administration you can now filter queries based on internal and external query IDs.

    • Reduced memory usage for queries that include noResultUntilDone: true in their inputs. This reduces memory usage in queries that do "export" of an aggregate result via the Query API, as well as the "inner" queries in joins, and queries from scheduled searches.

    • It is now possible to select an entire permissions group when configuring permissions for a role.

    • Added an option to make token hashing output in json format. See tokenhashing usage described at Hashed Root Access Token.

    • When configuring SAML and OIDC for an organization, for users with the ManageOrganizations permission to enable/disable whether the IDP is Default and Humio managed.

    • Add UI for enabling and disabling social logins on the identity providers page.

      • Added the possibility of creating a role that grants permissions on the system and organization levels from the UI.

      • Updated the flow of creating and editing roles in the Organization Settings pages.

    • In case view is not found we will try to fixup the cache on all cluster nodes.

    • Added new system permission, PatchGlobal, enabling access to the global patch API.

    • Allow any root user and any user with the PatchGlobal permission to use the global patch API. Previously required using the server-local special bootstraps root token, that would be valid only on the local node, thus hard to use via a load balancer.

    • In the dialog for entering a name, when creating a new entity (Alerts, Actions, Scheduled Searches, Parsers), hitting Enter without filling out the name field will now show an error and will not let you go on to the next page.

    • Permit the first character in the field name of a field being turned into a tag to be anything. If the first character does not match [a-zA-Z] then strip that from the resulting tag name. This does not alter the set of allowed names for tags, but allows the field names being turned into tags to have any character as the leading one, e.g. permitting examples such as &path and *path as field names to turn into the tag #path.

    • Added support for writing H in place of minutes in the cron schedule of scheduled searches — see Cron Schedule Templates for details.

    • With the new implementation for running alerts, alerts will now start faster after a node has been restarted, making it easier for alerts with a small search interval to be able to alert on events during the downtime.

    • When saving a parser, validate that the fields designated as tag fields have names that are valid as tag field names. Since packages with invalid parsers cannot be installed, if you have an invalid parser in a package, you will need to edit it to keep being able to install it.

Bug Fixes

  • Falcon Data Replicator

    • Fixed a bug where a dropdown for choosing a parser was not visible in a dialog when creating a new FDR feed.

    • Removed the deprecated feature flag `FdrFeeds`

  • UI Changes

    • Fixed a bug in the computation of query metadata that is used by the UI, which, for example, caused problems showing pie charts with queries containing both groupBy() and top().

  • GraphQL API

    • Fixed an error when querying for actions in GraphQL on a deleted view.

    • Marked all feature flags as preview in GraphQL, which means that once they are no longer needed, they will be removed without being deprecated first.

  • Dashboards and Widgets

    • Fixed a bug where certain queries would make it seem that all widgets were incompatible, even though the table view still works.

      Importing a dashboard with Shared time enabled and Live disabled would import the dashboard with Live enabled. Likewise, when creating a new dashboard from a template, Live would be on.

    • Fixed an issue where wordwrap did not work in the Inspect Panel.

    • The Single Value color threshold list could get into a state where you could not type threshold values into the four text fields.

    • The Apply Filter button on the dashboard correctly applies the typed filter again.

  • Functions

    • Fixed a recent bug which caused the category links from groupBy()-groups to be lost when a subsequent sort() was used, and also made grouping-based charts (bar, pie, heat map) unusable in such cases.

  • Other

    • Fixed an issue with tags in Event Forwarding, so that it is now possible to filter on tags using event forwarding rules, and the tags are present in the forwarded events.

    • Fixed an issue where the HTTP threads (Akka pool) could get blocked while sending ingest requests to Kafka, which could result in Humio HTTP endpoints not responding.

    • Fixed an issue where delete events from a minisegment could result in the merge of those minisegments into the resulting target segment never got executed.

    • Fixed an issue where some segments could stall the background process implementing event redaction. This could then result in segments not being merged. The visible symptom would be segments with topOffset attribute being -1, and MiniSegmentMergeLatencyLoggerJob logging that some segments are not being merged.

    • It is no longer possible to have an upload file action with a path in the file name. This would result in an unusable file being created.

    • Fixing an issue, where the sessions of a user wasn't revoked when the user was deleted.

    • Fixed an issue where queries could fail when the requests within the cluster were more than 8 MB each.

    • Fix a regression introduced in 1.46.0 that can cause Humio to fail to properly replay data from Kafka when a node is restarted.

    • Fixes a bug where a placeholder would appear for the region selector on the login pages, even though it itself wouldn't be shown since it has no configured regions.

    • We have removed the @host field from the humio-activity logs and the #host tag from the humio-audit log, as we can no longer provide meaningful values for these. The @host field in the humio-metrics logs will remain, but its value will be changed to the vhost id (an integer number).

  • Packages

    • Previously parsing packages was very strict, falling when detecting unsupported files. This is no longer the case, unsupported files will now be ignored and won't stop the package from installing.

Humio Server 1.56.1 Preview (2022-09-20)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.56.1Preview2022-09-202022-09-261.30NoNo

Update.

Improvements, new features and functionality

  • UI Changes

    • Humio is now a Falcon product. The Humio owl logo and icons are therefore replaced by beautiful falcons.

Humio Server 1.56.0 Preview (2022-09-06)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.56.0Preview2022-09-062022-09-261.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • UI Changes

    • The event lists column header menus have been redesigned to be simpler:

      • You can now click the border between columns header in the event to fit the column to the content.

      • The Event List column Format Panel has been updated to make it easier to manage columns.

      See Formatting Columns.

    • Humio is now a Falcon product. The Humio owl logo and icons are therefore replaced by beautiful falcons.

    • It is now possible to interact directly with the JSON properties and values in the EventList.

    • In the Event List you can assign data types to a column field. You can now make the setting the default for a fields and the setting is remembered when even the field is added to the Event List, e.g. from the fields panel on the Search page. The button for assigning default data type to a field can be found in the Data type dropdown menu in the column headers of the event list widget. See Fields Data Types.

  • Dashboards and Widgets

    • Implemented support for widgets with a fixed time interval on dashboards.

  • Functions

    • BREAKING CHANGE: Changes to the serialization format of the Intermediate Language representation of queries.

      Description: The serialization format used to serialize the intermediate language representation of queries has changed to a JSON format. This has multiple consequences for on-prem customers. During upgrades to this version and rollbacks from this version you can expect the following:

      • Queries can be slower than usual initially as the query cache clears itself.

      • Queries may cause deserialization errors if they are run during upgrade and two or more nodes have different versions. It is recommended to block all queries upon upgrade and downgrade to and from this version and have all nodes upgrade at the same time.

  • Other

      • Added the possibility of creating a role that grants permissions on the system and organization levels from the UI.

      • Updated the flow of creating and editing roles in the Organization Settings pages.

Bug Fixes

  • Falcon Data Replicator

    • Removed the deprecated feature flag `FdrFeeds`

  • GraphQL API

    • Marked all feature flags as preview in GraphQL, which means that once they are no longer needed, they will be removed without being deprecated first.

  • Dashboards and Widgets

    • Fixed a bug where certain queries would make it seem that all widgets were incompatible, even though the table view still works.

      Importing a dashboard with Shared time enabled and Live disabled would import the dashboard with Live enabled. Likewise, when creating a new dashboard from a template, Live would be on.

  • Other

    • Fixed an issue with tags in Event Forwarding, so that it is now possible to filter on tags using event forwarding rules, and the tags are present in the forwarded events.

    • Fixed an issue where some segments could stall the background process implementing event redaction. This could then result in segments not being merged. The visible symptom would be segments with topOffset attribute being -1, and MiniSegmentMergeLatencyLoggerJob logging that some segments are not being merged.

    • It is no longer possible to have an upload file action with a path in the file name. This would result in an unusable file being created.

Humio Server 1.55.0 Preview (2022-08-30)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.55.0Preview2022-08-302022-09-261.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • UI Changes

    • It is now possible to scroll to the selected event on the Search page.

  • Automation and Alerts

    • When you create or edit an action it will now show a warning dialog if you have unsaved changes.

    • When creating new Actions, the new name will now stay when you change the Action Type without getting cleared. This also works when you want to change the New Action name while creating a New Action.

  • Functions

  • Other

    • It is now possible to select an entire permissions group when configuring permissions for a role.

    • In the dialog for entering a name, when creating a new entity (Alerts, Actions, Scheduled Searches, Parsers), hitting Enter without filling out the name field will now show an error and will not let you go on to the next page.

Bug Fixes

  • Other

    • Fixing an issue, where the sessions of a user wasn't revoked when the user was deleted.

Humio Server 1.54.0 Preview (2022-08-23)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.54.0Preview2022-08-232022-09-261.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • UI Changes

    • The Log line format type in the Event List will now render fully expanded JSON when a JSON structure starts with a square bracket or curly bracket followed by a newline.

  • Configuration

    • Added environment variable ENABLE_SANDBOXES to make it possible to enable and disable sandbox repositories.

  • Other

    • Added an option to make token hashing output in json format. See tokenhashing usage described at Hashed Root Access Token.

    • When configuring SAML and OIDC for an organization, for users with the ManageOrganizations permission to enable/disable whether the IDP is Default and Humio managed.

Bug Fixes

  • Functions

    • Fixed a recent bug which caused the category links from groupBy()-groups to be lost when a subsequent sort() was used, and also made grouping-based charts (bar, pie, heat map) unusable in such cases.

  • Other

    • Fixed an issue where queries could fail when the requests within the cluster were more than 8 MB each.

  • Packages

    • Previously parsing packages was very strict, falling when detecting unsupported files. This is no longer the case, unsupported files will now be ignored and won't stop the package from installing.

Humio Server 1.53.0 Preview (2022-08-16)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.53.0Preview2022-08-162022-09-261.30.0NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • Other

    • When searching for queries using the Query Monitor in Cluster Administration you can now filter queries based on internal and external query IDs.

    • Reduced memory usage for queries that include noResultUntilDone: true in their inputs. This reduces memory usage in queries that do "export" of an aggregate result via the Query API, as well as the "inner" queries in joins, and queries from scheduled searches.

    • Add UI for enabling and disabling social logins on the identity providers page.

Bug Fixes

  • Dashboards and Widgets

    • Fixed an issue where wordwrap did not work in the Inspect Panel.

    • The Single Value color threshold list could get into a state where you could not type threshold values into the four text fields.

    • The Apply Filter button on the dashboard correctly applies the typed filter again.

  • Other

    • Fixed an issue where delete events from a minisegment could result in the merge of those minisegments into the resulting target segment never got executed.

    • We have removed the @host field from the humio-activity logs and the #host tag from the humio-audit log, as we can no longer provide meaningful values for these. The @host field in the humio-metrics logs will remain, but its value will be changed to the vhost id (an integer number).

Humio Server 1.52.0 Preview (2022-08-09)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.52.0Preview2022-08-092022-09-261.30NoNo

Bug fixes and updates.

Improvements, new features and functionality

  • Falcon Data Replicator

    • The feature flag for FDR feeds has been removed. FDR feeds are now generally available.

  • Documentation

  • Automation and Alerts

    • A major change has been made to how alert queries are run in order to better reuse live queries when nodes are restarted in a Humio cluster. Find more details at Alerts.

  • GraphQL API

    • Deprecates the defaultSharedTimeIsLive input field on the updateDashboard GraphQL mutation, in favor of updateFrequency.

  • Configuration

    • New dynamic configuration MinimumHumioVersion, default value is 0.0.0, that allows setting a minimum Humio version that this cluster will accept starting on. This allows protecting against inadvertently later rolling back too far for some other feature to be turned on, that has an implied minimum version for support of that feature.

    • On cloud: added a configuration on dynamic identity providers to configure if users are allowed to be lazily created.

  • Functions

    • Improved warning message when using groupBy() with limit=max and the limit is exceeded.

  • Other

    • In case view is not found we will try to fixup the cache on all cluster nodes.

    • Added new system permission, PatchGlobal, enabling access to the global patch API.

    • Allow any root user and any user with the PatchGlobal permission to use the global patch API. Previously required using the server-local special bootstraps root token, that would be valid only on the local node, thus hard to use via a load balancer.

    • Permit the first character in the field name of a field being turned into a tag to be anything. If the first character does not match [a-zA-Z] then strip that from the resulting tag name. This does not alter the set of allowed names for tags, but allows the field names being turned into tags to have any character as the leading one, e.g. permitting examples such as &path and *path as field names to turn into the tag #path.

    • Added support for writing H in place of minutes in the cron schedule of scheduled searches — see Cron Schedule Templates for details.

    • With the new implementation for running alerts, alerts will now start faster after a node has been restarted, making it easier for alerts with a small search interval to be able to alert on events during the downtime.

    • When saving a parser, validate that the fields designated as tag fields have names that are valid as tag field names. Since packages with invalid parsers cannot be installed, if you have an invalid parser in a package, you will need to edit it to keep being able to install it.

Bug Fixes

  • Falcon Data Replicator

    • Fixed a bug where a dropdown for choosing a parser was not visible in a dialog when creating a new FDR feed.

  • UI Changes

    • Fixed a bug in the computation of query metadata that is used by the UI, which, for example, caused problems showing pie charts with queries containing both groupBy() and top().

  • GraphQL API

    • Fixed an error when querying for actions in GraphQL on a deleted view.

  • Other

    • Fixes a bug where a placeholder would appear for the region selector on the login pages, even though it itself wouldn't be shown since it has no configured regions.

Humio Server 1.51.2 Stable (2022-10-05)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.51.2Stable2022-10-052023-10-051.30.0NoNo
JAR ChecksumValue
MD5e21bc8fda9250669b15d7d61521501f7
SHA150669930b6f27b097221b7e9a12cc9b061d70e52
SHA256aec3efe7a376ada047e813aad87cd68c43a8ea0de1cfb863190b77265b3f8d32
SHA5121b9cec3f814d207bcc49ce9c43bcfcd139f7ddfaedd293c9a20fdfee2898aa0ff5fb5c82374eef2371e31753e331e15f8a6646a0e23b326885a1105fbd6081d4
Docker ImageSHA256 Checksum
humio-core-devaf30f2076612b8e04a8c55172b3ff6cbd41d09b9be64b0267d9f8bd6d3b9efdc
humio-deva63f552480e3e1ccaa22a095ff7b98efcbfc01d9e66fa7f1b40b45242226fc4en
kafka-dev723d25e8ba4bfb7247c4d39021155681aefab20f584c2d7db786941aa9d1522d
zookeeper-dev5878dbf9e32a0913da59d0b2e8dd13c5c7ba6043ba933a8b23d368f0d1241315

Bug fixes and updates.

Bug Fixes

  • Security

    • Update Scala to address CVE-2022-36944.

  • Dashboards and Widgets

    • Fixed a bug where certain queries would make it seem that all widgets were incompatible, even though the table view still works.

      Importing a dashboard with Shared time enabled and Live disabled would import the dashboard with Live enabled. Likewise, when creating a new dashboard from a template, Live would be on.

  • Other

    • Fixed an issue where some segments could stall the background process implementing event redaction. This could then result in segments not being merged. The visible symptom would be segments with topOffset attribute being -1, and MiniSegmentMergeLatencyLoggerJob logging that some segments are not being merged.

    • Fix a regression introduced in 1.46.0 that can cause Humio to fail to properly replay data from Kafka when a node is restarted.

Humio Server 1.51.1 Stable (2022-08-29)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.51.1Stable2022-08-292023-08-291.30.0NoNo
JAR ChecksumValue
MD56410ab777ec6d98066a3492f4a6b68af
SHA12b55844a4c4d5d613f091a7a753977e6b51477f4
SHA256a8beb23cfa0b00aebbd4a4a95665deedcce868c0be1de5c5383601fd55ba60f9
SHA512c37d2ee75d3b7ac4259fd453c24fa8ada18de360837ba475cf552747ac1b0b07dfce618ced2708e51ee9d66c5ff1a36081bb57a2531922930c385846ac80d73c
Docker ImageSHA256 Checksum
humio-core-devf232ce1b182b74bb534249fbf8eba1ab41544242353e1fe4d21f69a0e6a7c190
humio-dev10c21dbc2eba33d4e401b0559ae0ecacfd1f80e9184b946164e674068380d286
kafka-dev98fe1b8f3c6caadb6efb6de3e5be3215e9987f235c1134ac0e14eb8705d1d2d8
zookeeper-dev97c571a338e94b9ecaf66c6e9625c593dff68fe62c04c1b2a1ffd44bf10d39ba

Bug fix.

Bug Fixes

  • Dashboards and Widgets

    • The Apply Filter button on the dashboard correctly applies the typed filter again.

  • Functions

    • Fixed a recent bug which caused the category links from groupBy()-groups to be lost when a subsequent sort() was used, and also made grouping-based charts (bar, pie, heat map) unusable in such cases.

    • Fixed a bug related to query result metadata for some functions when used as the last aggegate function in a query.

  • Other

    • Fixed an issue where queries could fail when the requests within the cluster were more than 8 MB each.

    • Fixed an issue for ephemeral disk based installs where segment files could stay longer on local disks than they were required to, in cases where some nodes listed in the cluster were not alive for extended periods of time.

Humio Server 1.51.0 Stable (2022-08-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.51.0Stable2022-08-152023-08-151.30.0NoNo
JAR ChecksumValue
MD5af0041ec27647291086073dc83628bc2
SHA1210e924a2863c3b28d08659241c0a283482c12b8
SHA256fddcb2184d76d5cfefb2f6a02705f66764d8972fb2e664ef7115353344d05680
SHA5122b230a836e18d13a282ea28be23130897876e6cbe0bfa30a71a3795a7704255cbdf1c19eadc094cd970e58e0234c540a6b469266765d736fc6435c0a01bbda1e
Docker ImageSHA256 Checksum
humio-core-dev36dbe1d90534d2ca72bdadb4992397aa60d2315565ce7a3c7c272a48617cf759
humio-devc5db5fac0b03adf9039c31ef4ba69c49356b230b01e0eab0b16c477768dd52af
kafka-dev92de8c0d092fe5c04cc10e076a9bb183c8f3136b9813f3ae74b423ae090cb0d8
zookeeper-dev85620182a8c5f91426e0d138ca21947975c99a16fbb00f9e7d0c0ca7a8e94d2a

Bug fixes and updates.

Deprecation

These items have been deprecated and may be removed in a future release:

  • The deprecated REST API for parsers has been removed.

  • Deprecated enabledFeatures query. Use new featureFlags query instead.

  • The deprecated REST API for actions has been removed, except for the endpoint for testing an action.

Improvements, new features and functionality

  • Falcon Data Replicator

    • Added environment variable FDR_USE_PROXY which makes the fdr job use the proxy settings specified with: HTTP_PROXY_* environment variables.

    • FDR polling is now turned on by default. Whether FDR polling should be turned on or off on a node can be configured using the ENABLE_FDR_POLLING_ON_NODE configuration variable.

      • If an S3 file is found to be incorrectly formatted during FDR ingest, it will not be ingested completely, but an attempt is made to ingest the remaining S3 files of the SQS message.

      • If an S3 file cannot be found during FDR ingest, it will not be ingested, but an attempt is made to ingest the remaining S3 files of the SQS message.

  • UI Changes

    • If Humio fails to start because the cluster is being upgraded, a dedicated message will show when launching the UI.

    • The Save As... button is now always displayed on the Search page, see it described at Saving a Search.

    • When editing an email action in the UI and adding multiple recipients, it is now possible to add a space after the comma in the comma-separated list of recipients.

    • The Live checkbox is now no longer checked automatically when changing the value of the time window in the Time Selector. See Expanding Time Frame for details.

    • Field columns now support multiple formatting options. See Formatting Columns for details.

    • Toggle switches anywhere in the UI are now tabbable and can be accessed using the keyboard.

    • Adds an icon and a hint to a disabled side navigation menu item that tells the user the reason for it being disabled.

    • In lists of users, with user avatars containing user initials, the current user would sometimes appear to have an opening parenthesis as their last initial.

    • The design of the Time Selector has been updated, and it now features an Apply button on the dashboard page. See Time Interval Settings.

    • New styling of errors on search and dashboard pages.

    • Improved keyboard accessibility for creating repositories and views.

    • Add missing accessibility features to the login page.

  • Documentation

    • All documentation links have been updated after the documentation site has been restructured. Please contact support, if you experience any broken links.

  • GraphQL API

    • Introduced new dynamic configuration LiveQueryMemoryLimit. It can be set using graphQL. See Limits for details.

    • Improved error messaging of GraphQL queries and mutations for alerts, scheduled searches and actions in cases where a given repository or view cannot be found.

    • Added a new dynamic configuration flag QueryResultRowCountLimit that globally limits how many results (events) a query can return. This flag can be set by administrators through graphQL. See Limits for more details.

    • Introduced new dynamic configuration GroupMaxLimit. It can be set using graphQL. See Limits for details.

    • Added a GraphQL mutation for testing an action. It is still in preview, but it will replace the equivalent REST endpoint soon.

    • Expose a new GraphQL type with feature flag descriptions and whether they are experimental.

    • Added a new dynamic configuration GroupDefaultLimit. This can be done through GraphQL. See Limits for details. If you've changed the value of MAX_STATE_LIMIT, we recommend that you also change GroupDefaultLimit and GroupMaxLimit to the same value for a seamless upgrade, see groupBy() for details.

    • Introduced new dynamic configuration QueryMemoryLimit. It can be set using graphQL. See also LiveQueryMemoryLimit for live queries. For more details, see Limits.

    • Added preview fields isClusterBeingUpdated and minimumNodeVersion to the GraphQL Cluster object type.

    • Introduced new dynamic configuration StateRowLimit. It can be set using graphQL. See Limits for details.

    • The GQL API mutation updateDashboard has been updated to take a new argument updateFrequency which can currently only be NEVER or REALTIME, which correspond respectively to "dashboard where queries are never updated after first completion" and "dashboard where query results are updated indefinitely".

    • Introduced new dynamic configuration JoinRowLimit. It can be set using graphQL and can be used as an alternative to the environment variable MAX_JOIN_LIMIT. If the JoinRowLimit is set, then its value will be used instead of MAX_JOIN_LIMIT. If it is not set, then MAX_JOIN_LIMIT will be used.

  • Configuration

    • Improve the error message if Humio is configured to use bucket storage, but the credentials for the bucket are not configured.

    • Bucket storage now has support for a new format for the keys (file names) for the files placed in the bucket. When the new format is applied, listing of files only happens for the prefixes "tmp/" and "globalsnapshots/". This help products such a "HCP". The new format is applied only to buckets created after the DynamicConfig BucketStorageKeySchemeVersion has been set to "2". Existing cluster can start using the new format for new files by setting the DynamicConfig. The change will take effect after restarting the cluster. When creating a new Humio clusters, the new format is the default. The new format is supported only on Humio version 1.41+.

    • Default value of configuration variable S3_ARCHIVING_WORKERCOUNT raised from 1 to (vCPU/4).

    • Add environment variable EULA_URL to specificy url for terms and conditions.

    • New file format for files uploaded to bucket storage that allows files larger than 2GB to be written to bucket storage. This may be turned on by setting the DynamicConfig BucketStorageWriteVersion to "3". When creating a new Humio clusters, the new format is the default. The new format is supported only on Humio version 1.41+.

    • New configurations BUCKET_STORAGE_SSE_COMPATIBLE that makes bucket storage not verify checksums of raw objects after uploading to an S3. This option is turned on automatically is KMS is enabled (see S3_STORAGE_KMS_KEY_ARN) but is available directly here for use with other S3 compatible providers where verfying even content length does not work.

      Mini segments usually get merged if their event timestamps span more than MAX_HOURS_SEGMENT_OPEN. Mini segments created as part of backfilling did not follow this rule, but will now get merged if their ingest timestamps span more than MAX_HOURS_SEGMENT_OPEN.

    • Support for KMS on S3 bucket for Bucket Storage. Specify full ARN of the key. The key_id is persisted in the internal BucketEntity so that a later change of the ID of the key to use for uploads will make Humio still refer the old keyID when downloading files uploaded using the previous key. Setting a new value for the target key results in a fresh internal bucket entity to track which files used kms and which did not. For simplicity it is recommended to not mix KMS and non-KMS configurations on the same S3 bucket.

    • Detect need for higher autoshard count by monitoring ingest request flow in the cluster. Dynamically increase the number of autoshards for each datasource to keep flow on each resulting shard below approximately 2MB/s. New DynamicConfig for this that sets the target maximum rate of ingest for each shard of a datasource: TargetMaxRateForDatasource. Default value is 2000000 (2 MB).

    • Added a link to humio-activity repository for debugging IDP configurations to the page for setting up the same.

    • Change default value for configuration AUTOSHARDING_MAX from 16 to 128.

    • Adds a new metric for measuring the merge latency, which is defined as the latency between the last minisegment being written in a sequence with the same merge target, and those minisegments being merged. The metric name is segment-merge-latency-ms.

    • Adds a new logger job that logs the age of an unmerged miniSegment if the age exceeds the threshold set by the env variable MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING. The default value of MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING is 2 x MAX_HOURS_SEGMENT_OPEN. MAX_HOURS_SEGMENT_OPEN defaults to 24 hours. The error log produced looks like: Oldest unmerged miniSegment is older than the threshold thresholdMs={value} miniSegmentAgeMs={value} segment={value}.

    • Added a new environment variable GLOB_MATCH_LIMIT which sets the maximum number of rows for csv_file in match(..., file=csv_file, glob=true). Previously MAX_STATE_SIZE was used to determine this limit. The default value of this variable is 20000. If you've changed the value of MAX_STATE_SIZE, we recommend that you also change GLOB_MATCH_LIMIT to the same value for a seamless upgrade.

  • Dashboards and Widgets

    • The widget legend column width is now based on the custom series title (if specified) instead of the original series name.

    • Note widget:

      • Default background color is now Auto.

      • Introduced the text color configuration option.

    • Added empty states for all widget types that will be rendered when there are no results.

    • Dashboards can now be configured to not update after the initial search has completed. This mode is mainly meant to be used when a dashboard is interactive and not for wall-mounted monitors that should update continually. The feature can be accessed from the Dashboard properties panel when a dashboard is put in edit-mode. See Working in Edit Mode.

    • Introducing the Heatmap widget that visualizes aggregated data as a colorised grid.

    • The Pie Chart widget now uses the first column for the series as a fall back option.

    • Table widgets will now break lines for newline characters in columns.

    • The Normalize option for the World Map widget has been replaced by a third magnitude mode named None, which results in fixed size and opacity for all marks.

    • Single Value widget new configuration: deprecated field use-colorised-thresholds in favor of color-method.

      Single Value widget Editor: the configuration option Enable Thresholds is being replaced by an option called Method under the Colors section.

    • Applied stylistic changes for the Inspect Panel used in Widget Editor.

    • Bar Chart widget:

      • The Y-axis can now start at smaller values than 1 for logarithmic scales, when the data contain small enough values.

      • It now has an Auto setting for the Input Data Format property, see Wide or Long Input Format for details.

      • Now works with bucket query results.

    • The Dashboard page now displays the current cluster status.

    • Pie Chart widget now uses the first column for the series as a fall back option.

    • Sorting of Pie Chart widget categories, descending by value. Categories grouped as Others will always be last.

    • Better handling of dashboard connections issues during restarts and upgrades.

    • When importing existing dashboard with a static Shared time, recent changes in the time selection would make those dashboards live.

    • Single Value widget:

      • Missing buckets are now shown as gaps on the sparkline.

      • Isolated data points are now visualised as dots on the sparkline.

  • Log Collector

    • The Log Collector download page has been enabled for on-prem deployments.

  • Functions

    • Added validation to the field and key parameters of the join() function, so empty lists will be rejected with a meaningful error message.

    • Added validation to the field parameter of the kvParse() function, so empty lists will be rejected with a meaningful error message.

    • Improved the phrasing of the warning shown when groupBy() exceeds the max or default limit.

    • The groupBy() function now accepts max as value for the limit parameter, which sets the limit to the largest allowed value (as configured by the dynamic configuration GroupMaxLimit).

  • Other

    • Fix a bug that could cause Humio to spuriously log errors warning about segments not being merged for datasources doing backfilling.

    • Improved performance of NDJSON format in S3 Archiving.

    • All feature flags now contains a textual description about what features are hidden behind the flag.

    • Fixed a bug where an alert with name longer than 50 characters could not be edited.

    • Compute next set of Prometheus metrics only in a single thread concurrently. If more requests arrive, then the next request gets the previous response.

    • Add warning when a multitenancy user is changing data retention on an unlimited repository.

    • Added a log line for when a query exceeds its allotted memory quota.

    • Added a new action type that creates a CSV file from the query result and uploads it to Humio to be used with the match() query function. See Upload File.

    • The referrer meta tag for Humio has been changed from no-referrer to same-origin.

    • Bump the version of the Monaco code editor.

    • Make BucketStorageUploadJob only log at info level rather than error if a segment upload fails because the segment has been removed from the host. This can happen if node X tries to upload a segment, but node Y beats it to the punch. Node X may then choose to remove its copy before the upload completes.

    • Fix a bug causing Humio's digest coordinator to allow nodes to take over digest without catching up to the current leader. This could cause the new leader to replay more data from Kafka than necessary.

    • The audit log system repository on Cloud has been replaced with a view, so that dashboards etc. can be created on top of audit log data.

    • Fixed an issue where query auto-completion sometimes wouldn't show the documentation for the suggested functions.

    • Adds a new metric for the temp disk usage. The metric name is temp-disk-usage-bytes and denotes how many bytes are used.

    • Make a number of improvements to the digest partition coordinator. The coordinator now tries harder to avoid assigning digest to nodes that are not caught up on fetching segments from the other nodes. It also does a better job unassigning digest from dead nodes in edge cases.

    • Adds a logger job for cluster management stats it log the stats every 2 minutes, which makes them searchable in Humio.

      The logs belong to the class c.h.c.ClusterManagementStatsLoggerJob, logs for all segments contains globalSegmentStats log about singular segments starts with segmentStats.

    • Added a log message with the maximum state size seen by the live part of live queries.

    • All users will not have access to the audit log or search all view by default anymore. Access can be granted with permissions.

    • Added detection and handling of all queries being blocked during Humio upgrades.

    • Humio now logs digest partition assignments regularly. The logs can be found using the query class=*DigestLeadershipLoggerJob*.

    • Remove remains of default groups and roles. The concept was replaced with UserRoles.

    • Streaming queries that fail to validate now return a message of why validation failed.

    • Fix an unhandled IO exception from TempDirUsageJob. The consequence of the uncaught exception was only noise in the error log.

    • Java in the docker images no longer has the cap_net_bind_service capability and thus Humio cannot bind directly to privileged ports when running as a non-root user.

    • When unregistering a node from a cluster, return a validation error if it is still alive. Hosts should be shut down before attempting to remove them from the cluster. This validation can be skipped using the same accept-data-loss parameter that also disables other validations for the unregistration endpoint.

    • Include the requester in logs from QuerySessions when a live query is restarted or cancelled.

    • Add flag whether a feature is experimental.

    • Added a log of the approximate query result size before transmission to the frontend, captured by the approximateResultBeforeSerialization key.

Bug Fixes

  • Security

    • Bump javax.el to address CVE-2021-28170.

    • Update Netty to address CVE-2022-24823.

  • Falcon Data Replicator

    • FDR Ingest will no longer fail on events that are larger than the maximum allowed event size. Instead, such messages will be truncated.

  • UI Changes

    • Fix the dropdown menus closing too early on the home page.

    • When viewing the events behind e.g. a Time Chart, the events will now only display with the @timestamp and @rawstring columns.

    • Fixed a bug where the "=" and "/=" buttons did not appear on cells in the event list where they should.

    • Prevent the UI showing errors for smaller connection issues while restarting.

    • Intermediate network issues are not reported immediately as an error in the UI.

    • Websocket connections are now kept open when transitioning pages, and are used more efficiently for syntax highlighting.

    • Cloud: Updated the layout for license key page.

  • GraphQL API

    • Fix the assets GraphQL query in organizations with views that are not 1-to-1 linked.

  • Configuration

    • Fixed an issue where event forwarding still showed as beta.

    • Fixed an issue where delete events from a minisegment could result in the merge of those minisegments into the resulting target segment never got executed.

      Index in block needs reading from blockwriter before adding each item.

      Fixed a bug where the @id field of events in live query were off by one.

    • Fixed a bug that could result in merging small ("undersized") segments even if the resulting segment would then have a wider than desired time span. The goal it to not produce segments that span more than the 10% of the retention setting for time for the repository. If no time-based retention is configured on the repository, then 3 times the value of configuration variable MAX_HOURS_SEGMENT_OPEN is applied as limit. For default settings, that results in 72 hours.

  • Dashboards and Widgets

    • The Time Chart widget regression line is no longer affected by the interpolation setting.

    • The theme toggle on a shared dashboard was moved to the header panel and no longer overlaps with any widgets.

  • Functions

    • Fixed a bug where using eval as an argument to a function would result in a confusing error message.

    • Revised some of the error messages and warnings regarding join() and selfJoin().

    • Fixed a bug where ioc:lookup() would sometimes give incorrect results when negated.

    • Fixed a bug where the writeJson() function would write any field starting with a case-insensitive inf or infinity prefix as a null value in the resulting JSON.

  • Other

    • Fix a bug that could cause a NumberFormatException to be thrown from ZookeeperStatsClient.

    • Fix an issue that could rarely cause exceptions to be thrown from Segments.originalBytesWritten, causing noise in the log.

    • Bump woodstox to address SNYK-JAVA-COMFASTERXMLWOODSTOX-2928754.

    • Fixed an issue where some warnings would show twice.

    • Fix an issue causing Humio to create a large number of temporary directories in the data directory.

    • Fixed an issue where JSON parsing on ingest and in the query language was inefficient for large JSON objects.

    • Humio will now clean up its tmp directories by deleting all "humiotmp" directories in the data directory when terminating gracefully.

      Fix a regression in the launcher script causing JVM_LOG_DIR to not be evaluated relative to the Humio base install path. All paths in the launcher script should now be relative to the base install path, which is the directory containing the bin folder.

      Fix a bug that could cause merge targets to be cached indefinitely if the associated minis had their mergeTarget unset. The effect was a minor memory leak.

      Fix a bug that could cause Humio to attempt to merge minisegments from one datasource into a segment in another datasource, causing an error to be thrown.

      When configuring thread priorities, Humio will no longer attempt to call the native setpriority function. It will instead only call the Java API for setting thread priority.

    • Fixed an issue where query auto-completion would sometimes delete existing parentheses.

    • Centralise decision for names of files in bucket, allow more than one variant.

      Improved hover messages for strings.

    • Update org.json:json to address a vulnerability that could cause stack overflows.

    • Fix a bug causing digesters to continue digesting even if the local disk is full. The digester will now pause digesting and error log if this occurs.

    • Fix a bug where changing a role for a user under a repository would trigger infinite network requests.

    • If a segment is deleted or otherwise disappears from global while Humio is attempting to upload it to bucket storage, the upload will now be dropped with an info-level log, rather than requeued with an error log.

    • Upgrade Kafka to 3.2.0 in the docker images, and in the Humio dependencies.

    • Fix type in Unregisters node text on cluster admin UI.

      • Fixed an issue where event forwarder properties were not properly validated.

      • Reduced the timeout used when testing event forwarders in order to get a better error when timeouts happen.

    • Fix an issue causing the event forwarding feature to incorrectly reject topic names that contained a dash (-).

    • Fixed a bug where multiline comments weren't always highlighted correctly.

    • Make streaming queries search segments newest-to-oldest rather than oldest-to-newest. Streaming queries do not ensure the order of exported events anyway, and searching newest-to-oldest is more efficient.

    • Improve file path handling in DiskSpaceJob to eliminate edge cases where the job might not have been able to tell if a file was on primary or secondary storage.

    • Fix performance issue for users with access to many views.

    • Some errors messages wrongly pointed to the beginning of the query.

    • Fixed an issue where strings like Nana and Information could be interpreted as NaN (not-a-number) and infinity, respectively.

    • Fixes the placement of a confirmation dialog when attempting to change retention.

    • Fix response entities not being discarded in error cases for the proxyqueryjobs endpoint, which could cause warnings in the log.

Humio Server 1.50.0 Preview (2022-08-02)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.50.0Preview2022-08-022022-08-151.30.0NoNo

Bug fixes and an updated dependency, released to cloud only.

Improvements, new features and functionality

  • UI Changes

    • When editing an email action in the UI and adding multiple recipients, it is now possible to add a space after the comma in the comma-separated list of recipients.

    • Adds an icon and a hint to a disabled side navigation menu item that tells the user the reason for it being disabled.

    • The design of the Time Selector has been updated, and it now features an Apply button on the dashboard page. See Time Interval Settings.

  • Documentation

    • All documentation links have been updated after the documentation site has been restructured. Please contact support, if you experience any broken links.

  • GraphQL API

    • The GQL API mutation updateDashboard has been updated to take a new argument updateFrequency which can currently only be NEVER or REALTIME, which correspond respectively to "dashboard where queries are never updated after first completion" and "dashboard where query results are updated indefinitely".

  • Dashboards and Widgets

    • Dashboards can now be configured to not update after the initial search has completed. This mode is mainly meant to be used when a dashboard is interactive and not for wall-mounted monitors that should update continually. The feature can be accessed from the Dashboard properties panel when a dashboard is put in edit-mode. See Working in Edit Mode.

  • Functions

    • Added validation to the field and key parameters of the join() function, so empty lists will be rejected with a meaningful error message.

    • Added validation to the field parameter of the kvParse() function, so empty lists will be rejected with a meaningful error message.

    • Improved the phrasing of the warning shown when groupBy() exceeds the max or default limit.

    • Added validation to the field parameter of the top() function, so empty lists will be rejected with a meaningful error message.

  • Other

    • Added a new action type that creates a CSV file from the query result and uploads it to Humio to be used with the match() query function. See Upload File.

    • Fixed an issue where query auto-completion sometimes wouldn't show the documentation for the suggested functions.

    • Humio now logs digest partition assignments regularly. The logs can be found using the query class=*DigestLeadershipLoggerJob*.

    • Streaming queries that fail to validate now return a message of why validation failed.

Bug Fixes

  • GraphQL API

    • Fix the assets GraphQL query in organizations with views that are not 1-to-1 linked.

  • Configuration

    • Fixed an issue where validation of +/- Infinity as integer arguments would crash.

    • Fixed an issue where event forwarding still showed as beta.

  • Functions

    • Fixed an issue where join() would not produce the correct results when mode=left was set.

  • Other

    • Fix an issue that could rarely cause exceptions to be thrown from Segments.originalBytesWritten, causing noise in the log.

    • Fix an issue causing Humio to create a large number of temporary directories in the data directory.

    • Fixed an issue where JSON parsing on ingest and in the query language was inefficient for large JSON objects.

    • Fixed an issue where query auto-completion would sometimes delete existing parentheses.

    • Fix performance issue for users with access to many views.

Humio Server 1.49.1 Preview (2022-07-26)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.49.1Preview2022-07-262022-08-151.30.0NoNo

Bug fixes and an updated dependency, released to cloud only.

Deprecation

These items have been deprecated and may be removed in a future release:

  • The deprecated REST API for parsers has been removed.

Improvements, new features and functionality

  • UI Changes

    • The Save As... button is now always displayed on the Search page, see it described at Saving a Search.

  • Functions

    • The groupBy() function now accepts max as value for the limit parameter, which sets the limit to the largest allowed value (as configured by the dynamic configuration GroupMaxLimit).

  • Other

    • Parser installation will now be ignored when installing a package into a system repository.

    • Fixed a bug where an alert with name longer than 50 characters could not be edited.

    • Make BucketStorageUploadJob only log at info level rather than error if a segment upload fails because the segment has been removed from the host. This can happen if node X tries to upload a segment, but node Y beats it to the punch. Node X may then choose to remove its copy before the upload completes.

    • Fix an unhandled IO exception from TempDirUsageJob. The consequence of the uncaught exception was only noise in the error log.

    • Java in the docker images no longer has the cap_net_bind_service capability and thus Humio cannot bind directly to privileged ports when running as a non-root user.

Bug Fixes

  • Functions

    • Revised some of the error messages and warnings regarding join() and selfJoin().

  • Other

    • Fix a bug that could cause a NumberFormatException to be thrown from ZookeeperStatsClient.

    • Fixed an issue where some warnings would show twice.

    • Fixed an issue where strings like Nana and Information could be interpreted as NaN (not-a-number) and infinity, respectively.

Humio Server 1.49.0 Not Released (2022-07-26)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.49.0Not Released2022-07-262022-08-151.30.0NoNo

Not released.

Humio Server 1.48.1 Preview (2022-07-19)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.48.1Preview2022-07-192022-08-151.30.0NoNo

Bug fixes and an updated dependency, released to cloud only.

Deprecation

These items have been deprecated and may be removed in a future release:

  • Remove the following feature flags and their usage: EnterpriseLogin, OidcDynamicIdpProviders, UsagePage, RequestToActivity, CommunityNewDemoData.

  • Deprecated enabledFeatures query. Use new featureFlags query instead.

Improvements, new features and functionality

  • UI Changes

    • The Live checkbox is now no longer checked automatically when changing the value of the time window in the Time Selector. See Expanding Time Frame for details.

    • Updated styling on the log in pages.

    • Add missing accessibility features to the login page.

  • GraphQL API

    • Expose a new GraphQL type with feature flag descriptions and whether they are experimental.

  • Other

    • All feature flags now contains a textual description about what features are hidden behind the flag.

    • Added detection and handling of all queries being blocked during Humio upgrades.

    • Include the requester in logs from QuerySessions when a live query is restarted or cancelled.

    • Add flag whether a feature is experimental.

Bug Fixes

  • UI Changes

    • When viewing the events behind e.g. a Time Chart, the events will now only display with the @timestamp and @rawstring columns.

  • Dashboards and Widgets

    • The theme toggle on a shared dashboard was moved to the header panel and no longer overlaps with any widgets.

  • Other

    • Fixes the placement of a confirmation dialog when attempting to change retention.

    • Fix response entities not being discarded in error cases for the proxyqueryjobs endpoint, which could cause warnings in the log.

Humio Server 1.48.0 Not Released (2022-07-19)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.48.0Not Released2022-07-192022-08-151.30.0NoNo

Not released.

Humio Server 1.47.1 Preview (2022-07-12)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.47.1Preview2022-07-122022-08-151.30.0NoNo

Bug fixes and an updated dependency, released to cloud only.

Improvements, new features and functionality

  • Falcon Data Replicator

    • FDR polling is now turned on by default. Whether FDR polling should be turned on or off on a node can be configured using the ENABLE_FDR_POLLING_ON_NODE configuration variable.

  • UI Changes

    • If Humio fails to start because the cluster is being upgraded, a dedicated message will show when launching the UI.

  • GraphQL API

    • Introduced new dynamic configuration LiveQueryMemoryLimit. It can be set using graphQL. See Limits for details.

    • Added a new dynamic configuration flag QueryResultRowCountLimit that globally limits how many results (events) a query can return. This flag can be set by administrators through graphQL. See Limits for more details.

    • Introduced new dynamic configuration GroupMaxLimit. It can be set using graphQL. See Limits for details.

    • Added a new dynamic configuration GroupDefaultLimit. This can be done through GraphQL. See Limits for details. If you've changed the value of MAX_STATE_LIMIT, we recommend that you also change GroupDefaultLimit and GroupMaxLimit to the same value for a seamless upgrade, see groupBy() for details.

    • Introduced new dynamic configuration QueryMemoryLimit. It can be set using graphQL. See also LiveQueryMemoryLimit for live queries. For more details, see Limits.

    • Added preview fields isClusterBeingUpdated and minimumNodeVersion to the GraphQL Cluster object type.

    • Introduced new dynamic configuration StateRowLimit. It can be set using graphQL. See Limits for details.

    • Introduced new dynamic configuration JoinRowLimit. It can be set using graphQL and can be used as an alternative to the environment variable MAX_JOIN_LIMIT. If the JoinRowLimit is set, then its value will be used instead of MAX_JOIN_LIMIT. If it is not set, then MAX_JOIN_LIMIT will be used.

  • Configuration

    • New configurations BUCKET_STORAGE_SSE_COMPATIBLE that makes bucket storage not verify checksums of raw objects after uploading to an S3. This option is turned on automatically is KMS is enabled (see S3_STORAGE_KMS_KEY_ARN) but is available directly here for use with other S3 compatible providers where verfying even content length does not work.

      Mini segments usually get merged if their event timestamps span more than MAX_HOURS_SEGMENT_OPEN. Mini segments created as part of backfilling did not follow this rule, but will now get merged if their ingest timestamps span more than MAX_HOURS_SEGMENT_OPEN.

    • Support for KMS on S3 bucket for Bucket Storage. Specify full ARN of the key. The key_id is persisted in the internal BucketEntity so that a later change of the ID of the key to use for uploads will make Humio still refer the old keyID when downloading files uploaded using the previous key. Setting a new value for the target key results in a fresh internal bucket entity to track which files used kms and which did not. For simplicity it is recommended to not mix KMS and non-KMS configurations on the same S3 bucket.

  • Dashboards and Widgets

    • Table widgets will now break lines for newline characters in columns.

    • Applied stylistic changes for the Inspect Panel used in Widget Editor.

  • Other

    • Fix a bug that could cause Humio to spuriously log errors warning about segments not being merged for datasources doing backfilling.

    • Compute next set of Prometheus metrics only in a single thread concurrently. If more requests arrive, then the next request gets the previous response.

    • The referrer meta tag for Humio has been changed from no-referrer to same-origin.

    • The audit log system repository on Cloud has been replaced with a view, so that dashboards etc. can be created on top of audit log data.

    • Improved performance of validation of keys in tags.

    • All users will not have access to the audit log or search all view by default anymore. Access can be granted with permissions.

Bug Fixes

  • Functions

    • Fixed a bug where using eval as an argument to a function would result in a confusing error message.

  • Other

    • Fix type in Unregisters node text on cluster admin UI.

Humio Server 1.47.0 Not Released (2022-07-12)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.47.0Not Released2022-07-122022-08-151.30.0NoNo

Not released.

Humio Server 1.46.0 Preview (2022-07-05)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.46.0Preview2022-07-052022-08-151.30.0NoNo

Bug fixes and an updated dependency, released to cloud only.

Improvements, new features and functionality

  • UI Changes

    • In lists of users, with user avatars containing user initials, the current user would sometimes appear to have an opening parenthesis as their last initial.

    • New styling of errors on search and dashboard pages.

  • GraphQL API

    • Improved error messaging of GraphQL queries and mutations for alerts, scheduled searches and actions in cases where a given repository or view cannot be found.

  • Dashboards and Widgets

    • The widget legend column width is now based on the custom series title (if specified) instead of the original series name.

    • Added empty states for all widget types that will be rendered when there are no results.

    • Introducing the Heatmap widget that visualizes aggregated data as a colorised grid.

    • Sorting of Pie Chart widget categories, descending by value. Categories grouped as Others will always be last.

    • Better handling of dashboard connections issues during restarts and upgrades.

  • Other

    • Fix a bug causing Humio's digest coordinator to allow nodes to take over digest without catching up to the current leader. This could cause the new leader to replay more data from Kafka than necessary.

    • Make a number of improvements to the digest partition coordinator. The coordinator now tries harder to avoid assigning digest to nodes that are not caught up on fetching segments from the other nodes. It also does a better job unassigning digest from dead nodes in edge cases.

    • Remove remains of default groups and roles. The concept was replaced with UserRoles.

    • When unregistering a node from a cluster, return a validation error if it is still alive. Hosts should be shut down before attempting to remove them from the cluster. This validation can be skipped using the same accept-data-loss parameter that also disables other validations for the unregistration endpoint.

Bug Fixes

  • Falcon Data Replicator

    • FDR Ingest will no longer fail on events that are larger than the maximum allowed event size. Instead, such messages will be truncated.

  • UI Changes

    • Intermediate network issues are not reported immediately as an error in the UI.

  • Configuration

    • Fixed a bug that could result in merging small ("undersized") segments even if the resulting segment would then have a wider than desired time span. The goal it to not produce segments that span more than the 10% of the retention setting for time for the repository. If no time-based retention is configured on the repository, then 3 times the value of configuration variable MAX_HOURS_SEGMENT_OPEN is applied as limit. For default settings, that results in 72 hours.

  • Functions

    • Fixed a bug where the writeJson() function would write any field starting with a case-insensitive inf or infinity prefix as a null value in the resulting JSON.

  • Other

    • Upgrade Kafka to 3.2.0 in the docker images, and in the Humio dependencies.

Humio Server 1.45.0 Preview (2022-06-28)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.45.0Preview2022-06-282022-08-151.30.0NoNo

Bug fixes and an updated dependency, released to cloud only.

Improvements, new features and functionality

  • Configuration

    • Adds a new metric for measuring the merge latency, which is defined as the latency between the last minisegment being written in a sequence with the same merge target, and those minisegments being merged. The metric name is segment-merge-latency-ms.

    • Adds a new logger job that logs the age of an unmerged miniSegment if the age exceeds the threshold set by the env variable MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING. The default value of MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING is 2 x MAX_HOURS_SEGMENT_OPEN. MAX_HOURS_SEGMENT_OPEN defaults to 24 hours. The error log produced looks like: Oldest unmerged miniSegment is older than the threshold thresholdMs={value} miniSegmentAgeMs={value} segment={value}.

  • Dashboards and Widgets

    • Note widget:

      • Default background color is now Auto.

      • Introduced the text color configuration option.

    • The Pie Chart widget now uses the first column for the series as a fall back option.

    • The Bar Chart widget now works with bucket query results.

  • Other

    • Bump the version of the Monaco code editor.

    • Added a log message with the maximum state size seen by the live part of live queries.

Bug Fixes

  • UI Changes

    • Fix the dropdown menus closing too early on the home page.

    • Websocket connections are now kept open when transitioning pages, and are used more efficiently for syntax highlighting.

  • Dashboards and Widgets

    • The Time Chart widget regression line is no longer affected by the interpolation setting.

  • Other

    • Bump woodstox to address SNYK-JAVA-COMFASTERXMLWOODSTOX-2928754.

    • Fix a bug causing digesters to continue digesting even if the local disk is full. The digester will now pause digesting and error log if this occurs.

    • Make streaming queries search segments newest-to-oldest rather than oldest-to-newest. Streaming queries do not ensure the order of exported events anyway, and searching newest-to-oldest is more efficient.

    • Some errors messages wrongly pointed to the beginning of the query.

Humio Server 1.44.0 Preview (2022-06-21)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.44.0Preview2022-06-212022-08-151.30.0NoNo

Bug fixes and an updated dependency, released to cloud only.

Deprecation

These items have been deprecated and may be removed in a future release:

  • The deprecated REST API for actions has been removed, except for the endpoint for testing an action.

Improvements, new features and functionality

  • UI Changes

    • Toggle switches anywhere in the UI are now tabbable and can be accessed using the keyboard.

    • Improved keyboard accessibility for creating repositories and views.

  • GraphQL API

    • Introduced new dynamic configuration flags query-memory-limit. It can be set using graphQL. The flag replaces the environment variable MAX_MEMORY_FOR_REDUCE, so if you have changed the value of MAX_MEMORY_FOR_REDUCE, please use query-memory-limit now instead. See Limits for more details.

    • Introduced new dynamic configuration flag join-row-limit. It can be set using graphQL. The flag can be used as an alternative to the environment variable MAX_JOIN_LIMIT. If the join-row-limit flag is set, then its value will be used instead of MAX_JOIN_LIMIT. If it is not set, then MAX_JOIN_LIMIT will be used.

    • Introduced new dynamic configuration flag state-row-limit. It can be set using graphQL. The flag can be used as an alternative to the environment variable MAX_STATE_LIMIT. If state-row-limit is set, then its value will be used instead of MAX_STATE_LIMIT. If it is not set, then MAX_STATE_LIMIT will be used.

  • Configuration

    • Default value of configuration variable S3_ARCHIVING_WORKERCOUNT raised from 1 to (vCPU/4).

    • Added a link to humio-activity repository for debugging IDP configurations to the page for setting up the same.

    • Added a new environment variable GROUPBY_DEFAULT_LIMIT which sets the default value for the limit parameter of groupBy(). See groupBy() documentation for details.

  • Dashboards and Widgets

    • The Normalize option for the World Map widget has been replaced by a third magnitude mode named None, which results in fixed size and opacity for all marks.

    • The dashboards page now displays the current cluster status.

    • Bar Chart widget:

      • The Y-axis can now start at smaller values than 1 for logarithmic scales, when the data contain small enough values.

      • It now has an Auto setting for the Input Data Format property, see Wide or Long Input Format for details.

      • Now works with bucket query results.

    • Single Value widget:

      • Missing buckets are now shown as gaps on the sparkline.

      • Isolated data points are now visualised as dots on the sparkline.

  • Log Collector

    • The Log Collector download page has been enabled for on-prem deployments.

  • Other

    • Improved performance of NDJSON format in S3 Archiving.

    • Add warning when a multitenancy user is changing data retention on an unlimited repository.

    • Adds a new metric for the temp disk usage. The metric name is temp-disk-usage-bytes and denotes how many bytes are used.

    • Adds a logger job for cluster management stats it log the stats every 2 minutes, which makes them searchable in Humio.

      The logs belong to the class c.h.c.ClusterManagementStatsLoggerJob, logs for all segments contains globalSegmentStats log about singular segments starts with segmentStats.

    • Added a log of the approximate query result size before transmission to the frontend, captured by the approximateResultBeforeSerialization key.

Bug Fixes

  • Security

    • Bump javax.el to address CVE-2021-28170.

    • Update Netty to address CVE-2022-24823.

  • Other

    • Update org.json:json to address a vulnerability that could cause stack overflows.

    • Fix a bug where changing a role for a user under a repository would trigger infinite network requests.

    • If a segment is deleted or otherwise disappears from global while Humio is attempting to upload it to bucket storage, the upload will now be dropped with an info-level log, rather than requeued with an error log.

    • Fix an issue causing the event forwarding feature to incorrectly reject topic names that contained a dash (-).

    • Fixed a bug where multiline comments weren't always highlighted correctly.

    • Improve file path handling in DiskSpaceJob to eliminate edge cases where the job might not have been able to tell if a file was on primary or secondary storage.

Humio Server 1.42.2 Stable (2022-10-05)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.42.2Stable2022-10-052023-10-051.30.0NoNo
JAR ChecksumValue
MD5c129f5c1d5d5cf469abdfd604267b6d6
SHA1737393d0e02fc6a3e5599a20d3b7f640d0ce3347
SHA256e283e268d4d268a21f0e7fe2f6ff08582a96cb6d37dd28b020670eb3600a8e86
SHA5126cc3f4ad41b46d71ff67db7a4720e1a027583938ec1158b1fa45de8943030caf70e4b7b50dea9c42c92b3bb6d9ab335783a9b5f12dd9b79e240e4eadceac17ba
Docker ImageSHA256 Checksum
humio-core-dev070dff4cd2a472994ad4999d36b98c1592fb6be703c9f2ae590f278dc47339e4
humio-dev4a5399bb43705c9e2f95d745fd87766552d9f1ef74d459feb3e10244b958d37e
kafka-deva5447202b222b70d6569e03668056e6059621894d3287f6d92f0e4ecbfb50a34
zookeeper-dev6487f4600d004f1ea797a86bef307781ac8840b438c28c8405ffdfd334205f99

Bug fixes and updates.

Bug Fixes

  • Security

    • Update Scala to address CVE-2022-36944.

  • Other

    • Fix performance issue for users with access to many views.

Humio Server 1.42.1 Stable (2022-07-18)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.42.1Stable2022-07-182023-07-181.30.0NoNo
JAR ChecksumValue
MD50d84ae2bac065c74f033b3f510812cf6
SHA1aa21f410e29c6189b56526c42d4414398544f3e3
SHA2566b59d546a2f271d499b857b290f6c283b90282a5d9a213bc037652367f258c4d
SHA512688242a795f9526828841faabc34e59e048439a1c748842d0a0fdf8eb8dffa99ce2f5281fa1c067dbbbac3db0494af006f46d3917de4f85c73372d536a102d97
Docker ImageSHA256 Checksum
humio-core-dev14ec97ed7bf950b0e0669627babebfb3e5ca67b38cc40d116254567ee4e9199d
humio-devd83d0ea9247637ce91d2b84123659858624fe329583e1c6fe6900bd4eaa4acae
kafka-deve9a4ee28381265a1b80071257996003a9bea0e29234a6394477d8859cb546e68
zookeeper-devb377e734d662fe80b4dbc6b355965694464e437a2e0855272b9652ac9225b050

Bug fixes and an updated dependency.

Improvements, new features and functionality

  • UI Changes

    • The Save As... button is now always displayed on the Search page.

Bug Fixes

  • Other

    • Updated dependencies to woodstox to fix a vulnerability.

    • Compute next set of Prometheus metrics only in a single thread concurrently. If more requests arrive, then the next request gets the previous response.

Humio Server 1.42.0 Stable (2022-06-17)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.42.0Stable2022-06-172023-06-171.30.0NoYes
JAR ChecksumValue
MD56f0306d98c1f4931a083fe9211841ea1
SHA1afee8f0c7c705b0c6b54c5a3321cf7ed6bbfc6f2
SHA2560167bd6ae46368db74434133b9881380fd6c389c9ea35ac5612d9a643366d3ac
SHA512e66acd012641e19d6c8c7613a56302c66138902912eb3aaa2157fef4199b6e77b20367be49bd90f2b430573b6317bd7214600436edfaf52cbffc108c0c414fd6
Docker ImageSHA256 Checksum
humio-core-dev958fc373d5cf0da75861981cbf6fb3cead3c41388480d72b4bb7ad85734bc0cd
humio-dev37cb34cccd8e0b749308f96bc49cd67c92ca6af537e5c01cec0ecf4d26d2712f
kafka-devaea9942f9b789b058984dc348fa91657c8be210ad9d6f85ed8e0fdd6f09e408d
zookeeper-devd52cd8f48f55cf09db7426a746b536face085b8b919ed1cdc1ce57f7e74d450e

Bug fixes and updates.

Deprecation

These items have been deprecated and may be removed in a future release:

  • The Feature Flag, CookieAuthServerSide, has been deprecated as cookie authentication is now enabled by default. Instead, the configuration field ENABLE_BEARER_TOKEN_AUTHORIZATION has been introduced.

  • The local disk based backup feature described at Making Back-Ups is deprecated, and is planned for removal in September 2022. We have found that restoring backups using this feature is difficult in practice, it is not commonly used, and the backup/restore functionality is covered by the bucket storage feature as well. For these reasons, we are deprecating this feature in favour of bucket storage.

    The DELETE_BACKUP_AFTER_MILLIS configuration parameter, which controls the delay between data being deleted in Humio and removed from backup, will be retained, since it controls a similar delay for bucket storage. Customers using local disk based backups should migrate to using bucket storage instead. Systems not wishing to use a cloud bucket storage solution can keep backup support by instead installing an on-prem S3- or GCS-compatible solution, such as MinIO.

Improvements, new features and functionality

  • Falcon Data Replicator

    • Improved error logging, when an FDR feed fails to download data from an S3 bucket. It now clearly states when a download failed because the S3 bucket is located in a different region than the SQS queue.

    • Added the fdr-invisible-message-count metric, which contains the approximate number of invisible messages on an FDR feed's SQS queue.

    • Added the fdr-message-count metric, which contains the approximate number of messages on an FDR feed's SQS queue.

  • UI Changes

    • Both the Scatter Chart and the Bar Chart widgets now support automatically adding/toggling axis and legend titles based on the mapped data.

    • The Fields Panel now enables you to fetch fields beyond those from the last 200 events — see Adding and Removing Fields.

    • The Format Panel is now available for changing the style of the data displayed in the Event list — see Changing the Data Display.

  • Configuration

    • Improve the error message if Humio is configured to use bucket storage, but the credentials for the bucket are not configured.

  • Dashboards and Widgets

    • The Gauge widget is being deprecated in favour of the Single Value widget. Configurations of the former widget are compatible with the latter. This means that persisted configurations of the Gauge widget (url / dashboard widgets / saved queries / recent queries) are still valid, but are visualised using the Single Value widget instead.

    • The Single Value widget is now available. Construct a query which returns any single value, or use the timeChart() query function to create a single-value widget instance with sparkline and trend indicators.

  • Log Collector

    • The Humio Log Collector can now be downloaded from the Organizational Settings page, see the Log Collector Documentation for a complete list of the supported logs formats and operating systems.

  • Functions

    • ioc:lookup() would sometimes give incorrect results when negated.

    • worldMap() will warn about licensing issues with IP database.

    • worldMap() accepts more magnitude functions, including percentile and anonymous functions.

    • sankey() now accepts more weight functions such as anonymous functions and percentile.

  • Other

    • When cleaning up a deleted data space, don't error log if two nodes race to delete the data space metadata from global.

    • Fixed an issue where a scheduled search could trigger actions multiple times for the same time period if actions took a long time to finish.

    • Ensured that errors during view tombstone removal are logged and don't prevent the RetentionJob from performing other cleanup tasks.

    • Email actions can now add the result set as a CSV attachment.

    • Logging to the humio-activity repository is now also done for events in sandbox repositories.

    • Fixed an underlying bug causing addToExistingJob did not find the existing job to be error logged unnecessarily. Humio may decide to fetch a segment from bucket storage for querying. If this decision is made right as the query is cancelled, Humio could log the message above. With this fix, Humio will instead skip downloading the segment, and not log the error.

    • Fixed an issue where Humio's Zookeeper monitoring page would show X/0 followers in sync.

    • Specifying a versionless packageId will load the newest version of that package.

    • Fixed an issue that if download of IOCs took more than an hour, Humio would indefinitely start a new download every hour which would eventually fail.

Humio Server 1.40.0 Stable (2022-05-12)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.40.0Stable2022-05-122023-05-121.30.0NoYes
JAR ChecksumValue
MD58a733e1201103eeef32e63b0bf4c8977
SHA15b217fb48f1b5684330ec70fc5d20d322b0a75f8
SHA2568838d422459feb6a56d1f15578c581fec7983165635fb4e74f312c2cc4da8046
SHA51294bb617a37475918313decc3bf56696890c90d3e3f91de78dccb9431fee0b1bba8d90f60f0d591f5acbea7c6e09c5cb57ddf95fba088a34efc92a0899ac4aef9
Docker ImageSHA256 Checksum
humio-core-dev9326081840d3f852df54702c9d5e72ea492d49c55aab51ed83b1b234439c4ec7
humio-dev7c9b77b32fc84e31ecc57461ae3e8bfac9b584fb6fb3af0b909bd7e05903d0d8
kafka-dev344a06f56ada7ea9af2c7c5d146fa07f6fda87be750a7283e6f753189b42a0b5
zookeeper-dev42cdbca9d0ce73516a27beda618390a40db3e086580ce3d6ab2779c1952980ee

1.40 REQUIRES minimum version 1.30.0 of Humio to start. Clusters wishing to upgrade from older versions must upgrade to 1.30.0+ first. After running 1.40.0 or later, you cannot run versions prior to 1.30.0.

Behavior Changes

Scripts or environment which make use of these tools should be checked and update for the new configuration:

  • The selfJoin() query function was observed to cause memory problems, so we have set a limit of .0.0 output events (there was previously no bound). This limit can be adjusted with the GraphQL mutation setDynamicConfig with config flag SelfJoinLimit. A value of -1 returns selfJoin to its old, unbounded version.

Improvements, new features and functionality

  • Falcon Data Replicator

    • Using the dynamic configuration option FdrExcludedNodes, administrators can now exclude specific nodes from polling from FDR. Defaults to the empty list, so all nodes will be used for polling.

    • The static configuration variable ENABLE_FDR_POLLING_ON_NODE is no longer supported, as its functionality has been replaced with the dynamic configurations listed above.

    • It is now possible to test an FDR feed in the UI, which will test that Humio can connect to the SQS queue and the S3 bucket.

    • Introduced dynamic configuration options for changing FDR polling behaviour at runtime. FDR polling is not enabled by default, so you should take care to set up these new configurations after upgrading, or you will risk that your FDR data isn't ingested into Humio before it is deleted from Falcon.

    • Using the dynamic configuration option FdrEnable, administrators can now turn FDR polling on/off on the entire cluster with a single update. Defaults to false.

    • Using the dynamic configuration option FdrMaxNodes, administrators can put a cap on how many nodes should at most simultaneously poll data from the same FDR feed. Defaults to 5 nodes.

    • Fixed an issue where exceptions in FDR were not properly logged.

  • UI Changes

    • Events with JSON data can now be collapsed and expanded in the Json panel.

    • Introducing the new Scatter Chart widget (previously known as XY):

      • It supports long data format (one field for the series name and one field for the y values) as well as wide format (one field per series value).

      • You can now visualize data in the Scatter chart when queried with the timeChart(), bucket() and groupBy() functions, as well as the table() function like before.

    • Added style options to either truncate or show full legend labels in widgets.

    • Keep empty lines in queries when exporting assets as templates or to packages.

    • The @timestamp column is now allowed to be moved amongst the other columns in the event list.

    • Improvements to the Sankey Diagram widget, it now has multiple style options; show/hide the y-axis, sorting type, label position, and colors plus labels for series.

    • Syntax highlighting for XML, JSON and accesslog data now uses more distinguishable colors.

    • Improvements to the Pie Chart widget, it now has a max series setting similar to the Time Chart widget.

    • The widget dropdown can now be navigated with the keyboard.

    • When using a widget that is not compatible with the current data, the Reset Widget Type button now works again.

  • GraphQL API

    • Added two new organization level permissions: DeleteAllRepositories and DeleteAllViews that allow repository and view deletion, respectively, inside an organization.

    • Added a new GraphQL mutation to rename views or repositories by id.

    • Changed permission token related GraphQL endpoints to use enumerations instead of strings.

    • Marked experimental language features as preview in GraphQL API.

    • It is now possible to refer a parser by name when creating an ingest token or assigning a parser to an existing ingest token using the GraphQL API mutations addIngestTokenV3 and assignParserToIngestTokenV2. The old mutations addIngestTokenV2 and assignParserToIngestToken have been deprecated.

    • It is now possible to refer a parser by name when creating or updating an ingest listener using the GraphQL API mutations createIngestListenerV3 and updateIngestListenerV3. It is now also possible to change the repository on an ingest listener using updateIngestListenerV3. The old mutations createIngestListenerV2 and updateIngestListenerV2 have been deprecated.

    • Removed the following deprecated GraphQL fields: UserSettings.settings, UserSettings.isEventListOrderChangedMessageDismissed, and UserSettings.isNewRepoHelpDismissed.

    • Removed the deprecated clientMutationId argument from the GraphQL mutation updateSettings.

    • The GraphQL queries and mutations for FDR feeds are no longer in preview.

    • Added a GraphQL mutation deleteSearchDomainById that deletes views or repositories by ID.

  • Configuration

    • Added a new config NATIVE_FALLOCATE_SUPPORT (default true) to allow turning off the use of fallocate and ftruncate internally.

    • Require that {S3/GCS}_STORAGE config must be set before {S3/GCS}_STORAGE_2 is set.

    • Added a new configuration variable BUCKET_STORAGE_TRUST_POLICY for the dual-bucket use case. This setting configures which bucket is considered the "trusted" bucket when two buckets are configured, which impacts when Humio considers data to be safely replicated. Supported values are Primary for trusting the primary bucket, Secondary for trusting the secondary bucket, TrustEither for considering data safely replicated if it is in either bucket, and RequireBoth for considering data safely replicated only if it is in both buckets. This config replaces the BUCKET_STORAGE_2_TRUSTED configuration, true in the old configuration equates to Secondary in the new configuration. The default value of the new configuration is Secondary.

    • Added a new config NATIVE_FADVICE_SUPPORT (default true) to allow turning off the use of fadvice internally.

    • Amended how Humio chooses segments to download from bucket storage when prefetching. If S3_STORAGE_PREFERRED_COPY_SOURCE is false, the prefetcher will only download segments that are not already on another host. Otherwise, it will download as many hosts as necessary to follow the configured replication factor. This should help avoid excessive bucket downloads when nodes in the cluster have lots of empty disk space.

    • Validate block CRCs before uploading segment files to bucket storage. Can be disabled by setting VALIDATE_BLOCK_CRCS_BEFORE_UPLOAD to false.

  • Dashboards and Widgets

    • Introducing the Single Value widget. Construct a query which returns any single value, or use the timeChart() query function to create a single-value widget instance with sparkline and trend indicators.

    • Improvements to the Bar Chart widget:

      • Added style options to name the x and y axis.

      • Added option for interpreting the resulting query data as either wide or long format data.

      • Added option to set a max label length for the x-axis, instead of the bottom padding option. With auto-padding and this style option, it is easier to fit the wanted information in the view.

      • It is now possible to configure bar charts to have a logarithmic y axis.

      • Introduced the stacked bar charts option.

      • It no longer has an artificial minimum height for bars, as this may distort at a glance interpretations of the chart.

      • It no longer has sorting by default, which means that the order will be identical to the query result. You can now sort the x axis of the bar chart by using the sort() query function, if sort by series in the style options is not set.

      • It now has a max series setting similar to the Time Chart widget.

    • Improvements to the Time Chart widget:

      • It now has an option to show the underlying data points, which makes it possible to inspect the behaviour of the different interpolation methods.

      • Trend lines can now be added in the chart.

  • Other

    • When logging Kafka consumer and producer metrics, Humio will now log repeated metrics like records-lag-max once per partition, with the partition specified in the partition field.

    • Fixed an issue where query cancellation could in rare cases cause the query scheduler to throw exceptions.

    • Humio is now more strict during a Kafka reset to avoid global desyncs. Only one node will be allowed to boot on the new epoch, remaining nodes won't be allowed to use their snapshots, and will need to fetch a fresh global snapshot from that node.

    • Fixed an ingest bug where we might discard @timezone and @error fields in events with too many fields. Now we always retain those and only discard other fields.

    • Fixed duplicate Change triggers and actions entry in view permission token page.

    • Improved distribution of new autosharded datasources.

    • Fixed an issue where Filebeat 8.1 would not be compatible unless output.elasticsearch.allow_older_versions was set to true.

    • Fixed an issue that could cause creation of two datasources for the same tag set if messages with the same tags happened to arrive on different Kafka partitions.

    • When calculating the starting offset in Kafka for digest, Humio will now trust that if a segment in global is listed as being in bucket storage, that segment is actually present in bucket storage. Humio no longer double checks by asking bucket storage directly.

    • It is no longer possible to use experimental functions in Alerts, Parsers, and Event Forwarding. They are now only available on the search page.

    • Fixed an issue where audit logging of alerts, scheduled searches and actions residing on views would yield incomplete or missing audit logs.

    • Updating alert labels using the addAlertLabel and removeAlertLabel mutations now requires the ChangeTriggersAndActions permission.

    • Fixed an issue where NetFlow parsing would crash if it received an options data record.

    • Fixed an ingest bug where, under some circumstances, we would reverse the order of events in a batch.

    • The query scheduler improperly handled regex limits being hit, it should result in a warning on the query. In some cases it was handled by retrying the segment read.

    • Create, update and delete operations on ingest listeners are now always audit logged. Previously, they were only logged when performed through the REST API. Also, the audit log format has been updated to be similar to the format of other assets. Look for events with the type field set to ingestlistener.create, ingestlistener.update, and ingestlistener.delete.

    • Added support for restoring deleted repositories and views when using bucket storage. See Delete a Repository or View.

    • Fixed an issue when using bucket storage alongside secondary storage, where Humio would download files to the secondary storage but register them as present in the primary. It will now download and register them as present on the secondary storage.

    • Fixed how relative time is displayed.

    • It is no longer possible to delete a parser that is used by an ingest listener. You must first assign another parser to the ingest listener.

    • Fixed a caching-related issue with groupBy() in live queries that would briefly cause inconsistent results.

    • Reduced the amount of time Humio will spend during shutdown waiting for in-progress data to flush to disk to 60 seconds from 150 seconds.

    • Added support in fieldstats() query function for skipping events. This is used by the UI, but only in situations where we know an approximate result is acceptable and where processing all events would be too costly.

    • If the query scheduler attempts to read a broken segment file, it may be able to fetch a new copy from bucket storage in some cases. Humio will now only allow this if it can be guaranteed that no events from the broken segment have been added to the query result. Otherwise the query will receive a warning.

    • When Humio detects multiple datasources for the same set of tags, it will not deduplicate them by selecting one source to keep and marking the others replaced.

    • Added humio-decrypt-bucket-file.sh to the Humio bin directory. This invokes a utility for decrypting files downloaded from bucket storage.

    • Fixed an issue where the set-replication-defaults config endpoint could attempt to assign storage to nodes configured not to store segments.

    • It is now validated, that the parser supplied when creating or updating an ingest listener, exists.

    • Improved the phrasing of some error messages.

    • Renamed the Humio tarball distribution to humio-1.39.0.tar.gz instead of humio-release-1.39.0.tar.gz. The file now contains a directory named humio-1.39.0 instead of humio-release-1.39.0.

    • Webhook action now includes the 'Message Body Template' for PATCH and DELETE requests as well if it is not empty.

    • Fixed a race condition between nodes creating the merge result for the same target segment, and also transferring it among the nodes concurrently. If a query read the file during that race, an in-memory cache of the file header might hold contents that did not match the local file, resulting in Broken segment warnings in queries.

    • Improved the flow of creating a blocked query.

    • It is no longer possible to create ingest listeners on system repositories using the APIs. Previously, it was only prohibited in the UI.

    • When shared dashboards are disabled or become inaccessible because of IP filters, they will now be completely unreachable, and any dashboards already open will show an informative error message.

    • Webhook action has been updated to only allow the following HTTP verbs: GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS.

    • During ingest, if an event has too many fields we now sort the fields lexicographically and remove fields from the end. Before, there was no system to which fields were retained, it was effectively random.

    • It is now possible to create a view with the same name as a deleted view.

    • Fixed a bug where accessing a csv file with records spanning multiple lines would fail with an exception.

    • Fixed an issue that links in alerts from OpsGenie actions were not clickable.

    • Humio will now periodically log node configs to the debug log, in addition to the existing log of config on node boot. These logs will come from com.humio.jobs.ConfigLoggerJob.

    • Fixed bugs related to repository deletes.

    • Fixed an ingest bug where if multiple types of errors occurred for an event we would only add error fields describing one of them. Now we always report all errors.

    • Fixed an ingest bug where sometimes we wouldn't turn event fields into tags if we fell back to using the key-value parser. Now we always turn fields into tags.

    • The findTimestamp() function now supports date formats like 23FEB2022, that is date, literal month and year without any separators in between. Other formats still require separators between the parts.

    • Fixed an issue that could cause the query scheduler to erroneously retry searching a bucketed segment.

    • Added more visibility on organization limits when changing the retention settings on a repository.

    • Fixed an issue where an exception in rare cases could cause ingest requests to fail intermittently.

    • Fixed an ingest bug where, when truncating an event with too many fields, we wouldn't count error fields, leading to the event still being larger than the maximum size.

    • Added a feature that allows deletion of repositories and views on cloud.

    • Fixed an issue where non-default log formats such as log4j2-json-stdout.xml that logs to STDOUT were not fully in control of their output stream, as log entries of level ERROR were also printed directly to stderr from within the code. The default log4j2 configuration now includes a Console appender that prints errors to stdout, achieving the same result, while allowing the other formats to fully control their output stream.

    • Fixed an issue where download of IOCs from another node in the cluster could start before the previous download had finished, resulting in too many open connections between nodes in the cluster.

    • Fixed a bug with UTF-8 serialization of 4-byte codepoints (emojis etc.).

    • Fixed an issue where Filebeat 8.0 would not be compatible unless setup.ilm.enabled was set to false.

    • Improved distribution onto partitions of tag combinations (datasources) that are affected by auto sharding, resulting in less collisions.

    • Made changes to Humio's tracking of bucket storage downloads. This should avoid some rare cases where downloads could get stuck.

    • Automatic system removals of queries expired from the blocklist are now audit logged as well.

    • Added a feature that allows regular users with delete permissions on cloud to rename views and repositories.

    • Added humio-token-hashing.sh to the Humio bin directory. This invokes a utility for generating root tokens.

    • Adding and removing queries from the query blocklist is now audit logged as two separate audit log event types, query-blocklist-add and query-blocklist-remove, rather than the single event type blocklist.

    • The REST API for ingest listeners has been deprecated.

    • Fixed an issue where the UI would not detect parameters in a query when using saved queries from a package.

    • Ingest listeners are now only stopped, not deleted, when a user deletes a repository. If the repository is restored, the ingest listener will be restarted automatically. When it is no longer possible to restore the repository, the ingest listener will be deleted.

    • Fixed an issue that could cause an exception to be thrown in the ingest code if digest assignment changed while a local segment file being written was still empty.

    • Fixed an issue where OrganizationStatsUpdaterJob would repeatedly post the error com.humio.entities.organization.OrganizationSingleModeNotSupported: Not supported when using organizations in single mode when the cluster was configured for only one organization.

    • Improved performance of formatting action messages, when the query result for an alert or scheduled search contains large events.

    • Added a new system-level permission allowing changing the user name of a user.

    • Fixed an issue where some errors showed wrong positions in the search page query field.

Humio Server 1.38.2 Stable (2022-06-13)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.38.2Stable2022-06-132023-06-131.26.0NoNo
JAR ChecksumValue
MD5c00de7af24633422654b3d16a764d753
SHA16c3043c27e5c7b3c7353f0f0e5e3e5b876319314
SHA2566770856e5dcf19eee5384eecc40617fed15d92e2c2872ff7432f63bf43867c4a
SHA5127660d46ca1700336ce6fd2390e4b6de5b15963693499a6313513ff63ee9cedb6f99e1f595465ae3b1c420d0ba9b4626abe0ba81450f3bd7e92d528b0b1f51c6d
Docker ImageSHA256 Checksum
humio-core-dev4a9c5aa23b7842034e34dda4aaffcb12f6f23a8e1c2cf04933b44a8cdafbe74d
humio-dev1290b8e98ae3553b092879867a433077a1eb7ff626c989d01d14f71218644072
kafka-dev04d14b84378ac9f6787af1b8477a0d2cbd6979da283bde177470d1af85a01637
zookeeper-dev46aa8bbcaa2c64cfa7afdb6e07df0783658b4983a6727ca6670989364e687477

Updated dependencies with security fixes and weakness.

Bug Fixes

  • Security

    • Updated dependencies to fix vulnerabilities to CVE-2021-22573.

  • Summary

    • Updated java script dependencies to fix vulnerabilities.

Humio Server 1.38.1 Stable (2022-04-27)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.38.1Stable2022-04-272023-04-271.26.0NoNo
JAR ChecksumValue
MD5fcaf2c288bd1f7c0fbc63deca59aa53d
SHA1aec8d78eb49ee4954f2e542f614c89595da0ec39
SHA256d31c13fcecfd380562faddb7ba4662484aa2254f1f0f54591241341870c7ae83
SHA51298134b241d67029255018c24032897623e91a3f54627c53e1c801bd4528b9ea13ab48abe328f2b76f40048bf4cb7dd45480a9398f6bd8dea4edb5db1d296b3da
Docker ImageSHA256 Checksum
humio-core-dev7c1a2c853c4d7c348cfe948340a0f4101eb92a9ce365943897bf6c34cf393312
humio-dev2d33f1706e053414996c9ac5d3533a15b637d3b321ad91362ac1a2fb4e54d722
kafka-deve3fc06aca9f5df2e628fb6a2b78c39aaf1c1b682728eb74bbd87d018aa83b49a
zookeeper-dev73746eff47c136fc01bf5898c4fecf43d459d3f103ccd29e10edf2ce7c79255d

Updated dependencies with security fixes and weakness.

Bug Fixes

  • Summary

    • Updated dependencies to Jackson to fix a vulnerability.

    • Use latest version of Alpine on Docker image.

    • Use latest version of Java 1.13 on Docker image.

    • Updated java script dependencies to fix vulnerabilities.

Humio Server 1.38.0 Stable (2022-03-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.38.0Stable2022-03-152023-03-151.26.0NoYes
JAR ChecksumValue
MD583afa7f6d2c55efbb88387474efd1264
SHA15587c3365fcfb22e1a45ea96b9503497b705125e
SHA256357591952ed12d0d9f93b084cff4b0ff6848d7a464071ff27edee9f921e23174
SHA5127a88658b07d69f6a2fe151da8fe94ebfe0a1259ffa48c45df6154dcce4f6453fac8f78087cefdf869fb6322fa4e31a01f830d9db998293ebeabb0f2c8e3e5cfb
Docker ImageSHA256 Checksum
humio-core-devcff83e3a3ea8c455040ca31d4e8071a0f1c80be894fdde4cad768e69e1c449e5
humio-dev9cd0f6a91b150bb51f9407451bd70c40dc49f730f76840e061a6570008d88453
kafka-devd960ac292f781baa54c1388f4bbc94c77c1ae06b94a082a214777844f1435120
zookeeper-devb2ab322170bfab4d221f6f5e4a4cca5751b2d97bcf75d451de4d24a00c775206

Humio can now poll and ingest data from the Falcon platform's Falcon Data Replicator(FDR) service. This feature can be used as an alternative to the standalone fdr2humio project. See the Ingesting FDR Data for more information.

Improvements, new features and functionality

  • Falcon Data Replicator

    • Improved performance of FDRJob.

  • UI Changes

    • Better accessibility for queries panel. You can now tab to focus individual queries, and open a details panel. From here you can also access all actions in the details panel by tabbing.

    • Hover information in the search field is shown despite an overlapping warning.

    • First row entry in the statistics table on the repo page is now a table header and added hidden content to the empty table header in the new view page.

    • Visually hidden clipboard field is now hidden for assistive technologies/keyboard users.

    • Added a quick-fix for unknown escape sequences in the search field.

    • Minor UX improvements (ie. accessibility) on the queries panel.

    • The Cluster Nodes table has been redesigned to allow for easier overview and copying the version-number.

    • When using the table visualisation in dark mode, empty table cells are now clearly discernible.

    • Added a quick-fix to convert non-ASCII quotes to ASCII quotes in the search field.

    • Pop-ups and drop-downs will now close automatically when focus leaves them.

    • Hover over parameter names and arguments in the search field now includes the default value.

    • Reworked the hover message layout and changed the hover information on text (in the search field).

    • Added a warning for unknown escape sequences in the search field.

    • The search page now has focus states on the Language Syntax, Event List Widget and Save As buttons.

    • On the time, bar and pie charts you can hold the ALT/OPTION key to display long legend titles.

    • When changing focus inside a dialog with the keyboard, the focus will no longer move outside the dialog while it is open.

    • The bar and pie charts now support holding the SHIFT key to display unformatted numeric values.

  • GraphQL API

    • Fixed a bug in the response from calling the installPackageFromZip graphql mutation. Previously the response type exposed a deprecated clientmutationid that could not be selected. Also now if form fields are missing they are properly reported in the response.

    • Deprecates the ReadContents view action, in favor of ReadEvents. This also means ReadEvents has been undeprecated, as we have slightly changed how we consider read rights, and want the action names to match this.

    • The PERMISSION_MODEL_MODE config option has been removed. All graphql related schema has also been removed.

  • Configuration

    • Added config IP_FILTER_RDNS_SERVER for specifying what DNS servers can be allowed in the rdns query function.

    • Added config RDNS_DEFAULT_SERVER for specifying what DNS server is the default for the rdns query function.

    • Added the config CORS_ALLOWED_ORIGINS a comma separated list for CORS allowed origins, default allows all origins.

    • Added new settings for how uploads to bucket storage are validated. In the case that validation with etags are not available, content length can be used instead.

    • Reduce default value of INGESTQUEUE_COMPRESSION_LEVEL, the ingest queue compression level from 1 to 0. This reduces time spent compressing before inserting into the ingest queue by roughly 4x at the expense of a 10-20% increase in size required in Kafka for the ingest queue topic.

    • When Kafka topic configuration is managed by Humio (default true) set max.message.bytes on the topics to the value of Config TOPIC_MAX_MESSAGE_BYTES, default is 8388608 (8 MB). Minimum value is 2 MB.

    • Added new config NATIVE_FALLOCATE_SUPPORT (default true) to allow turning off the use of fallocate and ftruncate internally.

    • Fixed a bug where TLS_KEYSTORE_TYPE and TLS_TRUSTSTORE_TYPE would only recognize lower-case values.

    • Added new config NATIVE_FADVICE_SUPPORT (default true) to allow turning off the use of fadvice internally.

    • The Property inter.broker.protocol.version in kafka.properties now defaults to 2.4 if not specified. Users upgrading Kafka can either set inter.broker.protocol.version manually in kafka.properties, or pass DEFAULT_INTER_BROKER_PROTOCOL_VERSION as an environment variable to Docker when launching the container. Please follow Kafka's upgrade guidelines when upgrading a Kafka cluster to avoid data loss https://kafka.apache.org/documentation/#upgrade_3_1_0.

    • Added config IP_FILTER_RDNS for specifying what IP addresses can be queried using the rdns query function.

  • Other

    • Fixed a bug where providing a bad view/repository name when blocking queries would block the query in all views and repositories.

    • Allow cluster managers access to settings for personal sandboxes and to block and kill queries in them.

    • Fixed an issue where queries with tail() would behave in an unexpected manner when an event is focused.

    • Ensure only a cluster leader that still holds cluster leadership can force digesters to release partition leadership. This could cause spurious reboots in clusters where leadership was under contention.

    • During identity provider configuration, it's possible to fetch SAML configuration from an endpoint.

    • Upgrades the Kafka client to 3.1.0 from 2.8.1. 3.1.0 enables the idempotent producer by default, which implies acks=all. Clusters that set acks to a different number via EXTRA_KAFKA_CONFIGS_FILE should update their config to also specify enable.idempotence=false

    • Improved the performance of deletes from global.

    • Fixed an ingest bug where under some circumstances we would reverse the order of events in a batch.

    • Fixed an issue where percentile() would crash on inputs larger than ~1.76e308.

    • During Digest startup, abort fetching segments from other nodes if the assigned partition set changes while fetching.

    • Fixed a bug in the Sankey chart such that it now updates on updated query results.

    • Ensure a digester can only acquire or release partition leadership if no other digester has leadership of that partition. This could cause spurious reboots if digester leadership became contended.

    • Fixed an issue where top(max) could throw an exception when given values large enough to be represented as positive infinity.

    • Fixed a compatibility issue with FileBeat 8.0.0.

    • Fixed several issues where users could add invalid query filters via the Add filter context button after selecting text in the Event List.

    • Fixed an issue with epoch and offsets not always being stripped from segments.

    • Warn at startup if CORES > AvailableProcessorCount as seen by the JVM.

    • Fixed an issue where live queries would sometimes double-count parts of the historic data.

    • Published new versions of the Humio Kafka Docker containers for Kafka 3.1.0.

    • Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

    • LSP warnings don't crash queries any more.

    • Improved off-heap memory handling. Humio now typically uses only 1 GB on systems with 32 vCPUs, down from typically 16 GB. This leaves more memory for other processes and page cache for data.

    • Added tombstoning to uploaded files, which helps with avoiding data loss.

    • For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

    • Fixed a bug where the package marketplace would redirect to unsupported package versions on older Humio instances.

    • Fixed an issue where users could be shown in-development feature on the client when running a local installation of Humio.

    • Do not run the Global snapshot consistency check on stateless ingest nodes.

    • Added a new system-level permission that allows changing usernames of users.

    • Previously a package could be updated with another package with the same name and version, but with different content. This is no longer allowed, and any attempt do so will be rejected and fail.

    • Fixed an issue where tail() could produce results inconsistent with other query functions, when used in a live query.

    • Fixed an issue where negated functions could lose their negation.

    • Fixed a compatibility issue with LogStash 7.16+ and 8.0.0 when using the Elasticsearch output plugin.

    • Fixed a bug where the Add Column button on the Fields panel would do nothing

Humio Server 1.37.1 Preview (2022-02-25)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.37.1Preview2022-02-252022-03-151.26.0NoNo
JAR ChecksumValue
MD5e46117f38ef25afde602a458e5266b4b
SHA13b0f5a30a7918a5f08ae8492bf855fadfc36fb90
SHA256014420dfb22f8521a687eac1179c528afe0477fbb9284dc5381d9f91fd5329d1
SHA512ee13258be363f1b2103b864517ea4b9de9d6a78dcee0c4fcba95af2ea873dacebb298f6410f12cf68ecde3d17210256f85713ada7f5988726dc4440f5fbeee21
Docker ImageSHA256 Checksum
humio-core-deve0de42791dd3e83c2aa9bea871cb6e7a62bf51c835de2142adfd51aa863625a3
humio-deve131f664f67e5ce98a397431b1f1a9d3c134d47dd24a24ed8ad76ae9e6d79eb0
kafka-dev9ab50e070047406cd6316fa2017d15ca24caa6e7a9b20ba741114b9cc1c3feec
zookeeper-dev47aa1a18a57652f156406021dc61f8bb1042bc2bd23c89e715e14a8be4fb07f9

Minor fixes and improvements.

Improvements, new features and functionality

  • Falcon Data Replicator

    • Improved performance of FDRJob.

  • Other

    • Improved off-heap memory handling. Humio now typically uses only 1 GB on systems with 32 vCPUs, down from typically 16 GB. This leaves more memory for other processes and page cache for data.

    • Added a new system-level permission that allows changing usernames of users.

Bug Fixes

  • Other

    • Fixed an issue where QueryFunctionValidator failed giving the error "scala.MatchError".

    • Fixed an issue where some queries using regex would use an unbounded regex engine.

    • Fixed an issue where users could be shown in-development feature on the client when running a local installation of Humio.

Humio Server 1.37.0 Preview (2022-02-14)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.37.0Preview2022-02-142022-03-151.26.0NoYes
JAR ChecksumValue
MD5f5c25eee6d9efb0ddf9d86ca74c84a3c
SHA16026cc511279e9089bc49d8e5a0dd320e5397712
SHA256097886ea8a6d2eece7980c46ba0b1002b7f7edf6d68109f91374b002a61e4975
SHA5127c8fb7d2c53c5aab60ddf54250e47d41289cd9635005d3a765742298a20eb7f35426955a7388caf48fbc044747e917cfdd93003ce252c42358d947a504f73c29
Docker ImageSHA256 Checksum
humio-core-devf43d4a206d9386d601798029df5c02d9b1e1b35bb6ae0f666aa6d8d36bcc60e3
humio-devc27d93d4fd87d253117b1442a7391ea3cd28366a960727482b27b58706211435
kafka-dev291d25337324ab70a3490f9b06ed2860215f37b84ced203b26cfa5d10877ce42
zookeeper-dev606ebc2ffcd28bc36d7d091ad649743f22de21b891f7a75c9048343e019372ef

Humio can now poll and ingest data from the Falcon platform's Falcon Data Replicator (FDR) service. This feature can be used as an alternative to the standalone fdr2humio project. See the Ingesting FDR Data for more information.

Improvements, new features and functionality

  • UI Changes

    • Visually hidden clipboard field is now hidden for assistive technologies/keyboard users.

    • Added a quick-fix for unknown escape sequences in the search field.

    • First row entry in the statistics table on the repo page is now a table header and added hidden content to the empty table header in the new view page.

    • Added a quick-fix to convert non-ASCII quotes to ASCII quotes in the search field.

    • When changing focus inside a dialog with the keyboard, the focus will no longer move outside the dialog while it is open.

    • The bar and pie charts now support holding the SHIFT key to display unformatted numeric values.

    • Reworked the hover message layout and changed the hover information on text (in the search field).

    • Added a warning for unknown escape sequences in the search field.

    • The Cluster Nodes table has been redesigned to allow for easier overview and copying the version-number.

    • Hover over parameter names and arguments in the search field now includes the default value.

    • Hover information in the search field is shown despite an overlapping warning.

    • When using the table visualisation in dark mode, empty table cells are now clearly discernible.

    • The search page now has focus states on the Language Syntax, Event List Widget and Save As buttons.

    • Pop-ups and drop-downs will now close automatically when focus leaves them.

    • On the time, bar and pie charts you can hold the ALT/OPTION key to display long legend titles.

    • Minor UX improvements (ie. accessibility) on the queries panel.

    • Better accessibility for queries panel. You can now tab to focus individual queries, and open a details panel. From here you can also access all actions in the details panel by tabbing.

  • GraphQL API

    • Fixed a bug in the response from calling the installPackageFromZip graphql mutation. Previously the response type exposed a deprecated clientmutationid that could not be selected. Also now if form fields are missing they are properly reported in the response.

    • The PERMISSION_MODEL_MODE config option has been removed. All graphql related schema has also been removed.

    • Deprecates the ReadContents view action, in favor of ReadEvents. This also means ReadEvents has been undeprecated, as we have slightly changed how we consider read rights, and want the action names to match this.

  • Configuration

    • When Kafka topic configuration is managed by Humio (default true) set max.message.bytes on the topics to the value of Config TOPIC_MAX_MESSAGE_BYTES, default is 8388608 (8 MB). Minimum value is 2 MB.

    • Added the config CORS_ALLOWED_ORIGINS a comma separated list for CORS allowed origins, default allows all origins.

    • Added new settings for how uploads to bucket storage are validated. In the case that validation with etags are not available, content length can be used instead.

    • Reduce default value of INGESTQUEUE_COMPRESSION_LEVEL, the ingest queue compression level from 1 to 0. This reduces time spent compressing before inserting into the ingest queue by roughly 4x at the expense of a 10-20% increase in size required in Kafka for the ingest queue topic.

    • Added config RDNS_DEFAULT_SERVER for specifying what DNS server is the default for the rdns query function.

    • Added config IP_FILTER_RDNS for specifying what IP addresses can be queried using the rdns query function.

    • The Property inter.broker.protocol.version in kafka.properties now defaults to 2.4 if not specified. Users upgrading Kafka can either set inter.broker.protocol.version manually in kafka.properties, or pass DEFAULT_INTER_BROKER_PROTOCOL_VERSION as an environment variable to Docker when launching the container. Please follow Kafka's upgrade guidelines when upgrading a Kafka cluster to avoid data loss https://kafka.apache.org/documentation/#upgrade_3_1_0.

    • Fixed a bug where TLS_KEYSTORE_TYPE and TLS_TRUSTSTORE_TYPE would only recognize lower-case values.

    • Added config IP_FILTER_RDNS_SERVER for specifying what DNS servers can be allowed in the rdns query function.

  • Other

    • Ensure a digester can only acquire or release partition leadership if no other digester has leadership of that partition. This could cause spurious reboots if digester leadership became contended.

    • Ensure only a cluster leader that still holds cluster leadership can force digesters to release partition leadership. This could cause spurious reboots in clusters where leadership was under contention.

    • Added tombstoning to uploaded files, which helps with avoiding data loss.

    • Upgrades the Kafka client to 3.1.0 from 2.8.1. 3.1.0 enables the idempotent producer by default, which implies acks=all. Clusters that set acks to a different number via EXTRA_KAFKA_CONFIGS_FILE should update their config to also specify enable.idempotence=false

    • Published new versions of the Humio Kafka Docker containers for Kafka 3.1.0.

    • Allow cluster managers access to settings for personal sandboxes and to block and kill queries in them.

    • Improve the performance of deletes from global.

    • During Digest startup, abort fetching segments from other nodes if the assigned partition set changes while fetching.

    • Do not run the Global snapshot consistency check on stateless ingest nodes.

    • During identity provider configuration, it's possible to fetch SAML configuration from an endpoint.

Bug Fixes

  • UI Changes

    • Warn at startup if CORES > AvailableProcessorCount as seen by the JVM.

    • Fixed a bug where providing a bad view/repository name when blocking queries would block the query in all views and repositories.

    • Fixed an issue where live queries would sometimes double-count parts of the historic data.

    • Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

    • Fixed an issue where percentile() would crash on inputs larger than ~1.76e308.

    • Fixed a bug where the package marketplace would redirect to unsupported package versions on older Humio instances.

    • Fixes an issue with epoch and offsets not always being stripped from segments.

    • Fixed an issue where queries with tail() would behave in an unexpected manner when an event is focused.

    • For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

    • Fixed a bug in the Sankey chart such that it now updates on updated query results.

    • Fixed an issue where tail() could produce results inconsistent with other query functions, when used in a live query.

    • Fixed a compatibility issue with FileBeat 8.0.0.

    • Previously a package could be updated with another package with the same name and version, but with different content. This is no longer allowed, and any attempt do so will be rejected and fail.

    • Fixed several issues where users could add invalid query filters via the Add filter context button after selecting text in the Event List.

    • Fixed a compatibility issue with LogStash 7.16+ and 8.0.0 when using the Elasticsearch output plugin.

    • Fixed a bug where the Add Column button on the Fields panel would do nothing

    • LSP warnings don't crash queries any more.

    • Fixed an issue where negated functions could lose their negation.

    • Fixed an issue where top(max) could throw an exception when given values large enough to be represented as positive infinity.

Humio Server 1.36.4 Stable (2022-06-13)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.36.4Stable2022-06-132023-06-131.26.0NoNo
JAR ChecksumValue
MD5ec11e6c40052ff89c3f7a2a2b1fddc95
SHA1fafb29f0c7fe9638ad0b136ae0e7d1402a750912
SHA2563b8496c25ac0704d8e42f9261ec93877c7c9148f1f85d8bf0b5a6eaaf83e1820
SHA512205f646e1a700d38c95916a69830ab2b4f14b7839d8eaefa61cbdaf4404759e3ed8f6b9279b0050008cdaacddad6222cb8a91f730753b84a1fc029e4a5207ab4
Docker ImageSHA256 Checksum
humio-core-dev57ab8aaa9ce90575fd037da08f2be15df18286e74480594f08dd3c5ae81f39fa
humio-dev5c7189dfae8441322eea8eddbd25962dfc7e68f26eae3c7516e5a46f5b6313f0
kafka-dev4a03a4e0cb9aab9a0c3f626c8b49daa64dafb54eafb8ae67298dd86b45624c33
zookeeper-dev24ba0f7cdcaca8d841dba4ba2cdc7348e82c6c44c1ffff5537ba13d066c7c180

Updated dependencies with security fixes and weakness.

Bug Fixes

  • Security

    • Updated dependencies to fix vulnerabilities to CVE-2021-22573.

  • Summary

    • Updated java script dependencies to fix vulnerabilities.

Humio Server 1.36.3 Stable (2022-04-27)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.36.3Stable2022-04-272023-04-271.26.0NoNo
JAR ChecksumValue
MD5868ce151355a55e1793513eee4af54e2
SHA1a3e57e2fdbadcbfde4625d46084f25d84c5c2514
SHA25659792217be1bf5d12ba47e1049df45778c6cefcabbc57d6f7126b5bc98f093c0
SHA512a93f931491b8c77050adde3c1aa983d3c949ad6708f8be932cfb901ea6e69a03cdd06a62394627f80e593afaa354f2f30edf596a23300f5c3b16faee80afb09c
Docker ImageSHA256 Checksum
humio-core-dev1f3a36d2f6a0d97bc9d4462072e3fafa2355c5bc8352e1bc47a526332c1ec01c
humio-devbe443af484a4131b93cdee2e7a5449fcfa8320a344d2f81f7b432dea89365a65
kafka-devef6819d75f850b26a886b67e4e80f2d623eab268c4d2b4f85f7f47aa8daf9ecb
zookeeper-deva0edb279463029310c1f43555045297f54882082a70753916394a38b56c3e5be

Updated dependencies with security fixes and weakness.

Bug Fixes

  • Summary

    • Added new config NATIVE_FALLOCATE_SUPPORT (default true) to allow turning off the use of fallocate and ftruncate internally.

    • Use latest version of Alpine on Docker image.

    • Updated dependencies to Jackson to fix a vulnerability.

    • Use latest version of Java 1.13 on Docker image.

    • Added new config NATIVE_FADVICE_SUPPORT (default true) to allow turning off the use of fadvice internally.

    • Updated java script dependencies to fix vulnerabilities.

    • Fix ingest bug where under some circumstances we would reverse the order of events in a batch.

Humio Server 1.36.2 Stable (2022-03-01)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.36.2Stable2022-03-012023-03-011.26.0NoNo
JAR ChecksumValue
MD54949fefd4012efb53b92595c364a4c7a
SHA15350c5df3d0d43a5c08c2766003b28c959c912b1
SHA2562fac7cb6e1216790893ec0759f697736a9ca2605313bcef53b7af54ee72257d5
SHA51231fcdae45f52a263d5340b961a6e0feb98ea1fbb4ced0388216add576db9747995150112dee88d9ec3ea49cfc1367da1ca57bff13399d8d665fe9cdb80e9a1d8
Docker ImageSHA256 Checksum
humio-core-dev7a3e262871585d8a43df8c4c4dbcf706327cade2f683ffaa9a543afccc3e8687
humio-dev4a80cd68778a6d5ccd734982c46e0355f0acf5c68ad564dd67cdb6e949750970
kafka-dev6e362a4827f9a41d37b19bdfa63f3cad7f77d2786f6b0366e410474de99113ce
zookeeper-devdeac05cfaa4762eaf079afa3063cf9271eff7080157d0e785a4c345d280f5d24

Performance and stability improvements.

Bug Fixes

  • Summary

    • Improved off-heap memory handling. Humio now typically uses only 1 GB on systems with 32 vCPUs, down from typically 16 GB. This leaves more memory for other processes and page cache for data.

    • Fixed a race condition between nodes creating the merge result for the same target segment, and also transferring it among the nodes concurrently. If a query read the file during that race condition, an in-memory cache of the file header might hold contents that did not match the local file, resulting in "Broken segment" warnings in queries.

Humio Server 1.36.1 Stable (2022-02-14)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.36.1Stable2022-02-142023-02-141.26.0NoNo
JAR ChecksumValue
MD50aee460ed84a4acda917ce6cd61c433d
SHA19ea746229c3f1f0f780d356b7ce4b6f6e1bbb78d
SHA25656a3a2e7ba88e1f5a019184a0d68e83f25b319d54e3aaee3eba4a37f0ef8950c
SHA512aa3117230e866ae621c3f72e1517a9629f45520ea2fa00b6dc8c2ad3a6a1589ffbde36f38b3b1ec0ad927f89da4a9df7f3e6b59f1e844796553b5675608304e9
Docker ImageSHA256 Checksum
humio-core-devecfa5dd303d12725f754b4afabc44196ba37df739f04c30432401eb3149874ee
humio-dev2671bacddfe88f34eaba196332b08659e79eab40c2ce26a0e6c2f7e58a78a213
kafka-dev0d50f27e33bf61f8b76f482fa7b2c4237227af7e429b1080e65daa877c65b457
zookeeper-dev62a511127a0eaa4ba0f5a29c421063d4c6822371ba6ee16e96ae1b930ca0e7ce

Performance and stability improvements.

Bug Fixes

  • Summary

    • Reading hashfilter in chunks to avoid having huge off heap buffers.

    • Improve the performance of deletes from global.

    • Downgrade to Java 1.13 on Docker image to fix rare cases of JVM crashes.

    • Performance improvements of IngestPartitionCoordinator.

Humio Server 1.36.0 Stable (2022-01-31)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.36.0Stable2022-01-312023-01-311.26.0NoYes
JAR ChecksumValue
MD587cdf81b183bf1a065596181b873d813
SHA18425487e7e3b566ed2eae42cac4cbb6010eb1825
SHA25676af04b53a689411f4048e743e0491cb437b99503630a87cf5aba2eb0281231f
SHA5129dca89bf4097b1c4949c458b9010fff12edd25248c2f0f2e18835466e852d6c5fa6981c8763125b769c5a6673bd00a1a385bfb22f7241aeeadf9e826ef208c99
Docker ImageSHA256 Checksum
humio-core-dev2641650964190056ac10ad0225b712c3a01d844bf2c5f517663187d45adf846c
kafka-dev99e3a00c93308aa92a8363c65644748d6ace602c1c6e425dcfc32be12432dee7
zookeeper-dev45c911346e3b58501e1a1b264c178debd33edd692cd901dd9e87cbcd2f93e60a

Beta: Bucket storage support for dual targets

Support for dual targets to allow using one as the preferred download and the other to trust for durability. One example of this is to save on cost (on traffic) by using a local bucket implementation, such as MinIO, in the local datacenter as the preferred bucket storage target, while using a remote Amazon S3 bucket as the trusted bucket for durability. If the local MinIO bucket is lost (or just not responding for a while) the Humio cluster still works using the AWS S3 bucket with no reconfiguration or restart required. Configuration of the second bucket is via configuration entries similar to the existing STORAGE keys, but using the prefix STORAGE_2 for the extra bucket.

When using dual targets, bucket storage backends may need different proxy configurations for each backend - or not. The new configuration BUCKET_STORAGE_MULTIPLE_ENDPOINTS (default false) controls whether the proxy configuration in the environment is applied to all bucket storage backends. When set to true, each bucket preserves the active proxy/endpoint configuration and a change to those will trigger creation of a fresh internally persisted bucket storage access configuration.

Improvements, new features and functionality

  • UI Changes

    • Hovering over text within a query now shows the result of interpreting escape characters.

    • Added ability to resize search page query field by dragging or fitting to query.

    • Improved accessibility when choosing a theme.

    • New feature to select text in the search page event list and include/exclude that in the search query.

    • Disable the option to creating a view if the user does not have Connect a view permission on any repository. This is more intuitive than getting an empty dropdown of repositories to choose from.

    • Improved dark mode toggle button's accessibility.

    • New dialogs for creation of parsers and dashboards.

    • Time Selector is now accessible by keyboard.

    • Allow more dialogs in the UI to be closed with the Esc key.

  • GraphQL API

    • Improved the error messages when the GraphQL queries SearchDomain.alert, SearchDomain.action, and SearchDomain.savedQuery do not find the entity with the given ID.

  • Configuration

    • New configuration BUCKET_STORAGE_MULTIPLE_ENDPOINTS and many configurations using STORAGE_2 as prefix. See Bucket Storage.

    • Added the config CORS_ALLOWED_ORIGINS a comma separated list for CORS allowed origins, default allows all origins.

    • Reduce default value of INGESTQUEUE_COMPRESSION_LEVEL, the ingest queue compression level from 1 to 0. This reduces time spent compressing before inserting into the ingest queue by roughly 4x at the expense of a 10-20% increase in size required in Kafka for the ingest queue topic.

    • When using ZOOKEEPER_URL_FOR_NODE_UUID for assignment of node ID to Humio nodes, and value of ZOOKEEPER_PREFIX_FOR_NODE_UUID (default /humio_autouuid) does not match contents of local UUID file, acquire a fresh node uuid.

    • Added INITIAL_FEATURE_FLAGS which lets you enable/disable feature flags on startup. For instance, setting INITIAL_FEATURE_FLAGS=+UserRoles,-UsagePage enables UserRoles and disables UsagePage.

    • Make ZOOKEEPER_URL optional. When not set, the zookeeper-status-logger job does not run, and the cluster administration page does not display information about a Zookeeper cluster.

  • Other

    • Added warning logs when errors are rendered to browser during oAuth flows.

    • Remove caching of API calls to prevent caching of potential sensitive data.

    • Added a job that scans segments which are waiting to be archived, this value is recorded in the metric:s3-archiving-latency-max.

    • Added exceptions to the Humio logs from AlertJob and ScheduledSearchJob.

    • Improved the error message when an ingest request times out.

    • Added option to specify an IP Filter for which addresses hostname verification should not be made.

    • Added analytics on query language feature use to the audit-log under the fields queryParserMetrics.

    • Added ability to override max auto shard count for a specific repository.

    • Improved usability of the groups page.

    • Improved caching of UI static assets.

    • Allow the same view name across organizations.

    • Improved Humio's detection of Kafka resets. We now load the Kafka cluster id once on boot. If it changes after that, the node will crash.

    • Allow the query scheduler to enqueue segments and aux files for download from bucket storage more regularly. This should ensure that queries fetching small aux files can more reliably keep the download job busy.

    • Added granular IP Filter support for shared dashboards (BETA - API only).

    • Added job which will periodically run a query and record how long it took. By default the query is count().

    • Improved the default permissions on the group page by leaving their view expanded once the user cancels update.

    • Added a limit parameter to the FieldStats function. This parameter limits the number of fields to include in the result.

Bug Fixes

  • UI Changes

    • Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

    • Make writes to Kafka's chatter topic block in a similar manner as writes to global.

    • Bumped the Humio Docker containers to Java 17. If you manually set any --add-opens flags in your JVM config, you should remove them. The container should set the right flags automatically.

    • Humio now tries to avoid interrupting threads during shutdown, instead allowing them to finish their work. This should reduce log noise when shutting down.

    • Removed a spurious warning log when requesting a non-existent hash file from S3.

    • No longer allow requests to /hec to specify organizations by name. We now only accept IDs.

    • The query endpoint API now supports languageVersion for specifying Humio query language versions.

    • When creating ingest and chatter topic, reduce desired max.message.bytes to what Kafka cluster allows, if that is lower than our desired values.

    • Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

    • Fixed an issue where live queries would sometimes double-count parts of the historic data.

    • SAML and OIDC only - During signout, Humio background tabs will be redirected to a signout landing page instead of to the login page.

    • Fixed an issue where repeating queries could cause other queries to fail.

    • Queries on views no longer restart when the ordering of the view's connections is changed.

    • From the alerts overview and the scheduled searches overview, it is now possible to clear the error status on an alert or a scheduled search.

    • When starting ingest, Humio checks that the computed starting position in Kafka is below the Kafka end offset. Ensure that the end offset is requested after the starting position is computed, not before. This might prevent a very rare spurious boot failure.

    • Code completion in the query editor now also works on the right hand side of :=.

    • Reenable a feature to make Humio fetch and check hash files from bucket storage before fetching the segments.

    • Errors on alerts are now cleared more granularly. Errors when starting the alert query are cleared as soon as the query is successfully started, errors from polling the query are cleared when the query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

    • When bootstrapping a new cluster, set the cluster version in global right away. Since nodes will not boot on a snapshot that doesn't specify a cluster version, it is important that this field exists in all snapshots.

    • Reenable a feature to make Humio delete local copies of bucketed segments, even if they are involved in a query.

    • The action message templates {events_str} and {query_result_summary} always evaluate to the same string. To reflect this, the UI has been updated so that these templates are combined into the same item in the template overview for Email, Slack and Webhook actions.

    • Fixed an issue where the digest coordinator could consider a host to be alive if the coordinator hadn't seen any timestamps from that host.

    • Fixed an issue in the Table widget. It will no longer insert 0-values for missing fields in integer columns. Empty fields will be shown consistently, independent of the column data type.

    • Fixed a number of instability issues in the query scheduler. The scheduler should now more reliably ensure that each query either completes, or is cancelled.

    • Errors on scheduled searches are now cleared more granularly. Errors when starting a query are cleared as soon as another query is successfully started, errors from polling a query are cleared when a query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

    • Make Humio handle missing aux files a little faster when downloading segments from bucket storage.

    • The /hec endpoint no longer responds to OPTIONS requests saying it supports GET requests. It doesn't and never has.

    • Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

    • When interacting with the REST API for files, errors now have detailed error messages.

    • The AlertJob and ScheduledSearchJob now only log validation errors from running the queries as warnings, previously, some of these were logged as errors.

    • Fixed an issue where, if a custom parser was overriding a built-in parser, then the custom parser could accidentally be overwritten by creating a new parser with the same name.

    • Fixed a compatibility issue with Filebeat 7.16.0.

    • Reduce noise in the log when the bucket storage upload job attempts to upload a file that is deleted concurrently.

    • Fixed a race condition that could cause digesters to calculate two different offsets during startup when determining where to start consuming, and which partially written segments to discard, which could lead to data loss when partially written segments were replayed from Kafka.

    • Fixed an issue where top would fail if the sum of the values exceeded 2^63-1. Exceeding sums are now pegged to 2^63-1.

    • Remove script-src: unsafe-eval from content security policy.

    • Fixed an issue where the SegmentMoverJob could delete the local copy of a segment, if a pending download of the segment failed the CRC check. The job will now keep the downloaded file at a temporary path until the CRC check completes, to avoid deleting a local copy created by other jobs, e.g. by bucket downloads.

    • For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

    • Fixed an issue where MaxMind databases would only update if a license was present at startup and not if it was added later.

    • Query partition tables updates are now rejected if written by a node that is no longer the cluster leader.

    • Fixed an issue in the Export to file dialog on the search page. It is now possible to export fields with spaces.

    • Fixed an issue where nodes could request partitions from the query partitioning table that were not present.

    • Fixed an issue that repeatedly tried to restart live queries from a given user upon the deletion of the user.

    • No longer allow organization- and system-level ingest tokens to ingest into sandbox and system repos.

    • Fixed an issue where the Humio query URLs sent by actions would land users on the search page in editing mode for the alert or scheduled search that had triggered. Now, they still land on the search page, but not in editing mode.

    • The repository/.../query endpoint now returns a status code of .0 (BadRequest) when given an invalid query in some cases where previously it returned 503 (ServiceUnavailable).

    • Fixed Humio always reading and discarding an already processed message from the ingest queue on boot.

    • Fixed session() such that it works when events arrive out of time order.

Humio Server 1.35.0 Preview (2022-01-17)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.35.0Preview2022-01-172022-01-311.26.0NoYes
JAR ChecksumValue
MD583b164ea22cbc8a347ee22a4e49d87fb
SHA1cde673dc3026cf8455e980a7f1ffc17de2a92072
SHA256a43b1f86fe2f610eadaacfcff50264de578be56959125d24d27e51e1eacc403d
SHA512a0897d2b8acb1ad888c1f0128bc46a9f3a425cc87adc40192ea3089533f247ce0ddff23971b1298d58cdb9f0e93f1bb24ae3392587de3a313fa4bbd89a32747b
Docker ImageSHA256 Checksum
humio-core-dev56193b2add6ece05561e058ffcd1706989b9633cb1da857b26582df7d7bf210a
humio-dev2f6d1b42b5d2d519bd0152bf6e28952a8f5d9e711bfc6c8c50fb58d917d033f0
kafka-dev149bce1bfa2e9c3e8eb6ff3d8c9416fad058b392134cab5958bf405f2553d264
zookeeper-dev9393097554e28403372ef38f87eab200292a41f75d8d38a8d102f926e7919eae

Beta: Bucket storage support for dual targets

Support for dual targets to allow using one as the preferred download and the other to trust for durability. One example of this is to save on cost (on traffic) by using a local bucket implementation, such as MinIO, in the local datacenter as the preferred bucket storage target, while using a remote Amazon S3 bucket as the trusted bucket for durability. If the local MinIO bucket is lost (or just not responding for a while) the Humio cluster still works using the AWS S3 bucket with no reconfiguration or restart required. Configuration of the second bucket is via configuration entries similar to the existing STORAGE keys, but using the prefix STORAGE_2 for the extra bucket.

When using dual targets, bucket storage backends may need different proxy configurations for each backend - or not. The new configuration BUCKET_STORAGE_MULTIPLE_ENDPOINTS (default false) controls whether the proxy configuration in the environment is applied to all bucket storage backends. When set to true, each bucket preserves the active proxy/endpoint configuration and a change to those will trigger creation of a fresh internally persisted bucket storage access configuration.

Improvements, new features and functionality

  • UI Changes

    • New dialogs for creation of parsers and dashboards.

    • Hovering over text within a query now shows the result of interpreting escape characters.

    • Time Selector is now accessible by keyboard.

    • Allow more dialogs in the UI to be closed with the Esc key.

    • Disable the option to creating a view if the user does not have Connect a view permission on any repository. This is more intuitive than getting an empty dropdown of repositories to choose from.

    • Improved dark mode toggle button's accessibility.

    • New feature to select text in the search page event list and include/exclude that in the search query.

    • Added ability to resize search page query field by dragging or fitting to query.

    • Improved accessibility when choosing a theme.

  • GraphQL API

    • Improved the error messages when the GraphQL queries SearchDomain.alert, SearchDomain.action, and SearchDomain.savedQuery do not find the entity with the given ID.

  • Configuration

    • Added INITIAL_FEATURE_FLAGS which lets you enable/disable feature flags on startup. For instance, setting INITIAL_FEATURE_FLAGS=+UserRoles,-UsagePage enables UserRoles and disables UsagePage.

    • New configuration BUCKET_STORAGE_MULTIPLE_ENDPOINTS and many configurations using STORAGE_2 as prefix. See Bucket Storage

    • Make ZOOKEEPER_URL optional. When not set, the zookeeper-status-logger job does not run, and the cluster administration page does not display information about a Zookeeper cluster.

    • Reduce default value of INGESTQUEUE_COMPRESSION_LEVEL, the ingest queue compression level from 1 to 0. This reduces time spent compressing before inserting into the ingest queue by roughly 4x at the expense of a 10-20% increase in size required in Kafka for the ingest queue topic.

    • When using ZOOKEEPER_URL_FOR_NODE_UUID for assignment of node ID to Humio nodes, and value of ZOOKEEPER_PREFIX_FOR_NODE_UUID (default /humio_autouuid) does not match contents of local UUID file, acquire a fresh node uuid.

  • Other

    • Added granular IP Filter support for shared dashboards (BETA - API only).

    • Allow the query scheduler to enqueue segments and aux files for download from bucket storage more regularly. This should ensure that queries fetching small aux files can more reliably keep the download job busy.

    • Added a job that scans segments which are waiting to be archived, this value is recorded in the metric:s3-archiving-latency-max.

    • Added warning logs when errors are rendered to browser during oAuth flows.

    • Improved the error message when an ingest request times out.

    • Added option to specify an IP Filter for which addresses hostname verification should not be made.

    • Improved the default permissions on the group page by leaving their view expanded once the user cancels update.

    • Added a limit parameter to the FieldStats function. This parameter limits the number of fields to include in the result.

    • Added exceptions to the Humio logs from AlertJob and ScheduledSearchJob.

    • Allow the same view name across organizations.

    • Added ability to override max auto shard count for a specific repository.

    • Improved usability of the groups page.

    • Added analytics on query language feature use to the audit-log under the fields queryParserMetrics.

    • Added job which will periodically run a query and record how long it took. By default the query is count().

    • Improved Humio's detection of Kafka resets. We now load the Kafka cluster id once on boot. If it changes after that, the node will crash.

Bug Fixes

  • UI Changes

    • Fixed an issue where repeating queries could cause other queries to fail.

    • Errors on alerts are now cleared more granularly. Errors when starting the alert query are cleared as soon as the query is successfully started, errors from polling the query are cleared when the query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

    • When starting ingest, Humio checks that the computed starting position in Kafka is below the Kafka end offset. Ensure that the end offset is requested after the starting position is computed, not before. This might prevent a very rare spurious boot failure.

    • Code completion in the query editor now also works on the right hand side of :=.

    • Fixed an issue where top would fail if the sum of the values exceeded 2^63-1. Exceeding sums are now pegged to 2^63-1.

    • Fixed an issue where nodes could request partitions from the query partitioning table that were not present.

    • Query partition tables updates are now rejected if written by a node that is no longer the cluster leader.

    • Reenable a feature to make Humio fetch and check hash files from bucket storage before fetching the segments.

    • From the alerts overview and the scheduled searches overview, it is now possible to clear the error status on an alert or a scheduled search.

    • Remove script-src: unsafe-eval from content security policy.

    • Humio now tries to avoid interrupting threads during shutdown, instead allowing them to finish their work. This should reduce log noise when shutting down.

    • Queries on views no longer restart when the ordering of the view's connections is changed.

    • Fixed an issue where the Humio query URLs sent by actions would land users on the search page in editing mode for the alert or scheduled search that had triggered. Now, they still land on the search page, but not in editing mode.

    • The AlertJob and ScheduledSearchJob now only log validation errors from running the queries as warnings, previously, some of these were logged as errors.

    • Reduce noise in the log when the bucket storage upload job attempts to upload a file that is deleted concurrently.

    • When creating ingest and chatter topic, reduce desired max.message.bytes to what Kafka cluster allows, if that is lower than our desired values.

    • Fixed a compatibility issue with Filebeat 7.16.0.

    • Reenable a feature to make Humio delete local copies of bucketed segments, even if they are involved in a query.

    • For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

    • Bumped the Humio Docker containers to Java 17. If you manually set any --add-opens flags in your JVM config, you should remove them. The container should set the right flags automatically.

    • No longer allow organization- and system-level ingest tokens to ingest into sandbox and system repos.

    • Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

    • Errors on scheduled searches are now cleared more granularly. Errors when starting a query are cleared as soon as another query is successfully started, errors from polling a query are cleared when a query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

    • The /hec endpoint no longer responds to OPTIONS requests saying it supports GET requests. It doesn't and never has.

    • Fixed session() such that it works when events arrive out of time order.

    • Make writes to Kafka's chatter topic block in a similar manner as writes to global.

    • Make Humio handle missing aux files a little faster when downloading segments from bucket storage.

    • The query endpoint API now supports languageVersion for specifying Humio query language versions.

    • Fixed a number of instability issues in the query scheduler. The scheduler should now more reliably ensure that each query either completes, or is cancelled.

    • Fixed an issue where the SegmentMoverJob could delete the local copy of a segment, if a pending download of the segment failed the CRC check. The job will now keep the downloaded file at a temporary path until the CRC check completes, to avoid deleting a local copy created by other jobs, e.g. by bucket downloads.

    • Fixed a race condition that could cause digesters to calculate two different offsets during startup when determining where to start consuming, and which partially written segments to discard, which could lead to data loss when partially written segments were replayed from Kafka.

    • Removed a spurious warning log when requesting a non-existent hash file from S3.

    • Fixed an issue where MaxMind databases would only update if a license was present at startup and not if it was added later.

    • Fixed an issue where the digest coordinator could consider a host to be alive if the coordinator hadn't seen any timestamps from that host.

    • Fixed an issue in the Export to file dialog on the search page. It is now possible to export fields with spaces.

    • Fixed an issue where, if a custom parser was overriding a built-in parser, then the custom parser could accidentally be overwritten by creating a new parser with the same name.

    • Fixed an issue in the Table widget. It will no longer insert 0-values for missing fields in integer columns. Empty fields will be shown consistently, independent of the column data type.

    • The repository/.../query endpoint now returns a status code of .0 (BadRequest) when given an invalid query in some cases where previously it returned 503 (ServiceUnavailable).

    • Fixed an issue that repeatedly tried to restart live queries from a given user upon the deletion of the user.

    • Fixed Humio always reading and discarding an already processed message from the ingest queue on boot.

    • SAML and OIDC only - During signout, Humio background tabs will be redirected to a signout landing page instead of to the login page.

    • No longer allow requests to /hec to specify organizations by name. We now only accept IDs.

    • Fixed an issue where live queries would sometimes double-count parts of the historic data.

    • The action message templates {events_str} and {query_result_summary} always evaluate to the same string. To reflect this, the UI has been updated so that these templates are combined into the same item in the template overview for Email, Slack and Webhook actions.

    • When bootstrapping a new cluster, set the cluster version in global right away. Since nodes will not boot on a snapshot that doesn't specify a cluster version, it is important that this field exists in all snapshots.

    • Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

Humio Server 1.34.3 Stable (2022-03-09)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.34.3Stable2022-03-092023-03-091.26.0NoNo
JAR ChecksumValue
MD57184f2582bed56c0b29ffb2d39f508a5
SHA19d7beb007f9ec9e7603bcbf164b3006dce0932ef
SHA256ac95c6538dc88b6af31f0c55aaa46740503860ea90ad41d330593402915d885b
SHA512d4738190dfd9b100ac896969e70a541f1d0242fb822f312142636cb5055009f13f0dbca6193f6cb8ce89d36d9f3f8b9ebec5a684570a4f9500bd8ffc3379ee6a
Docker ImageSHA256 Checksum
humio-core-dev64547f071a29e5df7eb945f369b28cf6d365b1590f577163fd18fe8b76ce63ce
humio-dev955acd05d628a4da69a546ea58134a786c77349bfc21e10631b3f5b2934140ab
kafka-devb3318e88aa3aaaae09d88fae2bd37882d1a41738983a1ef783f9f07c30c73101
zookeeper-dev049489e9fcda7ca0ea11d96e45d8dde8d9a6582e0b9740b6865a952ec13332e5

Performance improvements of Ingest and internal caching.

Bug Fixes

  • Summary

    • Performance improvements of Ingest and internal caching.

Humio Server 1.34.2 Stable (2022-02-01)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.34.2Stable2022-02-012023-02-011.26.0NoNo
JAR ChecksumValue
MD5ebca829a100a92c4b96f05f421c9e5d2
SHA1f9d21990e4ae6f64eac6bd6aa6d65899583d1311
SHA2562141bd8fb2537f0242b30998938d780bd53cedbf2b04622b956923f677a56350
SHA51202d33bdfb65bf5ab949da8ae0a1bb9f04a509564c8d4a74cc08f5033040987152abd42743b0720290304f4bd5c4e50550327117efb6eda01d3b0ed8ef357938e
Docker ImageSHA256 Checksum
humio-core-deva927eb85f709561b659e3a566a5b0fd3e6b3be84b19db2832d70722897265cbb
humio-dev426715cb9faedce379d6a6add003cfcaa3fe9ce5b5ce706fab202b89eb5c8c45
kafka-devf181a5a1668d6c3f1ebe5e5216a00b393ee20eb0f1845d1a93309fdbfac8406d
zookeeper-dev361063a0a2eb0361209781f7dff9d5f0067b33806f14882fc4a0a0ff9f434b66

Updated dependencies with security fixes and weakness.

Bug Fixes

  • Security

    • Updated dependencies to follow-redirects for CVE-2022-0155.

    • Updated dependencies to nanoid for CVE-2021-23566.

    • Updated dependencies to node-fetch for CVE-2022-0235.

    • Updated dependencies to Akka for CVE-2021-42697.

    • Updated dependencies to Jawn for CVE-2022-21653.

  • Summary

    • Fixes an issue with epoch and offsets not always being stripped from segments.

    • Fixed an issue where live queries would sometimes double-count parts of the historic data.

    • Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

Humio Server 1.34.1 Stable (2022-01-06)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.34.1Stable2022-01-062023-01-061.26.0NoNo
JAR ChecksumValue
MD51d6b54fc6b4f52abff6c1106a904e4d1
SHA167e6e0cd4e6eb59a0d88f85dc0f511aefacef1dc
SHA25623f50f620fd5e51755521aba8185b76e4ca0187206fd55e8ed5fbbe14e42578b
SHA5126ad8fe4040b7c2e80643071e05b1d305f6d66e74c4041d3a4ac56f84ec6fd3f2b63c04c421029c436f081b8ab22e8a60bf17c5330f7fe117d178c596526a344f
Docker ImageSHA256 Checksum
humio-core-devfa7e9355cd4f41e64b404e65e33166c28fdc6c2ce5ceeea382007778f9ff64ce
humio-deve66c6b3fcf45bd36502c877e8a4a617f9f662c5cf672e6c6c73b45445d41ad20
kafka-dev459b3a6df8a678493bfb3266d243b867ed3ae4251464276c854afa0b2f784dac
zookeeper-dev748cfc151533e1e2efc870299bc5c2b10fda97ec0c6f522dd8c8576d9aea315e

Updated dependencies with security fixes and weakness.

Bug Fixes

  • Security

    • Updated dependencies to Netty to fix CVE-2021-43797

    • Updated dependencies to log4j 2.17.1 to fix CVE-2021-44832 and CVE-2021-45105

  • Summary

    • Updated dependencies to Jackson to fix a weakness

Humio Server 1.34.0 Stable (2021-12-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.34.0Stable2021-12-152022-12-151.26.0NoYes
JAR ChecksumValue
MD54dc3b67c42b44e59e0ad6cc02a220f12
SHA1099a9ae07d5595fb06c145aaa80b46ba9f74dd10
SHA25622cd6f60f030d56bcae159b853efe6dcd76f7add127e64c37bcca58c66d1a155
SHA5122645369a9ec989c1b40b190993ecbd4eca8be63b60318a1b1259124819446c06c3bbba92a9c22f1e194133b9da5d05b6c0346369c33e8c33a9777a2a168ae524

Humio Server 1.34 REQUIRES minimum previous version 1.26.0 of Humio to start. Clusters wishing to upgrade from older versions must upgrade to 1.26.0+ first. After running 1.34.0 or later, you cannot downgrade to versions prior to 1.26.0.

You can now use the mouse to resize columns in the event list. Previously you had to click the column header and use the Increase / Decrease Width buttons.

Improvements, new features and functionality

  • UI Changes

    • Allow resize of columns in the event list by mouse.

    • Dark mode is officially deemed stable enough to be out of beta.

    • Added buttons for stopping all queries, streaming queries, and historical queries from inside the query monitor.

    • Updated the links for Privacy Notice and Terms and Conditions.

    • Added autofocus to the first field when opening a dialog using the save as functionality from the Search page.

    • The overall look of message boxes in Humio has been updated.

    • Validation error messages are now more precise and have improved formatting.

    • Disable actions if permissions are handled externally.

    • Added maximum width to tabs on the Group page, so they do not keep expanding forever.

  • GraphQL API

    • The GraphQL field isEventForwardingEnabled on the HumioMetadata type is deprecated, as it is no longer in use internally. If you rely on this, please let us know.

    • Added three GraphQL mutations for stopping queries: stopAllQueries, stopStreamingQueries, and stopHistoricalQueries.

    • Added GraphQL mutation clearRecentQueries which a user can run to clear their recent queries in a specific view or repository.

    • Changed old personal user token implementation to hash based.

    • Renamed the deleteEvents related GraphQL mutations and queries to redactEvents. The redactEvents API is intended for redacting sensitive data from a repository, not for bulk deletion of events. We think the new name invites fewer misunderstandings.

    • Added 2-phase migration that will allow old user api tokens to be used and clean global from secrets after a 30 day period.

  • Configuration

    • When checking if the ViewAction.EventForwarding action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if the event forwarding is not enabled on the server.

  • Other

    • Reword regular expression related error messages.

    • Retention based on compressed size will no longer account for segment replication.

    • Added new metric: bucket-storage-upload-latency-max. It shows the amount of time spent for the event that that has been pending for upload to bucket storage the longest.

    • New metric: ingest-request-delay. Histogram of ingest request time spent being delayed due to exceeding limit on concurrent processing of ingest (milliseconds).

    • Improved partition layout auto-balancing algorithm.

    • Added query function math:arctan2 to the query language.

    • Minor optimization when using groupBy with a single field.

    • Added validation and a more clear error message for queries with a time span of 0.

    • Improved error messages when an invalid regular expression is used in replace.

    • The kvParse() query function can now parse unquoted empty values using the new parameter separatorPadding to specify if your data has whitespace around the key-value separator (typically =). The default is "Unknown", which will leave the functionality of the function unchanged.

    • Added metric for the number of currently running streaming queries.

    • It is now possible to create actions, alerts, scheduled searches, and parsers from Yaml template files.

    • Added management API to put hosts in maintenance mode.

    • Create, update, and delete of dashboards is now audit logged.

    • Added a precondition that ensures that the number of ingest partitions cannot be reduced.

    • Improved shutdown logic slightly, helping prevent thread pools from getting stuck or logging spurious errors during shutdown.

    • Node roles can now be assigned/removed at runtime.

    • Prepopulate email field when invited user is filling in a form with this information.

    • Added a communityID function for calculating hashes of network flow tuples according to the [Community ID Spec](https://github.com/corelight/community-id-spec).

    • Added Australian states to the States dropdown.

    • Improved the error reporting when installing, updating or exporting a package fails.

    • Refactored query functions join, selfjoin, and selfjoinfilter into user-visible and internal implementations.

    • It is now possible to ingest logs into Humio using LogStash v.7.13 and upwards.

    • Added checksum verification within hash filter files on read.

    • Improved handling of multiple nodes attempting to create views with the same names at the same time, as might happen when bootstrapping a cluster.

    • Added support in the humio event collector for organization- and system-wide ingest tokens and the ability to use a parser from a different repo than the one being ingested into.

    • Reduce limit on number of datasources for sandbox repositories created when a user is created to .0 by default.

    • Added a minSpan parameter to timeChart() and bucket(), which can be used to specify a minimum span when using a short time interval.

    • Query validation has been improved to include several errors which used to first show up after submitting search.

    • Query editor: improved code completion of function names.

    • A compressed segment with a size of 1GB will now always count for retention as 1 GB. Previously, a compressed segment with a size of 1GB might count for more than 1GB when calculating retention, if that segment had more replicas than configured. The effect on the retention policy was that if you had configured retention of .0GB compressed bytes, Humio might retain less than .0GB of compressed data if any of those segments had too many replicas.

    • Made the transfer coordinator display more clear errors instead of an internal server error for multinode clusters.

    • Added "export as yaml" function to the list pages of parsers, actions and scheduled searches.

    • Improved performance of the query functions drop() and rename() by quite a bit.

Bug Fixes

  • Security

    • Updated dependencies to log4j 2.16 to remove of message lookups (CVE-2021-44228 and CVE-2021-45046)

  • Other

    • Changed field type for zip codes.

    • Fixed an issue where streaming (exporting) query results in JSON format could include extra "," characters within the output.

    • Fixed an issue where release notes would not close when a release is open.

    • Fixed an issue where OIDC without a discovery endpoint would fail to configure if OIDC_TOKEN_ENDPOINT_AUTH_METHOD was not set.

    • Fixed a bug in the validation of the ‘bits’ parameter of hashMatch() and hashRewrite().

    • Crash the node if any of a number of critical threads die. This should help prevent zombie nodes.

    • Fixed an issue where the SegmentMoverJob could delete the local copy of a segment, if a pending download of the segment failed the CRC check. The job will now keep the downloaded file at a temporary path until the CRC check completes, to avoid deleting a local copy created by other jobs, e.g. by bucket downloads.

    • Fixed an issue on sandbox renaming, that would allow you to rename a sandbox and end up in a bad state.

    • Fixed an issue when adding a group to a repository or view than an error message is displayed when the user is not the organization owner or root.

    • Alerts and scheduled searches are now enabled per default when created. The check disabling these entities if no actions are attached has been replaced with a warning, which informs a user that even though the entity is enabled, nothing will trigger since no actions are attached.

    • Fixed an issue where the web client could start queries from the beginning of time when scrolling backwards through events in the UI.

    • Fixed an issue where clicking on the counters of parsed events on the Parsers page would open an empty search page, except for built-in parsers. Now, it correctly shows the latest parsed events for all parsers (except package parsers).

    • Fixed an issue in the interactive tutorial.

    • Prevent unauthorized analytics requests being sent.

    • Fixed an issue where a dashboard installed with a YAML file could be slightly different than what was specified in the file.

    • Removed error query param from URL when entering Humio.

    • Removed a spurious warning log when requesting a non-existent hash file from S3.

    • Fixed an issue causing Humio running on Java 16+ to return incorrect search results when the input query contains Unicode surrogate pairs (e.g. when searching for an emoji).

    • Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

    • When checking if the ViewAction.ChangeRepoConnections action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if checked on a repository, as the action only makes sense on views.

    • Fixed a number of stability issues with the event redaction job.

    • Support Java 17.

    • Changed default package type to "application" on the export package wizard.

    • Fixed an issue on on-prem trial license that would use user count limits from cloud.

    • Fixed an issue where certain problems would highlight the first word in a query.

    • Fixed an issue where sort() would cause events to be read ina non-optimal order for the entire query.

    • Changes to the state of IOC access on organizations are now reflected in the audit log.

    • The field vhost in internal Humio logging is now reserved for denoting the host logging the message. Other uses of vhost now uses the field hostId.

    • Temporary fix of issue with live queries not having first aggregator as bucket() or timeChart(), but then later in the query having those as a second aggregator. As a temporary fix, such queries will fail. In later releases, this will get fixed more properly.

    • Fixed an issue where an alert would not be throttled until after its actions had completed, which could make the alert trigger multiple times shortly after each other if an action was slow. Now, the alert is throttled as soon as it triggers.

    • Fixed a bug where only part of the Users page was loading when navigating from the All organizations page.

    • Fixed an issue where missing undersized segments in a datasource might cause Humio to repeatedly transfer undersized segments between nodes.

    • Alerts and scheduled searches are no longer run on cloud for organizations with an expired trial license, and on-prem for any expired license.

    • Fixed an issue where series() failed to serialize its state properly.

    • Fixed an issue that in rare cases would cause login errors.

    • Remove the ability to create ingest tokens and ingest listeners on system repositories.

    • When a digester fails to start, rather than restarting the JVM as previous releases did, keep retrying to start assuming that the issue is transient, such as data for a single ingest partition being unavailable for a short while. While in this situation the process reports the metric for ingest latency on the affected partitions as being uptime of the JVM process at this point. The idea is to signal that data is not flowing on those partitions, so that a monitored metric can raise an alarm somewhere. In lack of a proper latency in this situation, it's better to have a growing non-zero metrics than having the metrics being zero.

    • Fixed a bug with the cache not being populated between restarts on single node clusters.

    • Fixed an issue where the segment merger could mishandle errors during merge.

    • Fixed an issue where some regexes could not be used.

    • Fixed an edge case where Humio might create multiple copies of the same datasource when the number of Kafka partitions is changed. The fix ensures only one copy will be created.

    • Use a fresh (random) name for the tmp folder below the datadir to ensure that it is a proper subdir of the datadir and not a mount point.

    • Fixed an issue where a scheduled search failed and was retried, if it had multiple actions and at least one action was unknown to Humio. Now, the unknown action is logged, but the scheduled search completes successfully and continues to the next scheduled run.

    • Browser storage is now cleared when initiating while unauthenticated.

    • Fixed an issue where a failing event forwarder would be cached indefinitely and could negatively impact Humio performance.

    • Fixed a bug where shared lookup files could not be downloaded from the UI.

    • Fixed a compatibility issue with Filebeat 7.16.0

    • Fixed incorrect results when searching through saved queries and recent queries.

    • Changes to the state of backend feature flags are now reflected in the audit log.

    • Fixed a bug where query coordination partitions would not get updated.

    • When creating or updating an action, the backend now verifies that the host url associated with the action is prefixed with either 'http://' or 'https://'. This affects Actions of the type: Webhook, OpsGenie, Single-Channel Slack and VictorOps.

    • Fixed an issue where error messages would show wrong input.

    • When checking if the ViewAction.ChangeS3ArchivingSettings action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if checked on a view, as the action only makes sense on repositories.

    • Fixed an issue where a digest node could be unable to rejoin the cluster after being shut down if all other digest nodes were also down at the time.

    • When an alert query encounters a warning and Humio is not configured to trigger alerts despite warnings (ALERT_DESPITE_WARNINGS=true, see [docs](https://library.humio.com/preview/docs/automated/alerts/throttle-period/#errors-warnings)), the warning text will now be shown as an error message on the alert in the UI.

    • Addressed an issue causing Humio to sometimes error log an ArrayIndexOutOfBoundsException during shutdown.

    • Fixed some widgets on dashboards reporting errors while waiting for data to load.

    • Fixed an issue where comments spanning multiple lines wouldn't be colored correctly.

    • No longer return the "Query Plan" in responses, but return a hash in the new field hashedQueryOnView instead. The plan could leak information not otherwise visible to the user, such as query prefixes being applied.

    • When performing jobs triggered via the Redact Events API, Humio could restart queries for unrelated views until the delete job completed. This has been improved, so only views affected by the delete will be impacted.

    • Include view+parser-name in thread dumps when time is spent inside a parser.

    • Fixed a bug where offsets from one Kafka partition could be used when deciding where to start consuming for another partition, in the case where there were too many datasources in the repo. This led to a crash loop when the affected node was restarted.

    • Fixed styling issue on the search page where long errors would overflow the screen.

    • Fixed an issue where the segment merger would write that the current node had a segment slightly before registering that segment in the local node.

    • Fixed a bug where invalid UTF-16 characters could not be ingested. They are now converted to 'ufffd'.

    • Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

Humio Server 1.33.3 Preview (2021-12-10)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.33.3Preview2021-12-102021-12-151.26.0NoNo
JAR ChecksumValue
MD510d2ee69d0bcdc6313fb3529912007ba
SHA15be098e4f3f6500704e85c0763c918763b90aa34
SHA256eaefa5ce2c162fbd9d0a57d3b7c47dee828848eabdd7e96d885a812208c20a46
SHA512a9268b87f416d9b857eccb506c304ba7ca552cd6408ac13791b160e0d17c3d82e67213025ec7bca820e970676e4a24d1a1f4d20ff27e3cbc5bc30edf874e58a0

More security fixes related to log4j logging.

Bug Fixes

  • Security

    • Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

Humio Server 1.33.2 Preview (2021-12-10)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.33.2Preview2021-12-102021-12-151.26.0NoNo
JAR ChecksumValue
MD5393be03445adbf84f63ef93b522b85fa
SHA136454936dfe7c3863656043a8ee1d8639c1c198e
SHA256e03616ba1d8d92e80031231ad7e2b7666121e7ccf7eee10f7a816241a90706ac
SHA5125d0504538cfa1db51f7188d4f6fef03aeb5a69b466f2e8367e91208745c4bf9050f271ffdf52ed6027796487ac11106726fbf3d7c3d6e259efa49f369793aa96

Security fix related to log4j logging, and fix compatibility with Filebeat.

Bug Fixes

  • Security

    • Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

  • Summary

    • Fixed a compatibility issue with Filebeat 7.16.0

Humio Server 1.33.1 Preview (2021-11-23)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.33.1Preview2021-11-232021-12-151.26.0NoNo
JAR ChecksumValue
MD5d9f270df38f2ce472801c81a06fa67af
SHA1c5740a06b4b86a8615767c388a7cf6d3e3a8ccf1
SHA256ed3c03b5dcb8fe2c7230bae2775346283d7cdc143854260672a5ba66f11d612b
SHA512d2762a9fa648af32e85205b4d972ad15d47870fc030c111d31ca4d048ce9459ce6e50a3bce0063f0c7347a6640181b4e3c41d1273a4c82b297fd8d3c844c529a

Critical bug fixes related to version dependencies, alert throttling, etc.; Improve Interactive Tutorial.

Bug Fixes

  • Summary

    • Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

    • Reverted from 1.33.0 Errors on alerts, which are shown in the alert overview, are now only cleared when either the alert query is updated by a user or the alert triggers. Previously, errors that occurred when actions were triggered would be removed when the alert no longer triggered. Now, they will be displayed until the actions trigger successfully. Conversely, errors that occur when running the query may now remain until the next time the alert triggers, where they would previously be removed as soon as the query run again without errors.

      See original release note entry in 1.33.0

    • Fixed an issue in the interactive tutorial.

    • Fixed an issue that in rare cases would cause login errors.

    • Fixed an issue where an alert would not be throttled until after its actions had completed, which could make the alert trigger multiple times shortly after each other if an action was slow. Now, the alert is throttled as soon as it triggers.

    • Updated a dependency to a version fixing a critical bug.

Humio Server 1.33.0 Preview (2021-11-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.33.0Preview2021-11-152021-12-151.26.0NoYes
JAR ChecksumValue
MD52964782694b82a39cc5b644d040fae68
SHA1b520dbabec0321b953c496b960710ba5fb6614a7
SHA2568b8de633ca08c9592ee2441b0498de1a86aa4093a505821923be7e8501b62526
SHA512be827349bf450d51b4c42c55c13120ba735196f598eaec798a7eb11b8e1320a6ad86caefca3841a3560013311e30347dc595a96ed59d4cb5c0cf946e72208ac2

1.33 REQUIRES minimum version 1.26.0 of Humio to start. Clusters wishing to upgrade from older versions must upgrade to 1.26.0+ first. After running 1.33.0 or later, you cannot run versions prior to 1.26.0.

Once the release has been deployed, all existing personal api tokens will be hashed so they still can be used, but you will not be able to retrieve them again. If you want to preserve the tokens, be sure to copy it into a secrets vault before the release is deployed. The api-token field on the User type in GraphQL has been removed.

You can now use the mouse to resize columns in the event list. Previously you had to click the column header and use the "Increase / Decrease Width" buttons.

Improvements, new features and functionality

  • UI Changes

    • Updated the links for Privacy Notice and Terms and Conditions.

    • The overall look of message boxes in Humio has been updated.

    • Added autofocus to the first field when opening a dialog using the save as functionality from the Search page.

    • Dark mode is officially deemed stable enough to be out of beta.

    • Allow resize of columns in the event list by mouse.

    • Disable actions if permissions are handled externally.

    • Added buttons for stopping all queries, streaming queries, and historical queries from inside the query monitor.

    • Added maximum width to tabs on the Group page, so they do not keep expanding forever.

    • Validation error messages are now more precise and have improved formatting.

  • GraphQL API

    • The GraphQL field isEventForwardingEnabled on the HumioMetadata type is deprecated, as it is no longer in use internally. If you rely on this, please let us know.

    • Added GraphQL mutation clearRecentQueries which a user can run to clear their recent queries in a specific view or repository.

    • Added 2-phase migration that will allow old user api tokens to be used and clean global from secrets after a 30 day period.

    • Renamed the deleteEvents related GraphQL mutations and queries to redactEvents. The redactEvents API is intended for redacting sensitive data from a repository, not for bulk deletion of events. We think the new name invites fewer misunderstandings.

    • Added three GraphQL mutations for stopping queries: stopAllQueries, stopStreamingQueries, and stopHistoricalQueries.

    • Changed old personal user token implementation to hash based.

  • Configuration

    • When checking if the ViewAction.EventForwarding action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if the event forwarding is not enabled on the server.

  • Other

    • Query validation has been improved to include several errors which used to first show up after submitting search.

    • Added validation and a more clear error message for queries with a time span of 0.

    • Retention based on compressed size will no longer account for segment replication.

    • Query editor: improved code completion of function names.

    • New metric: ingest-request-delay. Histogram of ingest request time spent being delayed due to exceeding limit on concurrent processing of ingest (milliseconds).

    • Improved the error reporting when installing, updating or exporting a package fails.

    • Added new metric: bucket-storage-upload-latency-max. It shows the amount of time spent for the event that that has been pending for upload to bucket storage the longest.

    • Made the transfer coordinator display more clear errors instead of an internal server error for multinode clusters.

    • Node roles can now be assigned/removed at runtime.

    • The kvParse() query function can now parse unquoted empty values using the new parameter separatorPadding to specify if your data has whitespace around the key-value separator (typically =). The default is "Unknown", which will leave the functionality of the function unchanged.

    • Create, update, and delete of dashboards is now audit logged.

    • Added a precondition that ensures that the number of ingest partitions cannot be reduced.

    • Added support in the humio event collector for organization- and system-wide ingest tokens and the ability to use a parser from a different repo than the one being ingested into.

    • Added query function math:arctan2 to the query language.

    • Added metric for the number of currently running streaming queries.

    • Improved performance of the query functions drop() and rename() by quite a bit.

    • Improved error messages when an invalid regular expression is used in replace.

    • Improved handling of multiple nodes attempting to create views with the same names at the same time, as might happen when bootstrapping a cluster.

    • Prepopulate email field when invited user is filling in a form with this information.

    • It is now possible to ingest logs into Humio using LogStash v.7.13 and upwards.

    • Added "export as yaml" function to the list pages of parsers, actions and scheduled searches.

    • Added a minSpan parameter to timeChart() and bucket(), which can be used to specify a minimum span when using a short time interval.

    • Reduce limit on number of datasources for sandbox repositories created when a user is created to .0 by default.

    • Reword regular expression related error messages.

    • Added Australian states to the States dropdown.

    • Refactored query functions join, selfjoin, and selfjoinfilter into user-visible and internal implementations.

    • Improved shutdown logic slightly, helping prevent thread pools from getting stuck or logging spurious errors during shutdown.

    • A compressed segment with a size of 1GB will now always count for retention as 1 GB. Previously, a compressed segment with a size of 1GB might count for more than 1GB when calculating retention, if that segment had more replicas than configured. The effect on the retention policy was that if you had configured retention of .0GB compressed bytes, Humio might retain less than .0GB of compressed data if any of those segments had too many replicas.

    • Added checksum verification within hash filter files on read.

    • Added management API to put hosts in maintenance mode.

    • Minor optimization when using groupBy with a single field.

    • Added a communityID function for calculating hashes of network flow tuples according to the [Community ID Spec](https://github.com/corelight/community-id-spec).

    • It is now possible to create actions, alerts, scheduled searches, and parsers from Yaml template files.

    • Improved partition layout auto-balancing algorithm.

Bug Fixes

  • Other

    • Fixed an issue on on-prem trial license that would use user count limits from cloud.

    • Fixed a bug where offsets from one Kafka partition could be used when deciding where to start consuming for another partition, in the case where there were too many datasources in the repo. This led to a crash loop when the affected node was restarted.

    • When an alert query encounters a warning and Humio is not configured to trigger alerts despite warnings (ALERT_DESPITE_WARNINGS=true, see [docs](https://library.humio.com/preview/docs/automated/alerts/throttle-period/#errors-warnings)), the warning text will now be shown as an error message on the alert in the UI.

    • Fixed an issue where the web client could start queries from the beginning of time when scrolling backwards through events in the UI.

    • Temporary fix of issue with live queries not having first aggregator as bucket() or timeChart(), but then later in the query having those as a second aggregator. As a temporary fix, such queries will fail. In later releases, this will get fixed more properly.

    • Changed field type for zip codes.

    • No longer return the "Query Plan" in responses, but return a hash in the new field hashedQueryOnView instead. The plan could leak information not otherwise visible to the user, such as query prefixes being applied.

    • Fixed an issue where a failing event forwarder would be cached indefinitely and could negatively impact Humio performance.

    • Fixed an issue where sort() would cause events to be read ina non-optimal order for the entire query.

    • Fixed an edge case where Humio might create multiple copies of the same datasource when the number of Kafka partitions is changed. The fix ensures only one copy will be created.

    • Fixed a number of stability issues with the event redaction job.

    • Alerts and scheduled searches are now enabled per default when created. The check disabling these entities if no actions are attached has been replaced with a warning, which informs a user that even though the entity is enabled, nothing will trigger since no actions are attached.

    • Fixed an issue where clicking on the counters of parsed events on the Parsers page would open an empty search page, except for built-in parsers. Now, it correctly shows the latest parsed events for all parsers (except package parsers).

    • Fixed styling issue on the search page where long errors would overflow the screen.

    • Fixed a bug with the cache not being populated between restarts on single node clusters.

    • Changes to the state of backend feature flags are now reflected in the audit log.

    • Fixed an issue where a dashboard installed with a YAML file could be slightly different than what was specified in the file.

    • Fixed an issue where certain problems would highlight the first word in a query.

    • Fixed an issue causing Humio running on Java 16+ to return incorrect search results when the input query contains Unicode surrogate pairs (e.g. when searching for an emoji).

    • Removed error query param from URL when entering Humio.

    • Fixed an issue where the segment merger would write that the current node had a segment slightly before registering that segment in the local node.

    • Addressed an issue causing Humio to sometimes error log an ArrayIndexOutOfBoundsException during shutdown.

    • Fixed an issue where series() failed to serialize its state properly.

    • Fixed a bug where invalid UTF-16 characters could not be ingested. They are now converted to 'ufffd'.

    • Crash the node if any of a number of critical threads die. This should help prevent zombie nodes.

    • When performing jobs triggered via the Redact Events API, Humio could restart queries for unrelated views until the delete job completed. This has been improved, so only views affected by the delete will be impacted.

    • Fixed a bug where only part of the Users page was loading when navigating from the All organizations page.

    • Alerts and scheduled searches are no longer run on cloud for organizations with an expired trial license, and on-prem for any expired license.

    • Fixed a bug in the validation of the ‘bits’ parameter of hashMatch() and hashRewrite().

    • Include view+parser-name in thread dumps when time is spent inside a parser.

    • Fixed incorrect results when searching through saved queries and recent queries.

    • Support Java 17.

    • Fixed an issue where error messages would show wrong input.

    • Fixed an issue where comments spanning multiple lines wouldn't be colored correctly.

    • Fixed an issue when adding a group to a repository or view than an error message is displayed when the user is not the organization owner or root.

    • The field vhost in internal Humio logging is now reserved for denoting the host logging the message. Other uses of vhost now uses the field hostId.

    • Use a fresh (random) name for the tmp folder below the datadir to ensure that it is a proper subdir of the datadir and not a mount point.

    • Changed default package type to "application" on the export package wizard.

    • Fixed an issue where a digest node could be unable to rejoin the cluster after being shut down if all other digest nodes were also down at the time.

    • Fixed an issue where the SegmentMoverJob could delete the local copy of a segment, if a pending download of the segment failed the CRC check. The job will now keep the downloaded file at a temporary path until the CRC check completes, to avoid deleting a local copy created by other jobs, e.g. by bucket downloads.

    • Removed a spurious warning log when requesting a non-existent hash file from S3.

    • Fixed a bug where query coordination partitions would not get updated.

    • When checking if the ViewAction.ChangeS3ArchivingSettings action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if checked on a view, as the action only makes sense on repositories.

    • Fixed a bug where shared lookup files could not be downloaded from the UI.

    • When checking if the ViewAction.ChangeRepoConnections action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if checked on a repository, as the action only makes sense on views.

    • Errors on alerts, which are shown in the alert overview, are now only cleared when either the alert query is updated by a user or the alert triggers. Previously, errors that occurred when actions were triggered would be removed when the alert no longer triggered. Now, they will be displayed until the actions trigger successfully. On the other hand, errors that occur when running the query may now remain until the next time the alert triggers, where they would previously be removed as soon as the query run again without errors. This change was reverted in 1.33.1.

    • Browser storage is now cleared when initiating while unauthenticated.

    • Fixed an issue where some regexes could not be used.

    • Fixed an issue where missing undersized segments in a datasource might cause Humio to repeatedly transfer undersized segments between nodes.

    • Fixed an issue where OIDC without a discovery endpoint would fail to configure if OIDC_TOKEN_ENDPOINT_AUTH_METHOD was not set.

    • Fixed some widgets on dashboards reporting errors while waiting for data to load.

    • Prevent unauthorized analytics requests being sent.

    • Fixed an issue where the segment merger could mishandle errors during merge.

    • When a digester fails to start, rather than restarting the JVM as previous releases did, keep retrying to start assuming that the issue is transient, such as data for a single ingest partition being unavailable for a short while. While in this situation the process reports the metric for ingest latency on the affected partitions as being uptime of the JVM process at this point. The idea is to signal that data is not flowing on those partitions, so that a monitored metric can raise an alarm somewhere. In lack of a proper latency in this situation, it's better to have a growing non-zero metrics than having the metrics being zero.

    • When creating or updating an action, the backend now verifies that the host url associated with the action is prefixed with either 'http://' or 'https://'. This affects Actions of the type: Webhook, OpsGenie, Single-Channel Slack and VictorOps.

    • Fixed an issue where a scheduled search failed and was retried, if it had multiple actions and at least one action was unknown to Humio. Now, the unknown action is logged, but the scheduled search completes successfully and continues to the next scheduled run.

    • Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

    • Fixed an issue on sandbox renaming, that would allow you to rename a sandbox and end up in a bad state.

    • Remove the ability to create ingest tokens and ingest listeners on system repositories.

    • Fixed an issue where release notes would not close when a release is open.

    • Changes to the state of IOC access on organizations are now reflected in the audit log.

Humio Server 1.32.8 Stable (2022-03-09)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.32.8Stable2022-03-092023-03-091.16.0NoNo
JAR ChecksumValue
MD594782d07a7feda72ffc831747e6740f1
SHA18c1afb6e1b4fe6e5eabe30823e7705b7a03a7af5
SHA25676eaa3581ad45443af93dd9e6f92f51142bdc082ba8af234b0ffc7f4346ef630
SHA5126929950a72ee073402aea63a3acc016b15ae435ba5c9cf4c24b94fbf51af01c4ccfa4da223374527b597c154f0ca72a114feb0ec45bfae55fad8be17645bccf5
Docker ImageSHA256 Checksum
humio-core-dev49d2631113684a8fc8b3ad53e5545a661961607a3033357ee977ce50d0b49f0a
humio-devd8f1892f444ab53d2e94419a096978da0eba8d7a995096d9b6f031162fd3bb3c
kafka-dev3bbbaec63eb2ca089800172d94e95f6bb84266dcbac3e76217f50c4169133546
zookeeper-dev9830902ac961b08c778f38b8714dcfab6be076c1acc5366db459a8560cb6eb61

Updated dependencies with security fixes and weakness and improved performance.

Bug Fixes

  • Security

    • Updated dependencies to Akka to fix CVE-2021-42697.

    • Updated dependencies to jawn to fix CVE-2022-21653.

  • Summary

    • Performance improvements of Ingest and internal caching.

    • Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

    • Fixes issue with epoch and offsets not always being stripped from segments.

Humio Server 1.32.7 Stable (2022-01-06)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.32.7Stable2022-01-062023-01-061.16.0NoNo
JAR ChecksumValue
MD530080b4b84bb4aba37eb11023019bd78
SHA1c53f4ac43beee249a68c90cae62d0b768b1284d7
SHA256192b0554f6cbdfd5853cc90d8a418497df800da85bc0795238fc359aae8fa309
SHA5120119341a2d041b0143a849881279274b7aef6589e8f90730907401562d03c631065bdb6f3e567b9cdffe31e572c570414f9386ef12e39ffaefdb4a8a5d70f479
Docker ImageSHA256 Checksum
humio-core-devc1efbc9ae9dd76ccbaa674e63ff0029625724c1bb82f3b759cf692f65b3861fc
humio-devc286be555ee8e333acaa87ff010a8b6ecda18cd57c57b2925513b300792c021c
kafka-deve0d67223acc40bc46d9205286655b28e5c5adfdacbd86441e57e4939113805ee
zookeeper-devc5a7a9ab2dc6be82defe163499b943b727697a3e5d06fc8ead128240e596beb9

Updated dependencies with security fixes and weakness.

Bug Fixes

  • Security

    • Updated dependencies to Netty to fix CVE-2021-43797

    • Updated dependencies to log4j 2.17.1 to fix CVE-2021-44832 and CVE-2021-45105

  • Summary

    • Updated dependencies to Jackson to fix a weakness

Humio Server 1.32.6 Stable (2021-12-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.32.6Stable2021-12-152022-12-151.16.0NoNo
JAR ChecksumValue
MD57faf420472dbc06536e7478f9b62ab9b
SHA177ab5617ec6a9ea24d5db93d82e44a6baa9b8bc2
SHA256f77c2758074e6ed3b0543531e8ad8ca8a62b934484ee2ac820eabcdd9c572b20
SHA512777a8f6e1f2371aea2f9aaeed46633c5c0837e96b1a902433adb7ad8fd98efdaf0f1b21fbae5c8ddb9b5099c4f85e70a0d5a7e9ca00a47b2f2293c9b37c129fe

Security fix related to log4j logging, and fix compatibility with Filebeat.

Bug Fixes

  • Security

    • Updated dependencies to log4j 2.16 to remove of message lookups (CVE-2021-45046)

  • Summary

    • Fixed issue where streaming (exporting) query results in JSON format could include extra "," characters within the output.

Humio Server 1.32.5 Stable (2021-12-10)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.32.5Stable2021-12-102022-12-101.16.0NoNo
JAR ChecksumValue
MD5e4475e8c2f6623ff22465ccd59bbfb8a
SHA15affbdbd10674259ec178db75171d73eb2835f1d
SHA25692c0261e328c43f0ba46ffaa72fc5e8a1ef075438759286ab00ea5dbb5b5ca30
SHA512e698dd4a2aa8c85ca3d89cc596e05677106d509082f816e46b3dca6b4b3313690d4c41c3a5b5529d08d91e51ebbfb3f9217e7830d1f4ade54fd79b40f366f449

Security fix related to log4j logging.

Bug Fixes

  • Security

    • Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

Humio Server 1.32.4 Stable (2021-12-10)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.32.4Stable2021-12-102022-12-101.16.0NoNo
JAR ChecksumValue
MD5237975851200cd2a21b749ea3994f307
SHA10e6acfcbc13150c83861af51798d8f4510de7bb4
SHA25699a86034dc2e26f0779a64a11633563f59dbc94959b85f80f996e5c267053ae4
SHA512aba67fee43c26d832cc9fb0a5ce3af0faabb596bc33c597eaba83f8f7d3e7da1ec61f6554c257ca7063991a802fdd4149f90e25db856751ca538c1d2f5262a40

Security fix related to log4j logging, and fix compatibility with Filebeat.

Bug Fixes

  • Security

    • Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

    • Fixed a compatibility issue with Filebeat 7.16.0

Humio Server 1.32.3 Stable (2021-12-01)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.32.3Stable2021-12-012022-12-011.16.0NoNo
JAR ChecksumValue
MD5a930565c1e42104fcf6b963089db33ec
SHA1b4818b51348ae64bf79104813d89fb34ec183a71
SHA256a100e4eb4161b0dc01ac745dffd5bb22839c557fd120f2ddb8359981558af5d5
SHA512fb2439171324b098a870bb143e4442bacd007c0f18c2fce9ead458e6f05d8672f3f4309e4c59c7b74a6c74763b6936707f67f36eb645847f0daaee75badd4f9a

Bug fix to resolve problem with clusters using bucket storage.

Bug Fixes

  • Summary

    • Fixed an issue that would result in a query not completing when one of the involved segments was deleted locally while the query was running. This could happen on clusters using bucket storage with more data than fits the local disks.

Humio Server 1.32.2 Stable (2021-11-19)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.32.2Stable2021-11-192022-11-191.16.0NoNo
JAR ChecksumValue
MD5098c372a532df86516d89e7d257f86b6
SHA1ea67955c0cad253a0278fe408fcce7d300491455
SHA256f2289d4bf0321e0dde905a8d4148d709e5ac846fdd055c7133172f5d33ef9fe0
SHA5121bb52a2333339201a7c56f2d0d93997e60ea5b62d5b2ec1dc9f84d812b50c3e5ebca8039de029ecdb14e00885f9e9965532acc13dd339589a45a836a5548b849

Critical bug fix regarding version dependency, and race conditions.

Bug Fixes

  • Summary

    • Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

    • Updated a dependency to a version fixing a critical bug.

Humio Server 1.32.1 Stable (2021-11-16)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.32.1Stable2021-11-162022-11-161.16.0NoNo
JAR ChecksumValue
MD57717b075d0e60780caf64c8a70afdf57
SHA102e400753b475b1ba668399bc27126a12304e4a6
SHA256c5d36f6bbcd5c8bc90e5ba2a28ca15cf5f1c3657a56c40e9f46f7bfaf48149e1
SHA51209d31840cd1442cfed31402bf52132a4c9960e3177b2c14e4b4da687333ae3995732a048c3b71ae7eb81ccfd40afee40e34085d6cc35da6b3cb826a57049f0a6

Bug fixes related to Amazon S3 log entries, saving a User Interface theme, Logtash, and general security.

Bug Fixes

  • Summary

    • Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

    • Removed a spurious warning log when requesting a non-existent hash file from S3.

    • It is now possible to ingest logs into Humio using LogStash v.7.13 and upwards.

    • Security fix.

Humio Server 1.32.0 Stable (2021-10-26)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.32.0Stable2021-10-262022-10-261.16.0NoYes
JAR ChecksumValue
MD527311d8fb5172cc95aa7cb8d02f5c58c
SHA10378ceb4d0ba9255dba6c213e1a728f7095e8ced
SHA2563dd0434039b1d8eaeb1d1242c860d51593ec222b3d09ae1d732503214edb6d06
SHA512b29267cd2e89cbbf88386a9c2e617c634ff05567388680b605804a0e3978fca4a55c483395d819ff27fbc53da6e29c09ff573c5f7ff00ab57dda45f5e20c1dd2

We now distribute Humio as a tarball in addition to the fat jar format we've previously used. We will continue to distribute the fat jar for the time being. The tarball includes a launcher script, which will set a number of JVM arguments for users automatically. We believe this will help users configure Humio for good performance out of the box. For more information, see Launcher Script.

Search performance via hashfilter-first on segments in buckets

Some searches, including regex and literal string matches, now allow searching without fetching the actual segment files from the bucket, in case the segment is only present in the bucket and not on any local disk. Humio now fetches the hash filter file and uses that to decide if the segment file may have a match before downloading the segment file in this case.

Humio packages can now carry scheduled searches, all types of actions, and files with lookup data (either CSV or JSON formatted). Additionally, we have improved the UI for managing packages, to make it easier to find the package you are looking for. This also marks the point where packages are brought out of beta.

Improvements, new features and functionality

  • UI Changes

    • The signup path was removed, together with the corresponding pages.

    • Cluster management pages style updates.

    • Removed the pop-up link to edit an alert or scheduled search when on the form page. This link is only relevant when creating an entity from the search page via a dialog.

    • Fixed some styling issue on Query Quotas page.

    • Updated design for Package Marketplace and Installed Packages to make them easier to use and more consistent.

    • Identity provider pages style update.

    • Updated the style of the email action template and made the wording used dependent on whether an alert or scheduled search was triggered.

    • The left navigation menu hides, and can be opened again, for mobile devices, on organization settings pages and repository settings pages.

    • Breadcrumbs are aligned across all pages and show the package name with a link when viewing or editing an asset from a package.

  • GraphQL API

    • The name, displayName, and location GraphQL fields on the File type are deprecated in favor of the new nameAndPath field.

    • Deprecates the copyFile GraphQL mutation, as it is no longer used. If you use this mutation, please let us know.

    • Deprecates the package field on the SearchDomain GraphQL type, in favor of packageV2. The new field has a simpler and more correct return type.

    • Deprecates the installPackageFromRegistry and updatePackageFromRegistry GraphQL mutations in favor of installPackageFromRegistryV2 and updatePackageFromRegistryV2.

    • Added a GraphQL mutation "cancelDeleteEvents" that allows cancelling a previously submitted deletion. Cancellation is best-effort, and events that have already been deleted will not be restored.

    • Deprecates the two GraphQL fields id and contentHash on the File type. The two fields are considered unused, so no alternatives are provided. If you rely on them, please let us know.

    • Added information about the use of preview fields in the result from calling the GraphQL API. The information will be in the field extensions.preview and will be a list of objects with a name and reason field.

    • The GraphQL DateTime type now supports non-UTC time. Timestamps like 2021-07-18T14:13:09.517+02.0 are now legal, and will be converted to UTC time internally.

    • The fileName, displayName, and location GraphQL fields on the UploadedFileSnapshot type are deprecated in favor of the new nameAndPath field.

    • Extended 'Relative' field type for schema files to include support for the value 'now'.

    • When using the GraphQL field allowedViewActions, the two previously deprecated actions ChangeAlertsAndNotifiers and ReadEvents are no longer returned. Look for their replacements ChangeTriggersAndActions and ReadContents instead.

  • Configuration

    • Added compatibility mode for using IBM Cloud Object Storage as bucket storage via S3_STORAGE_IBM_COMPAT

    • The Scheduled Searches feature is no longer in beta and can be used by all users without enabling it first

    • On a node configured as USING_EPHEMERAL_DISKS=true allow the local disk management deleting files even if a query may need them later, as the system is able to re-fetch the files from bucket storage when required. This improves the situation when there are active queries that in total have requested access to more segments than the local disk can hold.

  • Other

    • Added support for including dashboard and alert labels when exporting a package.

    • You can now export and import packages containing any of the action types: Webhook, Email, Humio Repo, Pager Duty, Slack, Slack multi channel, Ops Genie and Victor Ops.

    • When selecting actions for alerts or scheduled searches, the actions are now grouped by the package they were imported from.

    • Scheduled search "schedule" is explained using human readable text such as "At 9.30 on Tuesdays".

    • Package installation error messages are now much more readable.

    • Improved handling of local disk space relative to `LOCAL_STORAGE_MIN_AGE_DAYS`: When the local disk would overflow by respecting that config, Humio can now delete the oldest local segments that are present in bucket storage, even when they are within that time range.

    • Added Dark Mode for Query Monitor page.

    • Added focus states to text field, selection and text area components.

    • Improved error handling when running scheduled searches, so that a failed schedules search will be retried as long as it is within the [backfill limit](https://library.humio.com/preview/docs/automated/scheduled-search/#backfill-limit).

    • Warnings when running scheduled searches now show up as errors in the scheduled search overview page if [SCHEDULED_SEARCH_DESPITE_WARNINGS](https://library.humio.com/preview/reference/environment-variables/#var-scheduled-search-despite-warnings) is set to 'false' (the default).

    • Fixed an issue with using the browser back button while "advanced editing" the query text of a scheduled search or an alert would hide the blue bar that allows saving the query.

    • Allow launching using JDK-16.

    • Scheduled search "schedule" field is now validated, showing accurate help for each part of the crontab expression.

    • Improved performance in IP database lookups for the functions ipLocation(), asn() and worldMap().

    • Raise size limit on ingest requests from 8MB to 1 GB

    • Improved audit log for organization creation.

    • New metric: "ingest-request-delay". Histogram of ingest request time spent being delayed due to exceeding limit on concurrent processing of ingest.

    • The test action functionality no longer uses alert terminology, as actions can be invoked from both alerts and scheduled searches. Also, it is now possible to also test the scheduled search specific message templates using it.

    • Added support for importing packages with CSV and JSON files. Exporting packages with files is not fully supported yet, but will be in a future release.

    • Added loading and error states to the page where user selects to create a new repository or view.

    • Added a Data subprocessors page under account.

    • Added explicit distribution information for elastic bulk API for elasticsearch API compatibility.

    • Humio docker images is now based on the Alpine linux.

    • Improved search for users page.

    • Limit pending ingest requests by rejecting excess invocations. Rejections are signalled as status 429 "Too many requests" and a Retry-After header suggesting to retry in 5 seconds. Limiting starts when queued requests exceed INGEST_REQUEST_LIMIT_PCT of the total heap size, default is 5.

    • Added maximum width to tabs on the Group page, so they do not keep expanding forever.

Bug Fixes

  • Other

    • Updated the examples on how to use the match() query function in the inline documentation.

    • The simple and advanced permission model has been merged, thus allowing users who were using the simple permission model to create their own permission roles and groups, create groups with default roles, and all other features that were previously only available in advanced permissions mode.

    • Updated the new asset dialog button text so that it will say 'Continue' when an asset will not be created directly.

    • Global snapshots are now uploaded to bucket storage more often when there are a lot of updates to it, leading to shorter replay times on startup.

    • Fixed an issue where Humio would retain segments acquired from read-only buckets if those segments were deleted. Humio will now properly delete the segments locally, and drop the reference to the copy in the read-only bucket.

    • Fixed an issue that caused some metrics of type gauge to be reported with a wrong value.

    • Fixed an issue where the job responsible for deleting segment files off nodes was not running as often as expected.

    • Fixed an issue where the global consistency check job would fail to perform the consistency check, instead logging lines like "Global dump requested but global had expired". This line can still occur, but only when the consistency check takes too long.

    • Updated dependencies with security fixes.

    • When a search is able to filter out segments based on the hash filter files, and a segment file is not present locally on any node, fetch only the hash filter at first, evaluate that, and only if required, fetch the segment file. This speeds up searches that target segments only present in bucket storage and that have search filters that generate hash filter checks, such as regex and literal text comparisons.

    • Fixed an issue where Humio would create auxiliary files (hash files) for segments unnecessarily when moving segments between nodes.

    • Fixed an issue - when creating a repository a user is automatically assigned a role but isn't able to see himself in the roles list. Also, when editing roles the assignment is not counted correctly under usage.

    • Fixed an issue where the DiskSpaceJob could mark segments accessed slightly out of order during boot.

    • Fixed a bug where a 404 Not Found status on an internal endpoint would be incorrectly reported as an 401 Unauthorized.

    • Fixed an issue where, looking at GraphiQL, the dropdown from the navigation menu was partially hidden.

    • Fixed an issue where the {time_zone} [message template](https://docs.humio.com/docs/actions/message-template/) for actions would show a full description of the scheduled search instead of only the time zone.

    • Fixed an issue where Humio would create a broken hash file for the merge result when merging minisegments that did not originally have hash files.

    • Truncate long user names on the Users page.

    • Fixed a bug causing the disk space job to use an expensive code path even when a cheaper one was available.

    • Fixed a bug where a hidden field named "#humioAutoShard" would sometimes show up in the field list.

    • Fixed an issue where top() with max= can yield the same key multiple times (ei. ...| top([queryId, query], max=totalSize)).

    • Amended an internal limit on how many segments can be fetched from bucket storage concurrently. The old limit was based on the number of running queries. The new limit is 32.

    • Fixed an issue with the split() function which caused incorrect (usually, too few) query results in some cases where the output fields were refered to later in the query.

    • Creating a new dashboard now opens it after creation.

    • Updated Slack action for messaging multiple channels, so it propogates errors when triggered. Previously errors were ignored.

    • Updated Elastic ingest endpoint to accept 'create' operations in addition to 'index' operations. Both operation types result in the same ingest behavior. This update was added as Fluent-Bit v1.8.3 began using the 'create' operation rather than 'index' for ingest.

    • Fixed thread safety for a variable involved in fetching from bucket storage for queries.

    • When accessing Humio through a URL with either a repository or view name in it and using an ingest token, it is now checked that the view on the token matches the repository or view in the URL, and a 403 Forbidden status is returned, if not.

    • Reworded a confusing error message when using the top() function with a limit parameter exceeding the limits configured with TOP_K_MAX_MAP_SIZE_HISTORICAL or TOP_K_MAX_MAP_SIZE_LIVE.

    • Fixed an issue that caused some errors to be hidden behind a message about "internal error".

    • Fixed an issue where metrics of type gauge with a double value were not reported to the humio-metrics repository, but only to the humio repository.

    • Split package export page into dialog with multiple steps.

    • Fixed an issue where the query scheduler would spend too much time "shelving" queries, and not enough on getting them executed, leading to little progress on queries.

    • Fixed an issue where Shift+Enter would select the current completion rather than adding a newline.

    • Fixed an issue where it was possible to submit queries to the Delete Events API that were not valid for that API. Only pure filtering queries are allowed.

    • Fixed a bug which potentially have caused alerts to not re-fire after the throttle period for field-based throttling had passed.

    • Fixed an issue where the DiskSpaceJob could continue tracking segments if they were deleted from global, but the files were still present locally.

    • The DiskSpaceJob now removes newly written backfilled segments off the local disk before it chooses to remove non-backfilled segments.

    • Fixed an issue that could cause cluster nodes to crash when growing the number of digest partitions.

    • Fixed an issue where certain problems highlighted the first word in a query, not the location of the problem.

    • Fixed an issue where Humio attempted to fetch global from other nodes before TLS was initialized.

    • The DiskSpaceJob no longer initializes based off of the segment last-modified timestamp, this only happens if no access order snapshot is stored locally. If a snapshot is present, we trust that.

    • Fixed an issue that could cause UploadedFileSyncJob to crash if an uploaded file went missing.

    • Introduced a check for compatibility for packages and humio versions.

    • Security when viewing installed packages and packages on the marketplace are now less strict. Permissions are still required for installing and uninstalling packages.

    • Fixed a bug on queries that triggered an error while executing due to the input (such as a regex that exceeds limits on execution time) could result in the client getting 404 as status on poll, where it should get .0.

    • Fixed an issue where new groups added to a repository got a query prefix that disallowed search. The default is now to allow search with the queryprefix *.

    • Fixed an issue where the job responsible for deleting segment files off nodes was not deleting as many segments as it should.

    • Cloning an asset now redirects you to the edit page for the asset for all assets.

    • Removed an old Cloud Signups page. The page is not necessary since organizations were implemented for the Cloud environments.

Humio Server 1.31.0 Preview (2021-09-27)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.31.0Preview2021-09-272021-10-261.16.0NoYes
JAR ChecksumValue
MD54b4b4411d930d00275bc3a412c0c5c50
SHA1ca22652ca303a162f81711f43977e14e528f6e85
SHA256908a907b5c1ffbdce667b932daea0aab46a8ece4e164072f5bae0eb77d3bdd6f
SHA512bbc65ea8641ac3d9910da4a9dcda0c1817d2a8acc2e81491a389d2671af7e57c12f019ad71af7309d4ad68b67997a6cbd3b0fba3a2048f07b7c7567abd05b8ae

We now distribute Humio as a tarball in addition to the fat jar format we've previously used. We will continue to distribute the fat jar for the time being. The tarball includes a launcher script, which will set a number of JVM arguments for users automatically. We believe this will help users configure Humio for good performance out of the box. For more information, see Launcher Script.

Search performance via hashfilter-first on segments in buckets

Some searches, including regex and literal string matches, now allow searching without fetching the actual segment files from the bucket, in case the segment is only present in the bucket and not on any local disk. Humio now fetches the hash filter file and uses that to decide if the segment file may have a match before downloading the segment file in this case.

Humio packages can now carry scheduled searches, all types of actions, and files with lookup data (either CSV or JSON formatted). Additionally, we have improved the UI for managing packages, to make it easier to find the package you are looking for. This also marks the point where packages are brought out of beta.

Improvements, new features and functionality

  • UI Changes

    • Removed the pop-up link to edit an alert or scheduled search when on the form page. This link is only relevant when creating an entity from the search page via a dialog.

    • The left navigation menu hides, and can be opened again, for mobile devices, on organization settings pages and repository settings pages.

    • Cluster management pages style updates.

    • Updated design for Package Marketplace and Installed Packages to make them easier to use and more consistent.

    • The signup path was removed, together with the corresponding pages.

    • Breadcrumbs are aligned across all pages and show the package name with a link when viewing or editing an asset from a package.

    • Identity provider pages style update.

    • Updated the style of the email action template and made the wording used dependent on whether an alert or scheduled search was triggered.

    • Fixed some styling issue on Query Quotas page.

  • GraphQL API

    • Deprecates the two GraphQL fields id and contentHash on the File type. The two fields are considered unused, so no alternatives are provided. If you rely on them, please let us know.

    • Deprecates the package field on the SearchDomain GraphQL type, in favor of packageV2. The new field has a simpler and more correct return type.

    • Added a GraphQL mutation "cancelDeleteEvents" that allows cancelling a previously submitted deletion. Cancellation is best-effort, and events that have already been deleted will not be restored.

    • When using the GraphQL field allowedViewActions, the two previously deprecated actions ChangeAlertsAndNotifiers and ReadEvents are no longer returned. Look for their replacements ChangeTriggersAndActions and ReadContents instead.

    • Deprecates the installPackageFromRegistry and updatePackageFromRegistry GraphQL mutations in favor of installPackageFromRegistryV2 and updatePackageFromRegistryV2.

    • The name, displayName, and location GraphQL fields on the File type are deprecated in favor of the new nameAndPath field.

    • Deprecates the copyFile GraphQL mutation, as it is no longer used. If you use this mutation, please let us know.

    • The GraphQL DateTime type now supports non-UTC time. Timestamps like 2021-07-18T14:13:09.517+02.0 are now legal, and will be converted to UTC time internally.

    • Extended 'Relative' field type for schema files to include support for the value 'now'.

    • Added information about the use of preview fields in the result from calling the GraphQL API. The information will be in the field extensions.preview and will be a list of objects with a name and reason field.

    • The fileName, displayName, and location GraphQL fields on the UploadedFileSnapshot type are deprecated in favor of the new nameAndPath field.

  • Configuration

    • On a node configured as USING_EPHEMERAL_DISKS=true allow the local disk management deleting files even if a query may need them later, as the system is able to re-fetch the files from bucket storage when required. This improves the situation when there are active queries that in total have requested access to more segments than the local disk can hold.

    • The Scheduled Searches feature is no longer in beta and can be used by all users without enabling it first

    • Added compatibility mode for using IBM Cloud Object Storage as bucket storage via S3_STORAGE_IBM_COMPAT

  • Other

    • Improved search for users page.

    • Improved handling of local disk space relative to `LOCAL_STORAGE_MIN_AGE_DAYS`: When the local disk would overflow by respecting that config, Humio can now delete the oldest local segments that are present in bucket storage, even when they are within that time range.

    • Warnings when running scheduled searches now show up as errors in the scheduled search overview page if [SCHEDULED_SEARCH_DESPITE_WARNINGS](https://library.humio.com/preview/reference/environment-variables/#var-scheduled-search-despite-warnings) is set to 'false' (the default).

    • Improved audit log for organization creation.

    • When selecting actions for alerts or scheduled searches, the actions are now grouped by the package they were imported from.

    • Fixed an issue with using the browser back button while "advanced editing" the query text of a scheduled search or an alert would hide the blue bar that allows saving the query.

    • Added explicit distribution information for elastic bulk API for elasticsearch API compatibility.

    • You can now export and import packages containing any of the action types: Webhook, Email, Humio Repo, Pager Duty, Slack, Slack multi channel, Ops Genie and Victor Ops.

    • Added Dark Mode for Query Monitor page.

    • Added loading and error states to the page where user selects to create a new repository or view.

    • Improved error handling when running scheduled searches, so that a failed schedules search will be retried as long as it is within the [backfill limit](https://library.humio.com/preview/docs/automated/scheduled-search/#backfill-limit).

    • Allow launching using JDK-16.

    • Humio docker images is now based on the Alpine linux.

    • Improved performance in IP database lookups for the functions ipLocation(), asn() and worldMap().

    • Scheduled search "schedule" field is now validated, showing accurate help for each part of the crontab expression.

    • The test action functionality no longer uses alert terminology, as actions can be invoked from both alerts and scheduled searches. Also, it is now possible to also test the scheduled search specific message templates using it.

    • Package installation error messages are now much more readable.

    • Scheduled search "schedule" is explained using human readable text such as "At 9.30 on Tuesdays".

    • Added focus states to text field, selection and text area components.

    • Added a Data subprocessors page under account.

    • Added maximum width to tabs on the Group page, so they do not keep expanding forever.

    • Added support for importing packages with CSV and JSON files. Exporting packages with files is not fully supported yet, but will be in a future release.

    • Added support for including dashboard and alert labels when exporting a package.

Bug Fixes

  • Other

    • Fixed an issue where metrics of type gauge with a double value were not reported to the humio-metrics repository, but only to the humio repository.

    • Fixed an issue where the global consistency check job would fail to perform the consistency check, instead logging lines like "Global dump requested but global had expired". This line can still occur, but only when the consistency check takes too long.

    • Fixed a bug causing the disk space job to use an expensive code path even when a cheaper one was available.

    • Updated Slack action for messaging multiple channels, so it propogates errors when triggered. Previously errors were ignored.

    • Fixed an issue that could cause cluster nodes to crash when growing the number of digest partitions.

    • Reworded a confusing error message when using the top() function with a limit parameter exceeding the limits configured with TOP_K_MAX_MAP_SIZE_HISTORICAL or TOP_K_MAX_MAP_SIZE_LIVE.

    • Removed an old Cloud Signups page. The page is not necessary since organizations were implemented for the Cloud environments.

    • Fixed an issue where Humio would create auxiliary files (hash files) for segments unnecessarily when moving segments between nodes.

    • Security when viewing installed packages and packages on the marketplace are now less strict. Permissions are still required for installing and uninstalling packages.

    • Truncate long user names on the Users page.

    • Fixed an issue that caused some errors to be hidden behind a message about "internal error".

    • Split package export page into dialog with multiple steps.

    • Fixed an issue where the query scheduler would spend too much time "shelving" queries, and not enough on getting them executed, leading to little progress on queries.

    • Updated dependencies with security fixes.

    • Fixed a bug where a hidden field named "#humioAutoShard" would sometimes show up in the field list.

    • Fixed an issue where it was possible to submit queries to the Delete Events API that were not valid for that API. Only pure filtering queries are allowed.

    • The simple and advanced permission model has been merged, thus allowing users who were using the simple permission model to create their own permission roles and groups, create groups with default roles, and all other features that were previously only available in advanced permissions mode.

    • Fixed thread safety for a variable involved in fetching from bucket storage for queries.

    • Fixed an issue where certain problems highlighted the first word in a query, not the location of the problem.

    • Updated Elastic ingest endpoint to accept 'create' operations in addition to 'index' operations. Both operation types result in the same ingest behavior. This update was added as Fluent-Bit v1.8.3 began using the 'create' operation rather than 'index' for ingest.

    • Fixed an issue where Humio attempted to fetch global from other nodes before TLS was initialized.

    • Global snapshots are now uploaded to bucket storage more often when there are a lot of updates to it, leading to shorter replay times on startup.

    • Cloning an asset now redirects you to the edit page for the asset for all assets.

    • Fixed an issue where Humio would create a broken hash file for the merge result when merging minisegments that did not originally have hash files.

    • Fixed an issue where the {time_zone} message template for actions would show a full description of the scheduled search instead of only the time zone.

    • Fixed an issue where Shift+Enter would select the current completion rather than adding a newline.

    • Creating a new dashboard now opens it after creation.

    • Fixed a bug on queries that triggered an error while executing due to the input (such as a regex that exceeds limits on execution time) could result in the client getting 404 as status on poll, where it should get .0.

    • Fixed an issue with the split() function which caused incorrect (usually, too few) query results in some cases where the output fields were refered to later in the query.

    • When accessing Humio through a URL with either a repository or view name in it and using an ingest token, it is now checked that the view on the token matches the repository or view in the URL, and a 403 Forbidden status is returned, if not.

    • Fixed an issue where, looking at GraphiQL, the dropdown from the navigation menu was partially hidden.

    • Fixed an issue where the job responsible for deleting segment files off nodes was not deleting as many segments as it should.

    • Fixed an issue where new groups added to a repository got a query prefix that disallowed search. The default is now to allow search with the queryprefix *.

    • Fixed an issue where the job responsible for deleting segment files off nodes was not running as often as expected.

    • Fixed an issue where the DiskSpaceJob could continue tracking segments if they were deleted from global, but the files were still present locally.

    • Fixed a bug where a 404 Not Found status on an internal endpoint would be incorrectly reported as an 401 Unauthorized.

    • Introduced a check for compatibility for packages and humio versions.

    • Fixed a bug which potentially have caused alerts to not re-fire after the throttle period for field-based throttling had passed.

    • Fixed an issue that caused some metrics of type gauge to be reported with a wrong value.

    • Updated the new asset dialog button text so that it will say 'Continue' when an asset will not be created directly.

    • Amended an internal limit on how many segments can be fetched from bucket storage concurrently. The old limit was based on the number of running queries. The new limit is 32.

    • When a search is able to filter out segments based on the hash filter files, and a segment file is not present locally on any node, fetch only the hash filter at first, evaluate that, and only if required, fetch the segment file. This speeds up searches that target segments only present in bucket storage and that have search filters that generate hash filter checks, such as regex and literal text comparisons.

    • Fixed an issue that could cause UploadedFileSyncJob to crash if an uploaded file went missing.

    • Fixed an issue where top() with max= can yield the same key multiple times (ei. ...| top([queryId, query], max=totalSize)).

    • The DiskSpaceJob now removes newly written backfilled segments off the local disk before it chooses to remove non-backfilled segments.

    • Fixed an issue where the DiskSpaceJob could mark segments accessed slightly out of order during boot.

    • Updated the examples on how to use the match query function in the inline documentation.

    • The DiskSpaceJob no longer initializes based off of the segment last-modified timestamp, this only happens if no access order snapshot is stored locally. If a snapshot is present, we trust that.

Humio Server 1.30.7 Stable (2022-01-06)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.30.7Stable2022-01-062023-01-061.16.0NoNo
JAR ChecksumValue
MD59612de72bdd0275e39d6af23c51067c8
SHA14ecdf75a4deae2b2c75abcf1101d9b4711cacf31
SHA2563ae7ba0f40043f10c7fad02ea471bb55373cf38afd31ddfa2f47bdc87528f475
SHA5125d3cadcb47c1c792c2e643fbaffef5207a2d327a41142a337196863a1be39a5b39de1a527853bc08a285497b6f6791b592c9e0bf69f8aef3a2e16d9db6cee7de

Updated dependencies with security fixes.

Bug Fixes

  • Security

    • Updated dependencies to Netty to fix CVE-2021-43797

    • Updated dependencies to log4j 2.17.1 to fix CVE-2021-44832 and CVE-2021-45105

Humio Server 1.30.6 Stable (2021-12-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.30.6Stable2021-12-152022-12-151.16.0NoNo
JAR ChecksumValue
MD500b0fbed6da70bb28c130be8bab2f573
SHA1033f9cb06618af70ebf605534af3d97692b1279e
SHA256f389991e007489d9f5a0d6ca8b4cd3905b072ff40efcff3284bef47cf65d4e86
SHA51212fec5a5954f8ec49cbc30f1b206302bdb8d21fc34330cc5120d5af68a08e80c4fa53faad2d9c707535ced94e6134beaaca141212da7daa1d748b29b9df286ee

Fix log4j dependencies.

Bug Fixes

  • Security

    • Updated dependencies to log4j 2.16 to remove of message lookups (CVE-2021-45046)

Humio Server 1.30.5 Stable (2021-12-10)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.30.5Stable2021-12-102022-12-101.16.0NoNo
JAR ChecksumValue
MD5e4475e8c2f6623ff22465ccd59bbfb8a
SHA15affbdbd10674259ec178db75171d73eb2835f1d
SHA25692c0261e328c43f0ba46ffaa72fc5e8a1ef075438759286ab00ea5dbb5b5ca30
SHA512e698dd4a2aa8c85ca3d89cc596e05677106d509082f816e46b3dca6b4b3313690d4c41c3a5b5529d08d91e51ebbfb3f9217e7830d1f4ade54fd79b40f366f449

Fix log4j dependencies.

Bug Fixes

  • Security

    • Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

Humio Server 1.30.4 Stable (2021-12-10)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.30.4Stable2021-12-102022-12-101.16.0NoNo
JAR ChecksumValue
MD5815e193fd910b712d9be4420473101ec
SHA1f909e62433a8ee4ff3ac2a4b78ab966c311eae54
SHA256bb2fcd20a21e9d8a7a8e2866ff579259f3f4b9975f31731bb4d57d879072d9ca
SHA51296f31a00f96e44bf64128b9c58b9007cef78ccd12a2abc7264b884415c62f44df7837f4540780aa5a75c04c64488a33a6977d256333e950a181b861d6966b686

Security fix related to log4j logging, and fix compatibility with Filebeat.

Bug Fixes

  • Security

    • Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

  • Summary

    • Fixed a compatibility issue with Filebeat 7.16.0

Humio Server 1.30.3 Stable (2021-11-25)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.30.3Stable2021-11-252022-11-251.16.0NoNo
JAR ChecksumValue
MD51d3b908f6da95f2a02a69f220715b9ac
SHA1110fb83be1979070a55a6d9fc6662abcf8ef551a
SHA256c87ae3a41303afa5d11750d2ae8fa36bb9892723cefb1ffcb19bf1d93e87dde0
SHA5121c634b3401485aab33ca5ee6042d88596785f054c37933d37e5830a9b7817ec9dc995dda14bd1620f511f0cf685327b9c78f0e2d118f0b24ef04462c4d132136

Bug fix to resolve problem with race conditions.

Bug Fixes

  • Summary

    • Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

Humio Server 1.30.2 Stable (2021-11-19)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.30.2Stable2021-11-192022-11-191.16.0NoNo
JAR ChecksumValue
MD52395ce5b8017a632b02372da3dc0159b
SHA1049f9a0ed9c4e9acafcefe1a65997b65ba57d3f7
SHA256815bcce962ac9f43022424e2abdfa587f8377ba1ecf3b4c5ef423a43175fe424
SHA512bc93c9bbf9fe89eb0a279d265b775bc4b4590b897f7f08a31d2516cd767b4952c59e7a3bad9986b26592487246c8a54f2e29e85d9a2a248dc790418ec68627d7

Bug fixes related to version dependency, problems with incomplete URLS, as well as requiring organization level permissions in certain situations.

Bug Fixes

  • Summary

    • Updated a dependency to a version fixing a critical bug.

    • Require organization level permission when changing role permissions that possibly affects all views and repositories.

    • Fixed an issue where a URL without content other than the protocol would break installing a package.

Humio Server 1.30.1 Stable (2021-10-01)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.30.1Stable2021-10-012022-10-011.16.0NoYes
JAR ChecksumValue
MD5790fc08715648deadf23b204f6e77cc9
SHA185ea236e0abbaf29740e7288d7cefeb2b1069260
SHA256e4f8dcc73fbeaa5dcc7d68aa6a972e3ab5ccbb66848c189743b2f50b8bcea832
SHA512963ec5f550f5b496b08c9025e3fa9ed08c563e4270973092a4a1944a05bd79192316f3324d9a58e78dd014c2119ab389c1d6c566ef395b73c4df96f6d216e2c2

Fixes Humio ignoring MatchExceptions, the frequency of jobs which delete segment files, problems with USING_EPHEMERAL_DISKS, and upgrades Kafka and xmlsec addresses.

Bug Fixes

  • Security

    • Upgrade Kafka and xmlsec to address CVE-2021-38153 and CVE-2021-38153.

  • Summary

    • On a node configured as USING_EPHEMERAL_DISKS=true allow the local disk management deleting files even if a query may need them later, as the system is able to re-fetch the files from bucket storage when required. This improves the situation when there are active queries that in total have requested access to more segments than the local disk can hold.

    • Fixed an issue where the job responsible for deleting segment files off nodes was not running as often as expected.

    • Fixed an issue where the job responsible for deleting segment files off nodes was not deleting as many segments as it should.

    • Fixed an issue causing Humio to log MatchExceptions from the calculateStartPoint method.

Humio Server 1.30.0 Stable (2021-09-17)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.30.0Stable2021-09-172022-09-171.16.0NoYes
JAR ChecksumValue
MD5c8989abb219663a61ae54be021fcd367
SHA144e1d48d09ca3ae8fd59a185e77b3c9a55a6de8f
SHA25625a880f34a0fef72ab3cb4bf93f92eae2fdac0022d116485bed1013b3f6683b4
SHA51253b8055035bfcdd7176fa4369e607874ca9d5ee84de4a3beb964e3f0caba9578b3c46c04c10cb68657be34d8a165fa1089f1679716ecd4896ff57822d0b1e851

As a new feature Humio now includes an IOC (indicator of compromise) database from CrowdStrike to enable lookup of IP addresses, URLs and domains for malicious activity. This database is updated hourly. This is described in more detail at ioc:lookup()

Bug Fixes

  • Other

    • Fixed an issue where the UI page for new parser could have overflow in some browsers.

    • Fixed an issue where offsets from one Kafka partition could be used when deciding where to start consuming for another partition, in the case where there are too many datasources in the repo. This led to a crash loop when the affected node was restarted.

    • Fixed an issue where the query scheduler would spend too much time "shelving" queries, and not enough on getting them executed, leading to little progress on queries.

Humio Server 1.30.0 Includes the following changes made in Humio Server 1.29.0

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.0Preview2021-07-092021-09-171.16.0NoYes

Warning

This release has been revoked as it contained a known bug fixed in 1.29.1.

As a new feature Humio now includes an IOC (indicator of compromise) database from CrowdStrike to enable lookup of IP addresses, URLs and domains for malicious activity. This database is updated hourly. This is described in more detail at ioc:lookup()

Improvements, new features and functionality

Bug Fixes

Humio Server 1.30.0 Includes the following changes made in Humio Server 1.29.1

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.1Preview2021-07-122021-09-171.16.0NoYes
JAR ChecksumValue
MD56cea304226bb9eb096785375bb8f834f
SHA177d7b92df1884b8ec457246d602cc276e46ee032
SHA256e48d6a5c80e6979621b817c1ac53f778eae170185180ab9e70c295692dd1a7bc
SHA512c9e8019067a9ae1bd0b62215ee458ecabcee2b3a971688c6f66c58dc1009d498cdd560d4733f64f31e6d4204bebb6c8bc0934354ab04aaa008b3e21ef8bc7dee

Bug fixes.

Bug Fixes

Humio Server 1.30.0 Includes the following changes made in Humio Server 1.29.2

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.2Preview2021-09-022021-09-171.16.0NoNo
JAR ChecksumValue
MD50b32f9520b7a5ec3f1af3321ce7f1dfe
SHA14ae2567f9b3348d115819eefd5b9c078d6c2c6ad
SHA2560383277fd91b8933dfcdb94783e03d151975b01ee62dcc74515cbfb2d3299cdc
SHA512bbfb1f343f0567394128976ecddc6ad3b74f2996b0dc51e2fe0f9c5e0b60cbd7a935fc709b2ffc3b6a811a0e6a1c2fcc09e4e1552e5c7f87dd3670f07cf33b31

Minor bug fixes

Bug Fixes

Humio Server 1.30.0 Includes the following changes made in Humio Server 1.29.3

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.3Preview2021-09-072021-09-171.16.0NoNo
JAR ChecksumValue
MD596b4a0ff0c02a2dce2bb5ee467bdb9dd
SHA1b2a1ef55259f6c49ee7bf7de6efecc0f743d1bfa
SHA25695d9b52d6213d0af43dfc43cb66c878f1f584f446e4ba890137c5fd9923db1a4
SHA512392489e94b1e6f6799a6340df78e7bdb7d9547b97ba1844cfbf3c525e1e418fd2221543378f2b759acf46d5c02d99627f9b98650447d7c1c32ba599157718bf8

Minor bug fixes

Bug Fixes

Humio Server 1.30.0 Includes the following changes made in Humio Server 1.29.4

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.4Preview2021-09-092021-09-171.16.0NoNo
JAR ChecksumValue
MD58145f9ddc7804a44efe1e46cd71f5c17
SHA18db4079f580357162891d0153a70668b4f29d642
SHA25632adde840164668a96be651ede6052dbef3cf046ec9f83f39f62925d26e14104
SHA512cadcd2eb07e949f052bd51ecc272d79f7decfec0f3b7613dfdf712aa1ff287471060d25443c5be1b06744aefa43194fb2e78e223c362005cea62a5917a93b62e

Minor bug fixes

Bug Fixes

Humio Server 1.29.4 Preview (2021-09-09)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.4Preview2021-09-092021-09-171.16.0NoNo
JAR ChecksumValue
MD58145f9ddc7804a44efe1e46cd71f5c17
SHA18db4079f580357162891d0153a70668b4f29d642
SHA25632adde840164668a96be651ede6052dbef3cf046ec9f83f39f62925d26e14104
SHA512cadcd2eb07e949f052bd51ecc272d79f7decfec0f3b7613dfdf712aa1ff287471060d25443c5be1b06744aefa43194fb2e78e223c362005cea62a5917a93b62e

Minor bug fixes

Bug Fixes

  • Other

    • Added a GraphQL mutation cancelDeleteEvents that allows cancelling a previously submitted deletion. Cancellation is best-effort, and events that have already been deleted will not be restored.

    • Fixed an issue where it was possible to submit queries to the Delete Events API that were not valid for that API. Only purely filtering queries are allowed.

Humio Server 1.29.3 Preview (2021-09-07)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.3Preview2021-09-072021-09-171.16.0NoNo
JAR ChecksumValue
MD596b4a0ff0c02a2dce2bb5ee467bdb9dd
SHA1b2a1ef55259f6c49ee7bf7de6efecc0f743d1bfa
SHA25695d9b52d6213d0af43dfc43cb66c878f1f584f446e4ba890137c5fd9923db1a4
SHA512392489e94b1e6f6799a6340df78e7bdb7d9547b97ba1844cfbf3c525e1e418fd2221543378f2b759acf46d5c02d99627f9b98650447d7c1c32ba599157718bf8

Minor bug fixes

Bug Fixes

  • Other

    • Fixed an issue where the error TooManyTagValueCombination would prevent Humio from starting

    • Remove limit on search interval on cloud sandboxes

Humio Server 1.29.2 Preview (2021-09-02)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.2Preview2021-09-022021-09-171.16.0NoNo
JAR ChecksumValue
MD50b32f9520b7a5ec3f1af3321ce7f1dfe
SHA14ae2567f9b3348d115819eefd5b9c078d6c2c6ad
SHA2560383277fd91b8933dfcdb94783e03d151975b01ee62dcc74515cbfb2d3299cdc
SHA512bbfb1f343f0567394128976ecddc6ad3b74f2996b0dc51e2fe0f9c5e0b60cbd7a935fc709b2ffc3b6a811a0e6a1c2fcc09e4e1552e5c7f87dd3670f07cf33b31

Minor bug fixes

Bug Fixes

  • Other

    • Fixed an issue that could cause UploadedFileSyncJob to crash, if an uploaded file went missing

    • Fixed an issue where, looking at GraphQL, the dropdown from the navigation menu was partially hidden.

    • Fixed an issue where new groups added to a repository got a query prefix that disallowed search. The default is now to allow search with the query prefix * (wildcard).

    • Fixed an issue where if a package failed to be installed, and it contained an action, the failed installation might not be cleaned up properly.

Humio Server 1.29.1 Preview (2021-07-12)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.1Preview2021-07-122021-09-171.16.0NoYes
JAR ChecksumValue
MD56cea304226bb9eb096785375bb8f834f
SHA177d7b92df1884b8ec457246d602cc276e46ee032
SHA256e48d6a5c80e6979621b817c1ac53f778eae170185180ab9e70c295692dd1a7bc
SHA512c9e8019067a9ae1bd0b62215ee458ecabcee2b3a971688c6f66c58dc1009d498cdd560d4733f64f31e6d4204bebb6c8bc0934354ab04aaa008b3e21ef8bc7dee

Bug fixes.

Bug Fixes

  • Other

    • Fixed an issue in the 1.29.0 release that made it appear as though ingest tokens had no associated parser.

Humio Server 1.29.0 Preview (2021-07-09)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.29.0Preview2021-07-092021-09-171.16.0NoYes

Warning

This release has been revoked as it contained a known bug fixed in 1.29.1.

As a new feature Humio now includes an IOC (indicator of compromise) database from CrowdStrike to enable lookup of IP addresses, URLs and domains for malicious activity. This database is updated hourly. This is described in more detail at ioc:lookup()

Improvements, new features and functionality

  • GraphQL API

    • Removed the Usage feature flag which is now always enabled. This breaks backwards compatibility for internal graphql feature flag mutations and queries.

    • Field addIngestToken was deprecated in Mutation type, use addIngestTokenV2 instead

    • Field updateIngestListener was deprecated in Mutation type, use updateIngestListenerV2 instead

    • Removed the argument includeUsageView from the graphql mutation createOrganizationsViews which breaks backwards compatibility for this internal utility method.

    • Field assignIngestToken was deprecated in Mutation type, use assignParserToIngestToken instead

    • Deprecated argument repositoryName was removed from Mutation.updateParser field

    • Field createIngestListener was deprecated in Mutation type, use createIngestListenerV2 instead

    • Field copyParser was deprecated in Mutation type, use cloneParser instead

    • Deprecated argument name was removed from Mutation.updateParser field

  • Configuration

    • Allow the internal profiler to be configured via an environment variable. See Environment Variables

    • Humio nodes will now pick a UUID for themselves using the ZOOKEEPER_PREFIX_FOR_NODE_UUID prefix, even if Zookeeper is not used. This should make it easier to enable Zookeeper id management in existing clusters going forward.

    • Add a soft limit on the primary disk based on PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE (roughly the average of the two values). When the soft limit is hit and secondary storage is configured, the segment mover will prefer moving segments to secondary storage right away, instead of fetching them to primary and waiting for the secondary storage transfer job to move them.

  • Other

    • Return the responder's vhost in the metadata json.

    • Improved global snapshot selection in cases where a Kafka reset has been performed

    • Integrates the editing of alert searches and scheduled searches better with the search page

    • Enabled dark mode for cluster administration pages.

    • Make GlobalConsistencyCheckerJob shut down more cleanly, it could previously log some ugly exceptions during shutdown.

    • Packages now support Webhook actions and references between these and alerts in the Alert schema.

    • Added dark mode support to Identity provider pages.

    • Speed up the SecondaryStorageTransferJob. The job will now delete primary copies much earlier after moving them to the secondary volume.

    • The "Save Search as Dashboard" Widget dialog now gives user feedback about missing input in a manner consistent with other forms.

    • Previously, the server could report that a user was allowed to update parsers for a view, even though parsers cannot be used on views, only repositories. Now the server will always say the user cannot change parsers on views.

    • Created a new Dropdown component, and replaced some uses of the old component with the new.

    • Organization pages refactoring.

    • When editing a query, Enter no longer accepts a suggestion. Use Tab instead. The Enter key conflicted with the "Run" button for running the query.

    • In thread dumps include the job and query names in separate fields rather than as part of the thread name.

    • Scheduled searches are now allowed to run once every minute instead of only once every hour.

    • Internal change to parsers adding an id, where previously they only had a name as key.

Bug Fixes

  • Other

    • Fixed an issue with "show in context" feature of the event list did not quote the field names in the produced query string.

    • Fixed race condition that could cause parsers to not update correctly in rare cases

    • Fixed a bug where word wrapping in the event list was not always working for log messages with syntax highlighting (e.g. JSON or XML messages)

    • Fixed a bug in the blocklist which caused "exact pattern" query patterns to be interpreted as glob patterns.

    • Fixed bugs in the test parser UI, so that it should now always produce a result and be able to handle parsers that either drop events or produce multiple events per input event.

    • Fixed an issue where the axis titles on the timechart were not showing up in dark mode

    • Avoiding a costly corner case in some uses of glob-patterns.

    • When testing a Parser and more events are returned in a test an info message is now displayed conveying that only the first event is shown.

    • Address edge cases where QueryScheduler could throw exceptions with messages similar to "Requirement failed on activeMapperCount=-36"

    • Fixed a bug causing match() to let an empty key field match a table with no rows.

    • Fixed an issue where exporting a saved query did not include the options for the visualization, e.g. column layout on the event list.

    • Fixed a bug in the Search View. After editing and saving a saved query in the Search View, the notification message would disappear in an instant, making it impossible to read and to click the link therein.

    • Fixed an issue related to validation of integer arguments. Large integer arguments would be silently truncated and lower limits weren't checked, which led to unspecified behavior. Range errors are now reported in the following functions:

    • Fixed race condition that could cause event forwarding rules to not update correctly in rare cases

Humio Server 1.28.2 Stable (2021-09-29)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.28.2Stable2021-09-292022-09-291.16.0NoNo
JAR ChecksumValue
MD587f31a6c318d9383a944521ee34b572a
SHA1fc185c9a2f5f7e6d5425778995f679c49d430105
SHA25662f25f3fe69239e1615fb6cb2bffe6f16ae0fe8adc2a17a0a9fa03ba226f7b5f
SHA5126fb65258a9c21a4d681690a0dcc050cd5be96440cc2f1c6273707658504fc0f21fa5fd1ba9cdb664ab0a5f9aabede181dca5e1ff882305db30a0b95c57f6fba9

Bug Fixes

  • Security

    • Upgrade Kafka and xmlsec to address CVE-2021-38153 and CVE-2021-38153.

  • Other

    • Fix a bug where offsets from one Kafka partition could be used when deciding where to start consuming for another partition, in the case where there are too many datasources in the repo. This led to a crash loop when the affected node was restarted.

Humio Server 1.28.1 Stable (2021-08-24)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.28.1Stable2021-08-242022-08-241.16.0NoNo
JAR ChecksumValue
MD51a2b8d3acc15ac6789534f7624265ecb
SHA13cf96a324147967c1bc7753a7f9d94cbed8cd843
SHA2568a355f8bbab9a74422ee3456f9bfe93302734a69197b7e12c254f7c0fd9905de
SHA512e572352be7e71403f52fe0767567232a198861a60f100b7e9e32475e8e2720285902daf6493b62b79052ca71aa6550abe173d5ae5246e14e5ac30bda0883667c

Bug Fixes

  • Other

    • The signup path was removed, together with the corresponding pages. Before, anyone could sign up for the Humio SaaS solution. However, with stricter policies, this became obsolete and had to be removed. The new process redirecta a potential customer to Humio's official website, where they have to fill in a form in order to be vetted. Once the vetting process is complete, Humio support creates an organization for the customer.

    • Fixed an issue that could cause cluster nodes to crash when growing the number of digest partitions.

    • Fixed an issue that could cause UploadedFileSyncJob to crash if an uploaded file went missing

Humio Server 1.28.0 Stable (2021-06-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.28.0Stable2021-06-152022-06-151.16.0NoYes
JAR ChecksumValue
MD51a2b8d3acc15ac6789534f7624265ecb
SHA13cf96a324147967c1bc7753a7f9d94cbed8cd843
SHA2568a355f8bbab9a74422ee3456f9bfe93302734a69197b7e12c254f7c0fd9905de
SHA512e572352be7e71403f52fe0767567232a198861a60f100b7e9e32475e8e2720285902daf6493b62b79052ca71aa6550abe173d5ae5246e14e5ac30bda0883667c

Major changes, as well as requiring at least a trial license, require accepting privacy, terms, and conditions.

Bug Fixes

  • Summary

    • When searching through files in a dashboard parameter, users with CSV files greater than 50.0 records could see incomplete results.

    • Backfilled data gets lower priority on local disk when in over-commit mode using bucket storage.

    • Humio trial installations now require a trial license. To request a trial license go to Getting Started.

    • All users (including existing users) need to accept the privacy notice and terms and conditions before using Humio.

    • Humio will now try to upload more segments concurrently during a shutdown than during normal operation.

    • While waiting for the upload of files to bucket to complete during shutdown, the threaddumping will continue running, and the node will report as alive as seen from the other nodes.

    • Fixed a bug that caused previous 1.27.x but not earlier versions to add "host xyz is slow" warnings to query results also when that was not the case.

Humio Server 1.28.0 Includes the following changes made in Humio Server 1.27.0

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.27.0Preview2021-06-142021-06-151.16.0NoYes
JAR ChecksumValue
MD5cce0478c744d183db8491e338949bdfe
SHA16dd0bf5c8e0d4ca1f74116e31f28f8cfa7b58323
SHA256a3425e6141358cbc1115ab3c2691768c64d62f84cea3e018eb7b6debcb05f803
SHA512ca63e89946e4a12422124adb052b59f8da30ca026b5c34b0bfe1ddcc35cf7546fedd4127d46def6c36b3e0f7278675cf4fe47362fe5070a6d7b29ffbcbd0bc49

Bug fixes and updates.

Improvements, new features and functionality

Bug Fixes

Humio Server 1.28.0 Includes the following changes made in Humio Server 1.27.1

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.27.1Preview2021-06-152021-06-151.16.0NoYes
JAR ChecksumValue
MD5d45c8b1dd900bfaaae7ab6d7173f122a
SHA19602b62cab67ca3f1d35fd888303bc642c024518
SHA256ec2db12be413b83e52fb2f1cefa04bc9634e7c17657349c4e6b9c71c26a804f9
SHA5126179ff0307e3cd804cb4dfcf56a98d30b67cebf51eb2673accde437a308a2d16fd433db983e2948a06768dfac8fa71aa302a357524ed78b675ccbb8491844f6e

Security fixes and some minor fixes.

Bug Fixes

Humio Server 1.27.1 Preview (2021-06-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.27.1Preview2021-06-152021-06-151.16.0NoYes
JAR ChecksumValue
MD5d45c8b1dd900bfaaae7ab6d7173f122a
SHA19602b62cab67ca3f1d35fd888303bc642c024518
SHA256ec2db12be413b83e52fb2f1cefa04bc9634e7c17657349c4e6b9c71c26a804f9
SHA5126179ff0307e3cd804cb4dfcf56a98d30b67cebf51eb2673accde437a308a2d16fd433db983e2948a06768dfac8fa71aa302a357524ed78b675ccbb8491844f6e

Security fixes and some minor fixes.

Bug Fixes

  • Summary

    • Updated dependencies with security fixes.

    • Fixed an issue where Humio could prematurely clean up local copies of segments involved in queries, causing queries to fail with a "Did not query segment" warning.

    • Fixed issue where certain queries would cause NullPointerException in OneForOneStrategy.

Humio Server 1.27.0 Preview (2021-06-14)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.27.0Preview2021-06-142021-06-151.16.0NoYes
JAR ChecksumValue
MD5cce0478c744d183db8491e338949bdfe
SHA16dd0bf5c8e0d4ca1f74116e31f28f8cfa7b58323
SHA256a3425e6141358cbc1115ab3c2691768c64d62f84cea3e018eb7b6debcb05f803
SHA512ca63e89946e4a12422124adb052b59f8da30ca026b5c34b0bfe1ddcc35cf7546fedd4127d46def6c36b3e0f7278675cf4fe47362fe5070a6d7b29ffbcbd0bc49

Bug fixes and updates.

Improvements, new features and functionality

  • GraphQL API

    • Deprecated GraphQL mutation setRecentQueries, use addRecentQuery in future. The mutation will be removed after 2021-10-01. While setRecentQueries will remain in the API to not break existing clients, it will not modify the set of recent queries.

    • Deprecated GraphQL field SearchDomain.recentQueries in favor of SearchDomain.recentQueriesV2.

  • Configuration

    • Removed the log4j2-stdout-json.xml configuration file. The replacement log4j2-json-stdout.xml has been available for a while, and we want everyone to move to the new configuration, as the old configuration produces logs incompatible with the Humio Insights package.

    • Limit how many times we'll repeat a repeating regexp. The default max number of repetitions is .0 but the value is configurable between 50 and .0 by setting the MAX_REGEX_REPETITIONS env variable.

  • Other

    • Fixed an issue which caused queries to crash when "beta:repeating()" was used with a time interval ending before "now".

    • The New Action dialog validates user input in a more indulgent fashion and provides all validation errors consistently.

    • Added button to delete the organization from the Organization Overview page

    • Fixed an issue in timeChart() where the horizontal line did not showing up.

    • When assigning a role, all the user which need a new role are choosen, and then the same role is assigned to them all.

    • In the time selector, you can now write "24" in the time-of-day field to denote the end of the day.

    • Added frontend validation on welcome page and invitation page fields

    • Reduced memory usage for groupBy() function, etc.; worst-case in particular but also average-case to some degree.

    • The Alert and Scheduled Search dialogs have gotten a makeover.

    • Add a label to the empty option for default queries on the repository settings page.

    • Fixed an issue with AuthenticationMethod.SetByProxy where the search page would constantly reload.

    • Add a bit more debug logging to DataSnapshotLoader, for visibility around choice of global snapshot during boot

    • Added ability to set organization usage limits manually for cases where automatic synchronization is not possible.

    • Added a quickfix feature for reserved keywords

    • When looking at the details of an event, long field values will now extend beyond the viewport by default. Word wrapping can be enabled to stop it from extending outside the viewport.

    • The UI now consistently marks required field with a red asterisk across a number of dialogs.

    • The event distribution chart would sometimes show a bucket span reported in milliseconds instead of a more appropriate unit, when those milliseconds did not add up cleanly (e.g. "1h"). Now the bucket span can be reported with multiple units (e.g. "1h 30m")

    • Fixed a rare issue that could fail to trigger a JVM shutdown if the Kafka digest leader loop thread became nonfunctional.

    • Fixed an issue where worldmap widgets would revert to event list widgets when changing styling options.

    • Removed requirement that SAML Id needs to be an URL (Now, only requirement is that the field is not empty)

    • Fixed an issue in the Query State Cache that could fail a query on time intervals with a fixed timestamp as start and now as end.

    • Improve thread safety of updates to global Hosts entities during bootup

    • Fixed various bugs for the worldmap widget. The bug fixes may cause your world map marks to look different that previously, but should now work as intended and correcting it should be as simple as tweeking the style parameters.

    • The Humio frontend no longer sends the Humio-Query-Session header to the backend, since it is no longer used.

    • Changed implementation of cluster host alive stats to attempt to reduce thread contention when threads are checking for host liveness.

    • Fixed an OIDC group synchronization issue where users where denied access even though their group membership gave them access.

    • With worldMap() function, you can now see the magnitude value by hovering marks on the map.

    • The list of recent queries on the search page now has headers with the date the query was run.

    • Included both ws and wss in csp header

    • Started internal work on memory quotas on queries' aggregation states. This should not have any user-visible impact yet.

    • Updated the interactive tutorial with better descriptions

    • Fixed an issue where UI stalled on the "Data Sources" page

    • Automatically reduce the precision of world maps when they exceed a certain size limit

    • Changed implementation of cluster host alive stats to trigger updates in the in-memory state based on changes in global, rather than running periodic updates.

    • Fixed a problem where the global consistency check would report spurious inconsistencies because of trivial differences in the underlying JSON data

    • Debug logs which relate to the invocation of an action now contain an actionInvocationId. This trace id is the same for all logs generated by the same action invocation.

    • Users with read repository permissions can now access and see files.

    • Working on merging of advanced and simple permission models, so that the roles can be added directly to users.

    • Fixed a problem when some user-defined styles weren't being applied to a chart after a page refresh or when exported to a dashboard widget

    • Improved error messages when exporting invalid dashboards as templates

    • Slightly improve performance of id lookups in global

    • Fixed an issue for Firefox 78.10.1 ESR where the event list and event distribution chart would not be scrollable and resize incorrectly.

    • Reimplement several part of Humio to use a safer mechanism for listening to changes from global. This should eliminate a class of race condition that could cause nodes to ignore updates received during the boot process.

    • Inviting users on cloud now requires the invited user to accept the invitation before assigning permissions to him. Moreover, it is possible to invite users who are in another organization on cloud.

    • Fixed an issue where it was possible to create an alert with an empty time interval or a blank name or throttle field.

    • Improved styling of header on organization overview page

    • Fixed an issue where optimizeAndSaveQueryCoordinationPartitions could attempt to save a partitioning table to global with gaps in the partition list. This caused queries to fail, and repeated logging of a validation error.

Bug Fixes

  • Other

    • Humio trial installations now require a trial license. To request a trial license go to getting-started

    • All users (including existing users) need to accept the privacy notice and terms and conditions <https://www.crowdstrike.com/terms-conditions/humio-self-hosted> before using Humio.

Humio Server 1.26.3 Stable (2021-06-17)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.26.3Stable2021-06-172022-06-171.16.0NoNo
JAR ChecksumValue
MD58c880514f42787b5e5f85607bca347de
SHA1e97e3ea8ebc5de0076186e6daa7aa16d4ca48c8c
SHA256d906d0938e8c2283ab91dc999cac4f6a966591e3ee0089e309378123d13cd637
SHA512826aea0625a8daac1801f11f12429a6bcb3b8ee58f4b536172d4602fc5f09252fe0be0afd72a5300520980c962a9caa99aeb4ee6c9ada79544963b4c9687b972

Security fixes and some minor fixes related to Firefox, Worldmap widgets, and problems with local file clean-up.

Bug Fixes

  • Summary

    • Fixed an issue where Worldmap widgets would revert to event list widgets when changing styling options.

    • Fixed an issue for Firefox 78.10.1 ESR where the event list and event distribution chart would not be scrollable and resize incorrectly.

    • Fixed an issue where Humio could prematurely clean up local copies of segments involved in queries, causing queries to fail with a "Did not query segment" warning.

    • Updated dependencies with security fixes.

Humio Server 1.26.2 Stable (2021-06-07)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.26.2Stable2021-06-072022-06-071.16.0NoNo
JAR ChecksumValue
MD51ebc3d89c531e0ea11be7378e2f1d27c
SHA14ac77b9dd3532d6e1f3bce39a72a2f337c300ccc
SHA2566d06e3734f6a5f30715754d210092b31f4225a42d97495d8e0c8a3d6eea53bfa
SHA512d5c6e9b1b08ed10b5549359306e35734a28557088d3efa98d30ccc0080700ba053a8f83d694790686a6333c54734392e8199127cbaf1719a841979e5e9188e27

Several fixes related to the WorldMap and TimeChart widgets, OIDC group syncronization, and requirements for Humio trial installations, as well as privacy notices and terms and conditions, and other bugs.

Bug Fixes

  • Summary

    • Fix a number of cases where Humio could attempt to write a message to global larger than permitted.

    • Fixes an OIDC group synchronization issue where users where denied access even though their group membership gave them access.

    • Fixes issue where the world map widget would misbehave in different ways.

    • All users (including existing users) need to accept the privacy notice and terms and conditions before using Humio.

    • Update the minimum Humio version for Hosts in global when downgrading a node

    • Humio trial installations requires a trial license from this version, to request a trial license go to getting-started <https://www.humio.com/getting-started/>

    • Fixes an issue in Timechart with horizontal line not showing up.

Humio Server 1.26.1 Stable (2021-05-31)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.26.1Stable2021-05-312022-05-311.16.0NoNo
JAR ChecksumValue
MD58322d138b790cb9839e44c96e0cb4ba8
SHA1d4f47c97d3faa5ae5d014b5c47ec0221d24b4496
SHA256bb3fde18139e575a053709c042322604e8e01188f096a764bca9f4338286118e
SHA51244e699237aca10e0e3c5c219a06260e8715b16d8da6fa8a6e5e878f2c66ad9c639ba0d69ecc5aef8d2afb91c42b7a36fe0b7969d3b36d3b2ace21c6bb2c512c2

Several fixes related to WorldMap widget, applying user-defined styles to a dashboard chart, and partitions.

Bug Fixes

  • Summary

    • Fix an issue where optimizeAndSaveQueryCoordinationPartitions could attempt to save a partitioning table to global with gaps in the partition list. This caused queries to fail, and repeated logging of a validation error.

    • Fix an issue when some user-defined styles weren't being applied to a chart after a page refresh or when exported to a dashboard widget.

    • Fix an issue where data was not visible on the World Map until the opacity setting had been changed.

Humio Server 1.26.0 Stable (2021-05-20)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.26.0Stable2021-05-202022-05-201.16.0NoNo
JAR ChecksumValue
MD55f8abd037b3f73eaac8d5882fa58e4ec
SHA185971d1f18228a81f46f6f6334196fd918647438
SHA2564e0ad70a2c9275742aee8a0181eee2e20c6496ba16b8f6fb93490b84b5031b5e
SHA512425cacd3de3f54c2813dd3915ad35aed67de2f11a80d9c2fbf96055b030158b5d60c31686e121e613df855e6f0bdaad9d02f1c9e61a4df24b8f69cfd3193f56d

The HEC ingest endpoint will no longer implicitly parse logs using the built-in kv parser. Previously, a log ingested using this endpoint would implicitly be parsed with the kv parser when the supplied event field was given as a string. For instance, this log:

json
{
 "time" : 1537537729.0,
 "event" : "Fri, 21 Sep 2018 13:48:49 GMT - system started name=webserver",
 "source" : "/var/log/application.log",
 "sourcetype" : "applog",
 "fields" : { "#env" : "prod" }
 }

Would be parsed, so that the resulting Humio event would contain the field name=webserver.

If you don't wish this behavior to change, you will have to perform this parsing operation explicitly.

When ingesting into the HEC endpoint, you are using an ingest token to authenticate with Humio. If that token does not have an associated parser, all you need to do is assign the kv parser to the token.

If your ingest token already has an assigned parser, you will need to prepend the code of that parser with this code snippet:

kvParse(@rawstring) | findTimestamp(addErrors=false) |

Dark Mode is a new visual theme throughout Humio (except some settings pages) that is tailored to offer great readability in dark environments, to not brighten the entire room when used on dashboards, and offer a unique visual style that some users prefer simply for its aesthetics. In 1.25 users are going to see a modal dialogue that asks what mode users would like to have; dark mode, light mode or follow the OS theme. This setting can later be changed in the settings menu.

Bug Fixes

Known Issues

  • Other

    • A regression can cause 1.26.0 to repeatedly error log and fail to start queries in cases where the list of hosts in the cluster is not fixed. This is particularly likely to affect clusters running with ephemeral disks. The regression is fixed in 1.26.1.

Humio Server 1.25.3 Preview (2021-05-10)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.25.3Preview2021-05-102021-05-201.16.0NoNo
JAR ChecksumValue
MD508d8b9bfd9692b992a0f564426041717
SHA1463df975e2f50c3ae3de888b454a2d1a7285f148
SHA25606167df8dabc6211a26edc4aede8d2461ded183e7bb6f1ef527f1b8a441f52b0
SHA512dbbed239b977af08889433e9f020bbdcb02b5f9496ab2a7eb410d967eb72ef7a4dcfde93374d36a3fe8c5798b35527f2594c025b6c68a3517c20e6f32e5d4ad9

Minor bug fixes, including removing error logs from alert jobs running in a Sandbox.

Bug Fixes

  • Summary

    • Minor bug fixes and improvements.

    • Removes error logs from the alert job when running alerts on a sandbox repository.

Humio Server 1.25.2 Preview (2021-05-06)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.25.2Preview2021-05-062021-05-201.16.0NoNo
JAR ChecksumValue
MD529b0554b42990118d22fb674e0f6b397
SHA1ce0ee5e134123fa5ccde8dc012fb1822722140ff
SHA2569374d762c00d5aa1884f163391fa13149e74f22e428ff849f15124ded001c033
SHA51252b14b36db509515fb1d25e2e346b3a920493cdfd7f4862ebdee892014d14394d19e2324da60ec7d1f7137b1eef50c9716499e174e1f910f7a33f437aee1c053

Bug fix related to global consistency checks with nodes.

Bug Fixes

  • Summary

    • Fixes problem where having many nodes and a large global could lead to deadlocks in the global consistency check.

Humio Server 1.25.1 Preview (2021-05-04)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.25.1Preview2021-05-042021-05-201.16.0NoNo
JAR ChecksumValue
MD57e4477532960f4662ee7f3c11681d640
SHA18f7d79294eb27af73333252b2177e3b1467fa01e
SHA25644b0be0f312c747f1b4f32ca34613bccdc47330100d3d74381731e556e2da999
SHA512b3624257bd69d0d0e123e7af5010da3d49680f0d286c1ad4daae50f75bfc8ea0cea35836c8e233c09c1f3ee4e5c02ecbc91850c0a0af30afb59e26206c0de125

There is a serious issue affecting larger clusters in this release. The global inconsistency checker job can cause the thread responsible for reading changes from global to hang. It is possible to work around this by disabling the job using RUN_GLOBAL_CONSISTENCY_CHECKER_JOB=false. This is fixed in 1.25.2.

Bug Fixes

  • Other

    • Makes disabled items in the main menu look disabled in dark mode

Humio Server 1.25.0 Preview (2021-04-29)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.25.0Preview2021-04-292021-05-201.16.0NoNo
JAR ChecksumValue
MD5aa7d71e3617d71ec800f1e5e898cb328
SHA18e815fd8c1d6a0bc1c22e096e8f82d08d40ea172
SHA2567f26e858df2f1e16a64f44c6ac72948267eb317d884ad1db72b3799adcc95696
SHA5121f447d204ecb3e60c80835e02a4fe8e6c7984728df5b31827b23f2278e00a0862a78dabe8ef01a2295f925a351693bdbb1d649c83465bf0951b040eab466fbad

There is a serious issue affecting larger clusters in this release. The global inconsistency checker job can cause the thread responsible for reading changes from global to hang. It is possible to work around this by disabling the job using RUN_GLOBAL_CONSISTENCY_CHECKER_JOB=false. This is fixed in 1.25.2 (and 1.26.0).

The HEC ingest endpoint will no longer implicitly parse logs using the built-in kv parser. Previously, a log ingested using this endpoint would implicitly be parsed with the kv parser when the supplied event field was given as a string. For instance, this log:

json
{
 "time" : 1537537729.0,
 "event" : "Fri, 21 Sep 2018 13:48:49 GMT - system started name=webserver",
 "source" : "/var/log/application.log",
 "sourcetype" : "applog",
 "fields" : { "#env" : "prod" }
 }

Would be parsed, so that the resulting Humio event would contain the field name=webserver.

If you don't wish this behavior to change, you will have to perform this parsing operation explicitly.

When ingesting into the HEC endpoint, you are using an ingest token to authenticate with Humio. If that token does not have an associated parser, all you need to do is assign the kv parser to the token.

If your ingest token already has an assigned parser, you will need to prepend the code of that parser with this code snippet:

kvParse(@rawstring) | findTimestamp(addErrors=false) |

Dark Mode is a new visual theme throughout Humio (except some settings pages) that is tailored to offer great readability in dark environments, to not brighten the entire room when used on dashboards, and offer a unique visual style that some users prefer simply for its aesthetics. In 1.25 users are going to see a modal dialogue that asks what mode users would like to have; dark mode, light mode or follow the OS theme. This setting can later be changed in the settings menu.

Improvements, new features and functionality

  • Other

    • The query scheduler now prioritizes new queries started by a user based on the cumulative cost of recent queries started by that user. Added new configuration QUERY_SPENT_FACTOR with the default value 0.5, which defines the weight of recent query costs when scheduling. Higher values mean that users with high recent query costs will see their queries penalized harder in the scheduling.

Bug Fixes

  • GraphQL API

    • The SearchDomain.queries GraphQL field has been deprecated. Use SearchDomain.savedQueries instead.

    • The SearchDomain.viewerCanChangeConnections GraphQL field has been deprecated. Use SearchDomain.isActionAllowed instead.

    • The updateSettings GraphQL mutation has been marked as unstable, as it can control unstable and ephemeral settings.

    • Deprecates GraphQL fields UserSettings.isEventListOrderChangedMessageDismissed, UserSettings.isNewRepoHelpDismissed, and UserSettings.settings since they are not used for anything anymore, and will be removed in a future release.

    • Removes the deprecated Repository.isFreemium GraphQL field.

  • Configuration

    • New config: SEGMENTMOVER_EXECUTOR_CORES allows tuning number of concurrent fetches of segments from other nodes to this node. Defaults to vCPU/8, must be at least 2.

    • Removed the QUERY_QUOTA_EXCEEDED_PENALTY configuration.

    • New config: S3_ARCHIVING_IBM_COMPAT for compatility with S3 archiving to IBM Cloud Object Storage.

  • Other

    • When running alerts and scheduled searches, all logging related to a specific alert or scheduled search will now be logged to the humio-activity repository, instead of the humio repository. Error logs will still be logged to the humio repository as well.

    • Fixed a bug which could cause head(), tail(), sort() within either bucket() or a live query to return too few results in certain cases.

    • Fixed a bug where a scheduled search would be executed repeatedly, as long as at least one out of multiple actions was failing. Now, execution is only repeated if all actions are failing.

    • Fixed a bug where cidr() did not respect the include parameter

    • Allow user groups to be represented as a json string and not only as an array when logging in with oauth.

    • Refreshing actions while creating alerts and scheduled searches now happens automatically, but can also be triggered manually using a button.

    • Query poll responses meta data now include Query Quota spent for current user across queries. The cost so far of the current query was there already.

    • Reworked initialization of Humio's async listener infrastructure, to ensure that listeners do not miss any updates. This fixes a number of flakiness issues that could arise when a node was rebooted.

    • Bumped minimum supported versions of Chrome and Chromium from 60 to 69 due to updated dependencies

    • The HEC ingest endpoint is no longer implicitly running kvParse. This used to be the case when ingesting events of the form "event" : "Log line...". If the ingested data is to be key-value parsed, add kvParse() to the relevant parser for the input data.

    • Changed the built-in audit-log parser so that null values are stored as an empty string value. Previously, they were stored as the string "null". The defaults are consistent with the old behavior, so that null values become a "null" string and empty string values are kept.

    • Some minor performance improvements in the ingest pipeline

    • Rework how Humio caches data from global. This fixes a number of data races, where Humio nodes could temporarily get an incorrect view of global.

    • Optimized the splitString() function.

    • Fixed an issue where clicking the label of a parser rerouted erroneously

    • Added documentation link to autocomplete description in the Humio search field

    • Added IP ASN Database license information to the Cluster Administration page

    • Improved error logging for event forwarding

    • Fixed a bug that made it possible to rename a parser to an existing name and thereby overwriting the existing parser.

    • When installing an application package, you sometimes had to refresh the page to get the assets in the package linked to their installed counter parts.

    • Made it possible to delete a parser overriding a built-in parser, even though it is used in an ingest token.

    • Added new parameters handleNull and excludeEmpty to parseJson() to control how null and empty string values are handled.

    • When a query is cancelled, a reason for canceling the query is now always logged. Previously, this was only done if the query was cancelled due to an internal exception. Look for log lines starting with query is cancelled.

    • Fixed a bug that made it impossible to copy a parser to override a built-in parser.

    • Added audit logging when assigning a parser to an ingest token or unassigning a parser from an ingest token. Added the parser name to all audit logs for ingest tokens.

    • Added a new query function: base64Decode()

    • Make the parseLEEF() function more robust and optimize its memory usage.

    • Added a warning to the Cluster Nodes page that warns you if not all Humio servers are running the same Humio version.

Humio Server 1.24.4 Stable (2021-05-31)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.24.4Stable2021-05-312022-05-311.16.0NoNo
JAR ChecksumValue
MD583588b8570c97dc8a89b46524ea8d92a
SHA115958a097eaba9689a43c557e1d6d14e2d566d6d
SHA256cafca561035aec00f5971a15cf283b757794c8a2706829518a05ce089f92ea88
SHA51215352a96bb6b4ed27ef1c7b238cf97142c36cfefe17be25bf671a706bd6afcf0c8ad8951a325838e259eeb52e643f3950b8f47f3186ecea049f34fc81e066eed

Minor bug fixes, as well as fix a stackoverflow bug in large clusters.

Bug Fixes

  • Summary

    • Minor bug fixes and improvements.

    • Fix a stackoverflow that could occur during startup in larger clusters.

Humio Server 1.24.3 Stable (2021-05-10)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.24.3Stable2021-05-102022-05-101.16.0NoNo
JAR ChecksumValue
MD5adb3c4827d86d476d104ab2ba8ec3171
SHA106a25ba15bf28659900807a8505860f5b32a65d6
SHA256bae28e700dc6806496fd351ffb865a80420f0757613546076b4a2e9aae719d8d
SHA512aff4adf71e1140ffdbeebfef7eae451d0bbff41f5af1753dee13d1287635644228336da0de300208fe1e667ae151198c74b74fdf10d830d37ae9b072f136a7a4

Minor bug fixes.

Bug Fixes

  • Summary

    • Minor bug fixes and improvements.

Humio Server 1.24.2 Stable (2021-04-19)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.24.2Stable2021-04-192022-04-191.16.0NoNo
JAR ChecksumValue
MD569a6ef22d7f295f807ceef46c8c0c6d1
SHA16284ee05bd7c583044f6620f385864a3be3bab84
SHA256cc648f1c4efe01d20e9f93a77b1892291077ae76339d1b5dcbc0e504f9975e25
SHA51254c60624a5c0ef19c12fcda05b4fecbe8ddf626246c3160d90f29cc76143dfbe4b07f7d884616699486848f0e7b8c519c0e1d5f5dd3e2be3e8b0a6f49fe960c5

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.24.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.24.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Reduced off-heap memory usage

    • Fixed an issue where cost spent in a long-running query got accounted as spent "now" when the query ended in terms of Query Quota

    • Fixed an issue where a repository with very high number of datasources could trigger an error writing an oversized message to kafka from the ingest-reader-leader thread

Humio Server 1.24.1 Stable (2021-04-12)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.24.1Stable2021-04-122022-04-121.16.0NoNo
JAR ChecksumValue
MD5b7fec8d3a5c0b521a371dbeb6e56d8b2
SHA1fbabef325eaaf1bd0a3052f51497f00779efad5f
SHA256223e48fe647fc681456b47cad81d0fca5936d6283791b2a41fa4c8dc199c1c76
SHA51251663220d67bb25f67b7e44837e84c87c36c3f24da69918b1a6978fc751543a2f1f25f49f166681def7a0276881907b284a52bb302fa6d745d7b16859d3f7d96

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.24.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.24.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Allow reverse proxies using 10s as timeout to work also for a query that takes longer than that to initialize

    • Ensure that if the Kafka leader loop thread dies, it kills the Humio process. In rare cases it was possible for this thread to die, leaving the node incapable of performing digest work

    • Fixes an issue where the user would get stuck in infinite loading after having been invited into an organization

    • Fixed a bug where ingestOnly nodes could not start on a more recent version that the statefull nodes in the cluster

Humio Server 1.24.0 Stable (2021-04-06)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.24.0Stable2021-04-062022-04-061.16.0NoNo
JAR ChecksumValue
MD5cbee15b1c1af8d13984fbd938e9f9488
SHA18562af8753aca033d6b4966311787c2a681116dc
SHA2567cda1dd2188ec2ed5899c5a4c26cf45c2f2d4199439342da64819194475b5cf2
SHA512ad9e05ed84cd08f8774b5bbec44b8075ebb9e2cd7898f7d6f88fc445a5e1476284b86b1d3d5536ecdf1609b7c8b4e05d3ad27302dd79e41f95094140c12ce002

Important Information about Upgrading

This release promotes the latest 1.23 release from preview to stable.

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.24.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.24.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Humio will make some internal logs available in a new repository called humio-activity. This is meant for logs that are relevant to users of Humio, as compared to logs that are only relevant for operators. The latter logs are still put into the humio repository. For this release, only new log events will be put into humio-activity, but in later releases, some existing log events that are relevant for users, will be put into the humio-activity repository instead of the humio repository.

For cloud users, the logs for your organization can be accessed through the humio-organization-activity view.

For on-prem users, the logs can be accessed directly through the humio-activity repository. They are also output into a new log file named humio-activity.log which can be ingested into the humio repository, if you want it available there as well. If you do and you are using the Humio Insights Application, you should upgrade that to version 0.0.4. For more information, see the Internal Logging documentation.

Humio has decided to adopt an evolutionary approach to its GraphQL API, meaning that we will strive to do only backwards compatible changes. Instead of making non-backwards compatible changes to existing fields, we will instead add new fields alongside the existing fields. The existing fields will be deprecated and might be removed in some later release. We reserve the right to still do non-backwards compatible changes, for instance to fix security issues.

For new experimental features, we will mark the corresponding GraphQL fields as PREVIEW. There will be no guarantees on backwards compatibility on fields marked as PREVIEW.

Deprecated and preview fields and enum values will be marked as such in the GraphQL schema and will be shown as deprecated or preview in the API Explorer. Apart from that, the result of running a GraphQL query using a deprecated or preview field will contain a new field extensions, which contains a field deprecated with a list of all deprecated fields used in the query and a field preview with a list of all preview fields used in the query.

Example:

{
 "data": ...
 "extensions": {
 "deprecated": [
 {
 "name": "alert",
 "reason": "[DEPRECATED: Since 2020-11-26. Deprecated since 1.19.0. Will be removed March 2021. Use 'searchDomain.alert' instead]"
 }
 ]
 }
 }

Deprecated fields and enum values will also be noted in the release note, when they are first deprecated. All use of deprecated fields and enum values will also be logged in the Humio repository humio-activity. They will have #category=GraphQL, subCategory=Deprecation and #severity=Warning. If you are using the API, consider creating an alert for such logs.

Removed Support for CIDR Shorthand

Previous version of Humio supported a shorthand for IPv4 CIDR expressions. For example 127.1/16 would be equivalent to 127.1.0.0/16. This was contrary to other implementations like the Linux function inet_aton, where 127.1 expands to 127.0.0.1. Support for this shorthand has been removed and the complete address must now be written instead.

Bug Fixes

  • Other

    • Fixed an issue which prevented Safari users from seeing alert actions

    • The query scheduler now prioritizes new queries started by a user based on the cumulative cost of recent queries started by that user. Added new config QUERY_SPENT_FACTOR with the default value 0.5, which defines the weight of recent query costs when scheduling. Higher values mean that users with high recent query costs will see their queries penalized harder in the scheduling.

    • Fixed an issue which caused problems with forward/backward compatibility of LanguageVersion in GraphQL

    • Fixed a scrolling issues on the Kafka cluster admin page

    • Fixed an issue on the search page that prevented the event list from scrolling correctly.

    • Major changes: 1.23.0 and 1.23.1.

    • Removed the QUERY_QUOTA_EXCEEDED_PENALTY config (introduced in 1.19.0).

Humio Server 1.23.1 Stable (2021-03-24)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.23.1Stable2021-03-242022-03-241.16.0NoNo

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.23.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.23.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Allow users group to be represented as a json string and not only array when logging in with oauth.

    • New config: S3_ARCHIVING_IBM_COMPAT for compatibility with S3 archiving to IBM Cloud Object Storage.

Humio Server 1.23.0 Preview (2021-03-18)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.23.0Preview2021-03-182021-03-241.16.0NoNo
JAR ChecksumValue
MD5882c77cb19e867084fbb26dc80c079d8
SHA1053d49648f03fd49f0766aa9df64f66921c72638
SHA256898f1670010d25866f9fb27e054509a2ade615dbae612cdc70ce34371e03ac59
SHA512eba333bfec11983f6140ca4e64ec725c91c0d724f245c0250f2264a9221036a7d9e89aace2bf096ce7b5ecca72b4c24659348feba7098d89a5a4035359d8b8d3

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.23.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.23.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Humio will make some internal logs available in a new repository called humio-activity. This is meant for logs that are relevant to users of Humio, as compared to logs that are only relevant for operators. The latter logs are still put into the humio repository. For this release, only new log events will be put into humio-activity, but in later releases, some existing log events that are relevant for users, will be put into the humio-activity repository instead of the humio repository.

For cloud users, the logs for your organization can be accessed through the humio-organization-activity view.

For on-prem users, the logs can be accessed directly through the humio-activity repository. They are also output into a new log file named humio-activity.log which can be ingested into the humio repository, if you want it available there as well. If you do and you are using the Humio Insights Application, you should upgrade that to version 0.0.4. For more information, see Internal Logging documentation.

Humio has decided to adopt an evolutionary approach to its GraphQL API, meaning that we will strive to do only backwards compatible changes. Instead of making non-backwards compatible changes to existing fields, we will instead add new fields alongside the existing fields. The existing fields will be deprecated and might be removed in some later release. We reserve the right to still do non-backwards compatible changes, for instance to fix security issues.

For new experimental features, we will mark the corresponding GraphQL fields as PREVIEW. There will be no guarantees on backwards compatibility on fields marked as PREVIEW.

Deprecated and preview fields and enum values will be marked as such in the GraphQL schema and will be shown as deprecated or preview in the API Explorer. Apart from that, the result of running a GraphQL query using a deprecated or preview field will contain a new field extensions, which contains a field deprecated with a list of all deprecated fields used in the query and a field preview with a list of all preview fields used in the query.

Example:

{
 "data": ...
 "extensions": {
 "deprecated": [
 {
 "name": "alert",
 "reason": "[DEPRECATED: Since 2020-11-26. Deprecated since 1.19.0. Will be removed March 2021. Use 'searchDomain.alert' instead]"
 }
 ]
 }
 }

Deprecated fields and enum values will also be noted in the release note, when they are first deprecated. All use of deprecated fields and enum values will also be logged in the Humio repository humio-activity. They will have #category=GraphQL, subCategory=Deprecation and #severity=Warning. If you are using the API, consider creating an alert for such logs.

Removed Support for CIDR Shorthand

Previous version of Humio supported a shorthand for IPv4 CIDR expressions. For example 127.1/16 would be equivalent to 127.1.0.0/16. This was contrary to other implementations like the Linux function inet_aton, where 127.1 expands to 127.0.0.1. Support for this shorthand has been removed and the complete address must now be written instead.

Bug Fixes

  • Other

    • Fixed an issue with the Missing Segments API that caused missing segments to not appear in the missing segments list if they had a replacement segment.

    • Fixed an issue where changes to files would not propagate to parsers or event forwarders.

    • Fixed an issue where Prometheus metrics always reported 0.0 for humio_primary_disk_usage

    • Changed the URL of the Kafka cluster page in the settings.

    • Fixed the requirement condition for the time retention on a repository.

    • Added IP Filter for readonly dashboard links, and started to audit log readonly dashboard access. In this initial version. The readonly ip filter can be configured with the graphql mutation:

      graphql
      mutation {
       updateReadonlyDashboardIPFilter(ipFilter: "FILTER")
       }

      The FILTER is expected in this format: IP Filter. From Humio 1.25 this can be configured in the configuration UI.

    • Fixed an issue which caused ingest-to-multiple-repos to break, when the parser used copyEvent to duplicate the input events into multiple repositories

    • Fixed an issue causing undersized segment merging to repeatedly fetch the same segments, in cases where the merger job took too long to finish.

    • Added an option to make it easier to diagnose problems by detecting inconsistencies between globals in different Humio instances. Each Humio instance has its own copy of the global state which must all be identical. It has happened that they were not, so now we check and if there is a difference we report an error and dump the global state into a file.

    • Made the S3 archiving save button work again.

    • Enforce permissions to enter creating new repository page.

    • Fixes a bug where events deleted with the delete-event API would appear deleted at first, but then resurface again after 24h. If user applying delete did not have permission to search the events being deleted.

    • Allow turning encryption of files stored in bucket storage off by explicitly setting S3_STORAGE_ENCRYPTION_KEY=off (similar for GCP_ )

    • The GraphQL API Explorer is now available from inside Humio. You can access it using the Help->API Explorer menu.

    • Restyled the alert dialogue.

    • Fixed a bug where the same regex pattern occurring multiple times in a query could cause incorrect results

    • Added support for CIDR matching on match() using mode=cidr.

    • Added GraphQL queries and mutations for alerts and actions, which correspond to the deprecated REST endpoints for those entities.

    • Negated, non-strict match() or lookup() is no longer allowed.

    • Added a new introduction message to empty repositories.

    • Improved memory use for certain numerical aggregrating functions

    • Enforce permissions to enter Organization Settings page.

    • Fixed an issue where regular expressions too large to handle would sometimes cause the query to hang. Now we report an error.

    • Refactor how the width of the repository name in the main navigation bar is calculated.

    • Enforce accepting terms and conditions.

    • Deprecated GraphQL mutations addAlertLabel, removeAlertLabel, addStarToAlert and removeStarFromAlert as they did not follow the standard for mutation input.

    • Mark required fields on the Accept Terms and Conditions page.

    • Added mode parameter to match(), allowing different ways to match the key.

    • Refactor All Organizations page.

    • Deprecated the ReadEvents enum variant from the ViewAction enum in GraphQL. Use the ReadContents variant instead, which has the same semantics, but a more accurate name. ReadEvents will be removed in a future release.

    • Deprecated file and column parameter on cidr(). Use match() with mode=cidr instead.

    • Deprecated glob parameter on match(), use mode=glob instead.

    • Fixed a bug which caused glob-patterns in match() to not match newline characters

    • The SearchDomain.queries GraphQL field has been deprecated, and will be removed in a future release. Use SearchDomain.savedQueries instead.

    • The GraphQL API Explorer has been upgraded to a newer version. The new version includes a history of the queries that have been run.

    • Implemented toggle button for dark mode.

    • The SearchDomain.viewerCanChangeConnections GraphQL field has been deprecated, and will be removed in a future release. Use SearchDomain.isActionAllowed instead.

    • Removed support for shorthand IPv4 CIDR notation in cidr(). See section "Removed support for CIDR shorthand".

    • Improved performance when using match() with mode=cidr compared to using cidr() with file().

    • UI enhancements for the new repository Access Permissions page.

    • It is again possible to sort the events on the test parser page.

    • Improved performance of free-text search using regular expressions

    • Deprecated the REST endpoints for alerts and actions.

    • Fixed a bug which caused in() with values=[] to give incorrect results

    • Refactor client side action cache of allowed permissions.

    • Fixed a bug which caused tag-filters in anonymous functions to not work in certain cases (causing to many events to be let through)

    • Fixed a bug which caused match() to give incorrect results in certain cases due to incorrect caching

    • Removed the deprecated Repository.isFreemium GraphQL field.

    • Added GraphQL mutations addAlertLabelV2, removeAlertLabelV2, addStarToAlertV2 and removeStarFromAlertV2.

    • Refactor Organization Overview page.

    • Fixed a bug in event forwarding that made start(), end() and now() return the time at which the event forwarding rule was cached. Instead, now() will return the time at which the event forwarding rule was run. start() and end() were never meant to be used in an event forwarding rule and will return 0, which means Unix Epoch.

Humio Server 1.22.1 Stable (2021-03-02)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.22.1Stable2021-03-022022-03-021.16.0NoNo
JAR ChecksumValue
MD57d2fb4c0736d1c7f03197fba78a33c13
SHA136c3c2b7ffe3485fb9f87a75b515cb7b9efc5efc
SHA256bc3122c71e8c1bdf57fc044912c660b86933c871758818fb93a8d609c9bc340d
SHA51254e1da57da87480a2b1b0cc577eb731b734b8fe7af0e2ac3afcd406d28f29ffa5b834d836b283dc5e730b10bba43d55484cd8579746c800bd26a26280a088200

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.22.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.22.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Fixes parserlist having no height on Safari.

    • Fixes overflowing editor bug.

    • Fixes problem where alertpages have no height in Safari.

Humio Server 1.22.0 Stable (2021-03-02)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.22.0Stable2021-03-022022-03-021.16.0NoYes
JAR ChecksumValue
MD5115532e6c7c321a1fe737bdde5731f4b
SHA18a42ec6f7ba168939c60d521d30eba202479173e
SHA2564cff315346b9edb1ba625f48fe36105666dc9b95e711190578ff62752fa763e4
SHA5120173d8b48f8612198cb4a20146b15d23769cacee4fac12a7c710a93ef2f17a30140ccee8e09c8f7c5262815cbb2e03876fe30986f276a9d36155832c4e03a233

Important Information about Upgrading

This release promotes the latest 1.21 release from preview to stable.

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.22.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.22.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

## UI revamp In this version the UI has been given a complete makeover. ## Details To see more details, go through the individual 1.21.x release notes (links in the changelog).

Bug Fixes

  • Other

    • Change log lines creating a 'kind' field. Kind is used as a tag for the different humio logs

    • Restrict concurrency when mirroring uploaded files within the cluster

    • Fixed issue where local segment files would not get deleted in time, potentially filling the disk

    • Fixed issue where root users were not allowed to set unlimited time in retention settings

    • Increase HTTP chunk size from 16MB to 128MB

    • Add the "ProxyOrganization" header to the list of general auth headers used on REST calls

    • Major changes: (see version 1.21.0 and 1.21.1 release notes)

    • Fixed issue where tag filters in anonymous parts within an aggregate did not get applied

    • Fix issue where updating account settings would present the user with an error even though the update was successful

Humio Server 1.21.1 Preview (2021-02-23)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.21.1Preview2021-02-232021-03-021.16.0NoNo
JAR ChecksumValue
MD53f2b7ae5265ab8e81d339ebbd260b802
SHA1e406e539b9d3474a25accc82d49efdbcc94c7f4d
SHA2560ec0db6bfaa232c30d1e0056442f58e5d2c20d9b7716ba136b8350d2c5c05bdd
SHA51201383adbe54ceb73679aece980b0a7752b07478a40ac3f811a3aadbf9fb55077ebf08842cb2442628af1200e677d0db289a6007b3706794c79377787ef56e898

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.21.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.21.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Server: header in responses from from Humio HTTP server now includes (Vhost, NodeRole) after the version string.

    • New "prefetch from bucket" job. When a node starts with an empty disk it will download a relevant subset of segment files from the bucket in order to have them present locally for queries.

    • Improve performance of "decrypt step" in downloads from bucket storage

Humio Server 1.21.0 Preview (2021-02-22)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.21.0Preview2021-02-222021-03-021.16.0NoNo
JAR ChecksumValue
MD53175d041a4c0a6948d5e23993b7a3bcd
SHA11356a57098602623b5cab8511f530aab3b04a080
SHA2568f576aca2a00533180ed3710971bd9c4c419e275d618c4c745d004b9a5ad9987
SHA512475c72b5655744be0a900269478d930942cd7aae9ec8acf0e38c1eff2a4c7ec243c91293996ad8288ec2ed9c72b896436bb8e12b67f44b999fc03d1f43db4a2d

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.21.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.21.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Change handling of groupBy() in live-queries which should in many cases reduce memory cost.

    • subnet() now reports an error if its argument bits is outside the range 0 to 32.

    • Running test of a parser is no longer recorded in the audit log, and irrelevant fields are no longer recorded upon parser deletion.

    • Fixed a bug which could potentially cause a query state cache file to be read in an incomplete state.

    • Fixed an issue causing Humio to crash when attempting to delete an idle empty datasource right as the datasource receives new data.

    • Improve number formatting in certain places by being better at removing trailing zeros.

    • Fixed an issue where repeating queries would not validate in alerts.

    • Fixed an issue with the validation of the query prefix set on a view for each repository within the view: Invoking macros is not allowed and was correctly rejected when creating a view, but was not rejected when editing an existing connection.

    • Prevent Humio from booting when Zookeeper has been reset but Kafka has not.

    • When exporting a package, you now get a preview of the icon you've added for the package.

    • Improve hit rate of query state cache by allowing similar but not identical queries to share cache when the entry in the cache can form the basis for both. The cache format is incompatible with previous versions, this is handled internally by handling incompatible cache entries as cache misses.

    • Fixed a bug which caused eventInternals() to crash if used late in the pipeline.

    • Fixed an issue causing event redirection to break when using copyEvent to get the same events ingested into multiple repositories.

    • kvParse() now only unescapes quotes and backslashes that are inside a quoted string.

    • The default parser kv has been changed from using the parseemacs vTimestamp() function to use the findTimestamp() function. This will make it able to parse more timestamp formats. It will still only parse timestamps with a timezone. It also no longer adds a timezone field with the extracted timestamp string. This was only done for parsing the timestamp and not meant for storing on the event. To keep the old functionality, clone the kv parser in the relevant repositories and store the cloned parser with the name kv. This can be done before upgrading to this release. See Built-In kv Parser.

    • Fixed a bug where referenced saved queries were not referenced correctly after exporting them as part of a package.

    • Fixed an issue causing segment tombstones to potentially be deleted too early if bucket storage is enabled, causing an error log.

    • Fixed a bug which could cause saving of query state cache to take a rather long time.

    • kvParse() now also unescapes single quotes. (')

    • Made loggings for running scheduled searches more consistent and more structured. All loggings regarding a specific alert will contain the keys scheduledSearchId, scheduledSearchName and viewId. Loggings regarding the alert query will always contain the key externalQueryId and sometimes also the keys queryId with the internal id and query with the actual query string. If there are problems with the run-as-user, the id of that user is logged with the key user.

    • Improve performance of writeJson() a bit.

    • Create, update and delete of an alert, scheduled search or action is now recorded in the audit log.

    • The replace() function now reports an error if the arguments replacement and with are provided at the same time.

    • Fixed a bug which caused validation to miss rejecting window() inside window() and session().

    • The functions worldMap() and geohash() now errors if requested precision is greater than 12.

    • kvParse() now unescapes backslashes when they're inside (' or ") quotes.

    • Fixed bugs in format() which caused output from '%e'/'%g' to be incorrect in certain cases.

    • Fixed a number of potential concurrency issues.

    • Fixed an issue where cancelled queries could be cached.

    • Make the thread dump job run on a dedicated thread, rather than running on the thread pool shared with other jobs.

    • The replace() function now reports an error if an unsupported flag is provided in the flags argument.

    • Fixed a bug in lowercase() which caused the case lowercase(field="\*", include="values") to not process all fields but only the field named "\*".

    • When using filters on dashboards, you can now easily reset the filter, either removing it completely, or using the default filter if one is present.

    • Made sure the humio view humio default parser is only installed when missing, instead of overwriting it every time humio starts.

    • Lowered the severity level for some loggings for running alerts.

    • Fixed a bug where analysis of a regex could consume extreme amounts of memory.

    • The Auth0 login page will no longer load a local version of the Auth-Lock library, but instead load a login script hosted on Auth0's CDN. This may require opening access to https://cdn.auth0.com/ if hosting Humio behind a firewall.

    • The deprecated built-in parser bro-json has been deleted. It has been replaced by the parser zeek-json.

    • Fixed an issue with lack of escaping in filename when downloading.

    • The split() function no longer adds a @display field to the event it outputs.

    • Raised the parser test character length limit to .00.

    • Fixed an issue where the segment mover might schedule too many segments for transfer at a time.

    • Humio insights package installed if missing on the humio view when humio is started.

    • Packages can now be updated with the same version but new content. This makes iterating over a package before finalizing it easier.

    • Raised the note widget text length limit to .00.

    • Fixed a memory leak in rdns() in cases where many different name servers are used.

    • Fixed a bug in parseJson which resulted in failed JSON parsing if an object contained an empty key ("").

    • Fixed a performance and a robustness problem with the function unit:convert(). The formatting of the numbers in its output may in some cases be different now.

    • Added support for disaster recovery of a cluster where all nodes including Kafka has been lost, restoring the state present in bucket storage as a fresh cluster using the old bucket as read-only, and forming a fresh cluster from that. New Configs: S3_RECOVER_FROM_REPLACE_REGION and S3_RECOVER_FROM_REPLACE_BUCKET to allow modifying names of region/bucket while recovering to allow running on a replica, specifying read-only source using S3_RECOVER_FROM* for all the bucket storage target parameters otherwise named S3_STORAGE*

    • The experimental function moment has been removed.

    • Fixed a bug in upper() and lower() which could cause its output to be corrupted (in cases where no characters had been changed).

    • When on ephemeral disks, nodes being replaced with new ones on empty disks no longer download most of the segments they had before being replaced, but instead schedule downloads based on is being searched.

    • The transpose function now reports an error if the arguments header or column is provided together with the argument pivot.

    • Made loggings for running alerts more consistent and more structured. All loggings regarding a specific alert will contain the keys alertId, alertName and viewId. Loggings regarding the alert query will always contain the key externalQueryId and sometimes also the keys queryId with the internal id and query with the actual query string. If there are problems with the run-as-user, the id of that user is logged with the key user.

    • Fixed an issue where merge of segments were reported as failed due to input files being deleted while merging. This is not an error, and is no longer reported as such.

    • The deprecated built-in parser json-for-notifier has been deleted. It has been replaced by the parser json-for-action.

    • The findTimestamp() function has been changed, so that it no longer has a default value for the timezone parameter. Previously, the default was UTC. If no timezone argument is supplied to the function, it will not parse timestamps that do not contain a timezone. To get the old functionality, simply add timezone=UTC to the function. This can be done before upgrading to this release.

Humio Server 1.20.4 Stable (2021-02-22)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.20.4Stable2021-02-222022-02-221.16.0NoNo
JAR ChecksumValue
MD5e84da693a3ca628775ca56a33f27db91
SHA1fd2a37750456d861a92ee41840701c2040b71d79
SHA2560fc7d2b010abbc263ef97ae4cb019994804133ff858f23de03e0bce69760011a
SHA5129af984c0a5896046cf0f3febd3b64aef7af501404df75a612c04452140aa9cd9c97f4ed2a5a95fe241ac227db3f3bbbe072ddaa2bed058053b6cfeafcbc388e5

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.4 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.4. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Fixed an issue causing event redirection to break when using copyEvent() function to get the same events forwarded to multiple repositories.

    • New "prefetch from bucket" job - When a node starts with an empty disk it will download a relevant subset of segment files from the bucket in order to have them present locally for queries.

    • Fix newline glob handling in in() and match() functions.

    • Connecting to the Package Marketplace now respects the Humio proxy configuration

Humio Server 1.20.3 Stable (2021-02-11)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.20.3Stable2021-02-112022-02-111.16.0NoNo
JAR ChecksumValue
MD5eb0a1ddfb3bd3440206fc7ce95fedd74
SHA10eedbdc67554a9efbb0fcc5f667a99c899ae43bc
SHA256ecdcb4a299eb3668ed6d5435c97469b4f7b1423f239f4e0a4b95a88d9b8fd566
SHA51253dd06169c01eaccc6766f53f6a7c71910c131d7600bfdcdb3f9796d61e7ccdcfa801d8b2a2b9ed4b205fa7c3e567dc2a9a3b6879c94e10f408892cd0d57d77d

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.3 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.3. In case you need to do a rollback, this can also only happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Improve auto completion suggestions.

Humio Server 1.20.2 Stable (2021-02-11)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.20.2Stable2021-02-112022-02-111.16.0NoNo
JAR ChecksumValue
MD5c8369fd679e4ef4fb1ddad2a632156e1
SHA17dc7214d24c3314fa9e60128106aed4078b2c7c9
SHA256e1c8188fd7e0dc92c648a675514627c4a9ae0f52658aac748d35a0105347c4ba
SHA512fea474b22bebcbe7c5ad1e142fbf157f495b58726951e8b52820475fdda5eb48503a76bef7e2178ac3aeddcc6087d6bdd66c3ab5c67dbcf721da1ebc4bd671fa

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.2 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.2. In case you need to do a rollback, this can also only happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Fixed a bug where fields panel was not scrollable in Safari.

    • Reduce triggering of auto completion in the query editor.

    • Fixed an issue where cloning a dashboard or parser would clone the wrong entity.

    • Improve query cache hit rate by not starting queries locally when the preferred nodes are down, if the local node has just started — as there is a fair chance the preferred nodes will show up shortly too.

    • Fixed a bug that exporting a package with dashboard parameters would not set the correct name space for a saved query called in a parameter.

    • Fixed a bug in upper() and lower() functions which could cause its output to be corrupted (in cases where no characters had been changed).

    • Fixed a bug that exporting a package using a saved query with spaces in the name would not export the correct name.

    • Query scheduling now tracks cost spent across queries for each user and tends to select next task so that users (rather than queries) each get a fair share of available CPU time.

    • Handle inconsistencies in the global entities file gracefully rather than crashing.

    • Fixed a bug in parseJson which resulted in failed JSON parsing if an object contained an empty key ("").

    • Fixed an issue where some parts of regexes did not shown in the parser editor.

Humio Server 1.20.1 Stable (2021-02-01)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.20.1Stable2021-02-012022-02-011.16.0NoNo
JAR ChecksumValue
MD55f2ccaea9f97572ec047be936d7ff0de
SHA15e434cc0df8b437a3974be645e80c3f2c56ec78a
SHA25674f2fcf3d5d2bc5b1e5830d98a03512395ac7beb6456bf754e69e48e89e1d7cf
SHA51216a58326069b3dd9e401688627e62e825249654501f63c939d245c6b501bd683c7682a634f9cb0265c17029ac8b7cdf038e57daa27a57478980115bce18c53ce

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.1. In case you need to do a rollback, this can also only happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Minor fix to Humio internal JSON logging when using the configuration HUMIO_LOG4J_CONFIGURATION=log4j2-json-stdout.xml

Humio Server 1.20.0 Stable (2021-01-28)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.20.0Stable2021-01-282022-01-281.16.0NoYes
JAR ChecksumValue
MD5095aa44f1cbaf9cdffc9753286206248
SHA1fd4eb8cc488d18e7fedff3af212a9919d399b256
SHA25679868d79d893ebb3114208e5e7f64d20ded44b76f4342b3b2d932df6288c927e
SHA5129b91b51b21654ec1961ee9ba31193ad5511850cdb3623d82403356191535a74febeb51a49fb711438408898fe4222f2522f3c37b33c81c75091b6a415c2f0924

Important Information about Upgrading

This release promotes the latest 1.19 release from preview to stable.

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.0. In case you need to do a rollback, this can also only happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

This version introduces Humio packages - a way of bundling and sharing assets such as dashboards and parsers. You can create your own packages to keep your Humio assets in Git or create utility packages that can be installed in multiple repositories. All assets can be serialized to YAML files (like what has been possible for dashboards for a while). With tight integration with Humio's CLI humioctl you can install packages from local disk, URL, or directly from a Github repository. Packages are still in beta, but we encourage you do start creating packages yourself, and sharing them with the community. At Humio we are also very interested in talking with package authors about getting your packages on our upcoming marketplace.

Read more about packages on our package documentation.

With the introduction of Humio packages we have created the application Humio Insights. The application is a collection of dashboards and saved searches making it possible to monitor and observe a Humio cluster.

The new query editor has a much better integration with Humio's query language. It will give you suggestions as you type, and gives you inline errors if you make a mistake. We will continue to improve the capabilities of the query editor to be aware of fields, saved queries, and other contextual information.

A new function called test() has been added for convenience. What used to be done like: tmp := <expression> | tmp=true can now be done using: test( <expression> ). Inside <expression> field names appearing on the right hand side of an equality test, such as field1==field2 compares the values of the two fields. When comparing using = at top-level field1=field2 compares the value of field1 against the string "field2". This distinction is a cause of confusion for some users, and using test() simplifies that.

We have made small changes to how Humio logs internally. We did this to better support the new Humio Insights Application. We have tried to keep the changes as small and compatible as possible, but we have made some changes that can break existing searches in the humio repository (or other repositories receiving Humio logs). We made these changes as we think they are important in order to improve things moving forward. One of the benefits is the new Humio Insights Application. Read more about the details internal logging.

To see more details, go through the individual 1.19.x release notes (links in the changelog).

Bug Fixes

  • Other

    • Fixed an issue causing the secondary storage transfer job to plan more segments for transfer than necessary.

    • Segment download timeout raised from 120s to 1.0s. Avoids situations where large segments could not be moved around a cluster.

    • Fixed a bug where merged segments could grow too large if the source events were large.

    • Enable Package marketplace (in beta)

    • Major changes (see version 1.19.0 release notes)

Humio Server 1.19.2 Preview (2021-01-25)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.19.2Preview2021-01-252021-01-281.16.0NoNo
JAR ChecksumValue
MD501e72a42b56685f50111466e91475e9b
SHA17d09c09579a2c00cb2cc0a38c421969861f9c6a0
SHA25683e7efdf3bd38eb806b30c81603e4eefe5ee17f88fa9c6440fd56d11c86d2869
SHA5123ccc62d52899ecad9fd7626bb15f90b05bcabaf761d997c4aa63849f93702c6caf32d1f6ed191c981054c1df853ec6fbcdbd07fba0e76e289d4f71d39b542d9b

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.19.2 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.19.2. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Fixed an issue for on-prem users not on multitenant setup by reverted a metric change introduced in 1.18.0, jmx and Slf4j included an OrgId in all metrics for repositories.

    • Fixed automatic installation of Humio Insights package to the humio repository

Humio Server 1.19.1 Preview (2021-01-19)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.19.1Preview2021-01-192021-01-281.16.0NoNo
JAR ChecksumValue
MD57ba0f9e286f6933cb19b49be72df8078
SHA1489be0b931419cd128d5a03e2b2fbce819095257
SHA2562f8a22da0e6f85c4cd4479367635ad9c0a0586f2fc69df55533e349e3ea29bab
SHA512b306f424ae1425145a382be5847e46f6f56d91777202ef94117c755be5f713dab787ae6da2a4acd0091d04d07d75b3b4154185eab5327f8db558071d1b4d301f

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.19.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.19.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Update dependencies with known vulnerabilities

    • Fixed bug in a saved query in the Humio Insights package

    • Do not cache cancelled queries.

    • Do not retry a query when getting a HTTP .0 error

    • Fixed bug where the format() function produced wrong output for some floating-point numbers

    • Fixed an issue - Do not delete datasource before the segments have been deleted also in bucket storage if present there.

Humio Server 1.19.0 Preview (2021-01-14)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.19.0Preview2021-01-142021-01-281.16.0NoYes
JAR ChecksumValue
MD563d03b5a7d362d1d9a5dfcb5a7d6fcea
SHA17ed7776a690ff76afd4ff77ac585a28ef7ee1b2c
SHA256532dd54bc612b6f771a142899277430469a85c3a431a7824105c1ab69d21974e
SHA5129edc286d2409cdf36496cc9a7c69ab525ac3207006f1ce3aa194bd17e59e4601f676dbdec0c71cfecd197364b45d83398e5566cebbed82e0a10e1d19ae2e91eb

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.19.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.19.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Fixed a bug where fullscreen mode could end up blank

    • The function parseCEF() now deals with extension fields with labels, i.e. cs1=Value cs1Label=Key becomes cef.label.Key=Value.

    • Custom made saved queries, alerts and dashboards in the humio repository searching for events of the kinds metrics, requests or nonsensitive may need to be modified. This is described in more detail in the Internal Logging documentation.

    • New feature: "stateless Ingest-only nodes": A node that the rest of the cluster does not know exists, but is capable of ingesting events into the ingest queue. Enable using NODE_ROLES=ingestonly.

    • New feature "Event forwarding" making it possible to forward events during ingest out of Humio to a Kafka server. See Event Forwarding documentation. Currently only available for on-prem customers.

    • New config AUTO_UPDATE_MAXMIND for enabling/disabling updating of all maxmind databases. Deprecates AUTO_UPDATE_IP_LOCATION_DB, but old config will continue to work.

    • Add an error message to the event if the user is trying to redirect it to another repo using #repo, and the target repo is invalid.

    • In the GraphQL API, the value ChangeAlertsAndNotifiers on the Permission enum has been deprecated and will be removed in a later release. It has been replaced by the ChangeTriggersAndActions value. The same is true for the ViewAction enum. On the ViewPermissionsType type, the administerAlertsfield has been deprecated and will be removed in a later release. It has been replaced by the administerTriggersAndActions field.

    • unit on timechart (and bucket) now works also when the function within uses nesting and anonymous pipelines.

    • Fixed an issue where the filter and groupBy buttons on the search page would not restart the search automatically

    • New config MAXMIND_IP_LOCATION_EDITION_ID for selecting the maxmind edition of the IP location database. Deprecates MAXMIND_EDITION_ID, but old config will continue to work.

    • The configuration option IP_FILTER_NOTIFIERS has been renamed to IP_FILTER_ACTIONS. The old name will continue to work.

    • When a host dies and Humio reassigns digest, it will warn if a fallback host is picked that is in the same zone as existing replicas. Eliminate warning if falling back to a host in the null zone.

    • "Notifiers" have been renamed to "actions" throughout the UI and in log statements. The REST APIs have not been changed and all message templates can still be used.

    • New ingest endpoint /api/v1/ingest/raw for ingesting singular webcalls as events. See Ingest API - Raw Data documentation.

    • Added config option for Auth0 based sign on method: AUTH_ALLOW_SIGNUP defaults to true. The config is forwarded to the auth0 configuration for the lock widget setting: allowSignUp

    • Fixed timeout issue in S3 Archiving

    • New filter function test( <boolean expression> ) makes it convenient to test complex expressions.

    • Improved app loading logic.

    • Fixed an issue causing the secondary storage transfer job to select and queue too many segments for transfer at once. The job will now stop and recalculate the bulk to transfer periodically.

    • Fixed a rare issue where a node that was previously assigned digest could write a segment to global, even though it was no longer assigned the associated partition.

    • Fixed an issue causing queries using kvParse() to be executed incorrectly in certain circumstances when kvParse() assigned fields starting with a non-alphanumeric character.

    • Added asn function for retrieving the ASN number for a given IP address, see asn() reference page.

    • Fixed an issue where unit-conversion (by timechart) did not take effect through groupBy() and window().

    • Made cluster nodes log their own version as well as the versions of all other nodes. This makes it easier to tell which versions are running in the cluster.

    • Improve handling of broken local cache files

    • New feature "Custom ingest tokens" making it possible for root users to create ingest tokens with a custom string.

    • The transfer job will delete primary copies shortly after transferring the segments to secondary storage. The copies would previously only be deleted once a full bulk had been moved.

    • Fixed an issue where segment merge occasionally reported BrokenSegmentException when merging, while the segments where not broken.

    • Humio will only allow using Zookeeper for node id assignment (ZOOKEEPER_URL_FOR_NODE_UUID) when configured for ephemeral disks (USING_EPHEMERAL_DISKS). When using persistent disks, there is no need for the extra complexity added by Zookeeper.

    • Fixed an issue with the cidr function that would make some IPv4 subnets accept IPv6 addresses and some strings that were not valid IP addresses.

    • The Humio Repository action (formerly notifier) now replaces a prefix '#' character in field names with @tag. so that #source becomes @tag.source. This is done to make them searchable in Humio. You can change the name by creating a custom parser. See related documentation for more details.

    • Reduce contention on the query scheduler input queue. It was previously possible for large queries to prevent each other from starting, leading to timeouts.

    • Humio no longer deletes an existing humio-search-all view if the CREATE_HUMIO_SEARCH_ALL environment variable is false. The view instead becomes deleteable via the admin page.

    • For ingest using a URL with a repository name in it, Humio now fails ingest if the repository in the URL does not match the repository of the ingest token. Previously, it would just use the repository of the ingest token.

    • Updated the permission checks when polling queries. This will results in dashboard links "created by users who are either deleted or lost permissions to the view" to get unauthorized. To list all dashboard links, run this graphql query as root: query { searchDomains {dashboards { readOnlyTokens { createdBy name token } } } }

    • API Changes (Non-Documented API): Queries and Mutations for Parser now expects an id field in place of a name field, when fetching and updating parsers.

    • The configuration option HTTP_PROXY_ALLOW_NOTIFIERS_NOT_USE has been renamed to HTTP_PROXY_ALLOW_ACTIONS_NOT_USE. The old name will continue to work.

    • Make the query functions window() and series() be enabled by default. They can be disabled by setting the configuration options WINDOW_ENABLED and SERIES_ENABLED to false, respectively.

    • Fixed an issue where canceling queries could produce a spurious error log.

    • Fixed an issue causing Humio to retain deleted minisegments in global for longer than expected.

    • Removed config IDLE_POLL_TIME_BEFORE_DASHBOARD_QUERY_IS_CANCELLED_MINUTES. Queries on dashboards now have the same life cycle as other queries.

    • Fixed an issue where the segment rewrite job handling event deletion might rewrite segments sooner than configured.

    • The built-in bro-json parser is deprecated and will be removed in a later release. It has been replaced by an identical parser with the name zeek-json, see zeek-json.

    • Fixed an issue which caused free-text-search to not work correctly for large (>64KB) events.

    • Fixed an issue with updating user profile, in some situations save failed.

    • API Changes (Non-Documented API): Getting Alert by ID has been moved to a field on the SearchDomain type.

    • Renamed LOG4J_CONFIGURATION environment variable to HUMIO_LOG4J_CONFIGURATION. See Configuration reference pages. The old variable will no longer work.

    • Fixed crash in CleanupDatasourceFilesJob when examining a file size fails due to that file being deleted concurrently.

    • Introduced humio insights package that is installed per default on startup on the humio repository

    • No longer overwrite the humio parser in the humio repository on startup.

    • Fixed an issue that could cause node id assignment to fail when running on ephemeral disks and using Zookeeper for node id assignment. Nodes in this configuration will now try to pick a new id if their old id has been acquired by another node.

    • Cluster management stats now shows segments as underreplicated if they are replicated to enough hosts, but are not present on all configured hosts.

    • Introduction of the new log file humio-requests.log. Also the log format for the files humio-metrics.log and humio-nonsensitive.log has changed as described above. The guide for sending Humio logs to another Humio cluster has been updated.

    • New config QUERY_QUOTA_EXCEEDED_PENALTY with value 50 by default. When set >= 1.0 then this throttles queries from users that are over their quota by this factor rather than stopping their queries. Set to 0 to disable and revert to stopping queries.

    • In the GraphQL API, on the Alert type, the notifiers field has been deprecated and will be removed in a later release. It has been replaced by the actions field.

    • Added mutation to update the runAsUser for a read only dashboard token.

    • The names of the metadata fields added by the Humio Repository action (formerly notifier) has been changed to accomodate that it can now also be used from scheduled searches. See related documentation for more details.

    • Fixed bug where repeating queries would not validate in alerts.

    • Fixed an rare issue where the digest coordinator would assign digest fewer hosts than configured.

    • API Changes (Non-Documented API): getFileContent has been moved to a field on the SearchDomain type.

    • New feature "Scheduled Searches" making it possible to run queries on a schedule and trigger actions (formerly notifiers) upon query results. See documentation.

    • Raised the parser test character length to .00.

    • New function hash for computing hashes of fields. See hash() reference page.

    • Upgraded Log4j2 from 2.13.3 to 2.14.0.

    • Reduced the number of writes to global on restart, due to merge targets not being properly reused.

    • Added timeout for TCP ingest listeners. By default the connection is closed if no data is received after 5 minutes. This can be changed by setting TCP_INGEST_MAX_TIMEOUT_SECONDS. See Ingest Listeners documentation.

    • Fixed an issue causing queries using kvParse() to filter out too much in specific circumstances when filtering on a field assigned before kvParse().

    • New validation when creating an ingest token using the API that the parser, if specified, actually exists in the repository.

    • Kafka client inside Humio has been bumped from 2.4.1 to 2.6.0.

    • The built-in json-for-notifier parser used by the Humio Repository action (formerly notifier) is deprecated and will be removed in a later release. It has been replaced by an identical parser with the name json-for-action, see documentation.

    • Raised the limit for note widget text length to .00

    • Fixed logic for when the organization owner panel should be shown in the User's Danger zone.

Humio Server 1.18.4 Stable (2021-01-25)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.18.4Stable2021-01-252022-01-251.16.0NoNo
JAR ChecksumValue
MD5d6d2999c1640e0b922b79163c9ec83b5
SHA1a0452151aaa9437a2d4f772f23d3f817080d015c
SHA256b786cb7edf1d2b8729a44ff73ce8239688aefd2431940d283a15537b3be01b37
SHA512cfce44d51dce08213bfc26f5bd74cf3596185bc15e87518f63cf9b601f0e8118923d61afa17770827cd1fae6547a5d11decdacc9cffb57f95f0f3b351151632d

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.4 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.18.4. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Fixed an issue for on-prem users not on multitenant setup by reverted a metric change introduced in 1.18.0, jmx and Slf4j included an OrgId in all metrics for repositories.

Humio Server 1.18.3 Stable (2021-01-20)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.18.3Stable2021-01-202022-01-201.16.0NoNo
JAR ChecksumValue
MD52db608cedd7603e6cd595c58aa9fad5d
SHA1ea622d5f1a706daa3c6345bc1237918836498f9f
SHA25600f4f144647918d42cf85cb26ece7c0529a76af02d6a56dd483ada74b8028816
SHA5122335597bf91028e1b476178039e15b47645cca2f8dfdf445514e279133a042ed44a5450c9456710a9843279d431b37fff85ba4c41abab56780d8923e81e6dcc9

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.3 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.18.3. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Do not cache cancelled queries.

    • Fixed bug where the format() function produced wrong output for some floating-point numbers

    • Update dependencies with known vulnerabilities

    • Do not retry a query when getting a HTTP .0 error

Humio Server 1.18.2 Stable (2021-01-08)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.18.2Stable2021-01-082022-01-081.16.0NoNo
JAR ChecksumValue
MD5325cfefc1a6eef3b4f9d1e6beeb5a53a
SHA1a8af4a4a70c93cb6ff945c999bd0e6ea579d1a2a
SHA256f2201aab5190ec92b540bc8be9b6ea59c2e840fece63b2d87891aff9d7fc284a
SHA5128a1e56622041d45db967e6aa003da14fb78143fc63d3dfb936e318d385761f8a10a57823040d68b8f200048fc28006df1d281e74baad1bcdef080334a8634af5

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.2 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.18.2. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Fixed bug so as to reduce contention on the Query input queue.

    • Improves handling when many transfers to secondary storage are pending.

    • Adds a new configuration option for auth0: AUTH_ALLOW_SIGNUP. Default value is true.

    • Fixed bug where Humio could end in a corrupted state, needing manual intervention before working again.

    • Resolves problem when starting a query spanning very large data sets, a time-out could prevent the browser from getting responses initially.

Humio Server 1.18.1 Stable (2020-12-17)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.18.1Stable2020-12-172021-12-171.16.0NoNo
JAR ChecksumValue
MD523a1b98323ea040221d9314e181f5048
SHA12364af27ee4d0e12ff3732252e31aceaa12534a9
SHA2569f83caa9a0aa483087c28e083fb10e2d418c9f66c109abe0b7464dd312d3e873
SHA512682242210795e8b72f82589a01a3933072c7b744a8abdc54adca3964d08c32f02504e86abd44639278cf104d79587f8b0d0b89b807fc3ba321e04c3644c6dfab

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.18.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to an earlier release can result in data loss.

Bug Fixes

  • Other

    • Improve handling of a node being missing from the cluster for a long time by letting other nodes handle the parts of the query that node would normally do.

    • Fixes a bug where the to parameter to unit:convert would cause internal server errors instead of validation errors.

    • Only install default Humio parser to the Humio view if it is missing. No longer overwriting local changes.

    • Fixes a bug where some valid repeating queries would not validate in alerts

    • Fixes a bug where a query would not start automatically when requesting to filter or group by a value.

    • Increase number of vCPUs used when parsing TCP ingest, twice the number of the 1.18.0 build.

    • Fixes a bug where queries with @timestamp=x where x was a timestamp with the current search interval could fail

    • Add GraphQL mutation to update the runAsUser for a read only dashboard token.

    • Add non-sensitive logging that lists the versions of Humio running in the cluster. These logs can be found by searching the Humio debug log for "cluster_versions".

    • Fixes a bug that would allow users with read access to be able to delete a file (#10133)

    • Fixes a bug where the merge of mini segments could fail during sampling of input for compression.

    • Fixes a bug where top([a,b], sum=f) ignored events where f was not a positive integer. Now it ignores negative and non-numerical input but rounds decimal numbers to integer value.

    • Improve performance of S3 archiving when many repositories have the feature enabled.

    • Fixes a bug where the permissions check on editing a connection from a view to a repository allowed altering the search prefix of connections other than the one the user currently was allowed to edit.

Humio Server 1.18.0 Stable (2020-11-26)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.18.0Stable2020-11-262021-11-261.16.0NoYes
JAR ChecksumValue
MD50525cf2284207efde5655fd9174c411f
SHA19d28fc3e60a033c27746584ac10fd5abedb2af69
SHA2565f2a5cfa60bc13c859caa2e07a1dbd3a907d15483cc7d5829d02646f8350d61c
SHA512be22b5126137fa75d0d5ac5a870c716fadee85155bb58822d710397e633de9acbb060c7500f46031a3996e826c5d3b3ee5c0b0c1d572b3944f1be5ebc05cffca

Important Information about Upgrading

This release promotes the latest 1.17 release from preview to stable.

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.18.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to an earlier release can result in data loss.

Humio can now run repeating queries using the beta:repeating() function. These are live queries that are implemented by repeatedly making a query. This allows using functions in alerts and dashboards that typically do not work in live queries, such as selfJoin() or selfJoinFilter(). See the beta:repeating() reference page for more information.

In order to prevent alert notifiers being used to probe services on the internal network (eg. Zookeeper or the AWS metadata service), Humio now has an IP filter on alert notifiers. The default is to block access to all link-local addresses and any addresses on the internal network; however, you can opt-in to the old behavior by setting the configuration option IP_FILTER_NOTIFIERS to allow all. See IP Filter documentation.

New Experimental Query Function series()

A new experimental query function called series() has been added. It needs to be explicitly enabled on the cluster using the config option SERIES_ENABLED=true.

The function series() improves upon session() and collect() for grouping events into transactions. What used to be done with: groupby(id, function=session(function=collect([fields, ...]))) can now be done using: groupby(id, function=series([fields, ..])).

See series() reference page for more details.

This new feature stores a copy of live search results to the local disk in the server nodes, and reuses the relevant parts of that cached result when an identical live search is later started. Caching is controlled with the config option QUERY_CACHE_MIN_COST, which has a default value of .0. To disable caching, set the config option to a very high number, such as 9223372036854775807 (max long value).

To see more details, go through the individual 1.17.x release notes (links in the changelog).

Bug Fixes

  • Other

    • Fixed a bug where TCP listener threads could take all resources from HTTP threads

    • Changed behaviour when the config ZONE is set to the empty string. It is now considered the same as omitting ZONE.

    • Major changes (see 1.17.0 release notes)

    • Removed config IDLE_POLL_TIME_BEFORE_DASHBOARD_QUERY_IS_CANCELLED_MINUTES. Queries on dashboards now have the same life cycle as other queries.

Humio Server 1.17.0 Preview (2020-11-18)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.17.0Preview2020-11-182020-11-261.16.0NoYes
JAR ChecksumValue
MD59c47009810132eb67177966d10471544
SHA1341a2607265420b1a2d461ad111c88aca06419ed
SHA25659001d9a738930f8774c11864ce3c36b3b4b4003f8cad0d4b36af13275ceefa9
SHA512ee8e2837a8fba2b28aab8d18b16269f452f19a5c80ad9826ecbeb73eaa062236acdf2191cc448e60d81390f1a2881374637adce7603ebf9f0861ca6246f6c82f

Important Information about Upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.17.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.17.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to earlier release can result in data loss.

Humio can now run repeating queries using the beta:repeating() function. These are live queries that are implemented by repeatedly making a query. This allows using functions in alerts and dashboards that typically do not work in live queries, such as selfJoin() or selfJoinFilter(). See the beta:repeating() reference page for more information.

In order to prevent alert notifiers being used to probe services on the internal network (eg. Zookeeper or the AWS metadata service), Humio now has an IP filter on alert notifiers. The default is to block access to all link-local addresses and any addresses on the internal network; however, you can opt-in to the old behavior by setting the configuration option IP_FILTER_NOTIFIERS to allow all. See IP Filter documentation.

New Experimental Query Function series()

A new experimental query function called series() has been added. It needs to be explicitly enabled on the cluster using the config option SERIES_ENABLED=true.

The function series() improves upon session() and collect() for grouping events into transactions. What used to be done with groupby(id, function=session(function=collect([fields, ...]))) can now be done using groupby(id, function=series([fields, ..])).

See series() reference page for more details.

This new feature stores a copy of live search results to the local disk in the server nodes, and reuses the relevant parts of that cached result when an identical live search is later started. Caching is controlled with the config option QUERY_CACHE_MIN_COST, which has a default value of .0. To disable caching, set the config option to a very high number, such as 9223372036854775807 (max long value).

Bug Fixes

  • Other

    • Fixes a bug causing sort()/head()/tail() to work incorrectly after other aggregating functions.

    • New config option ALERT_DESPITE_WARNINGS makes it possible to trigger alerts even when warnings occur.

    • Crash the node if an exception occurs while reading from the global Kafka topic, rather than trying to recover.

    • API Changes (Non-Documented API): Saved Query REST API has been replaced by GraphQL.

    • Changed default TLS ciphers and protocols accepted by Humio, see TLS Configuration reference page.

    • The {events_html} notifier template will now respect the field order from the query.

    • Fixes a bug causing join() to not work after an aggregating function.

    • Reduce the max fetch size for Kafka requests, as the previous size would sometimes lead to request timeouts.

    • Fix several cases where Humio might attempt to write a message to Kafka larger than what Kafka will allow.

    • Switch from JDK to BouncyCastle provider for AES decrypt to reduce memory usage.

    • Setting the default query for a view in the UI has been moved from the "Save as Query" to the View's "Settings" tab.

    • Fixes the issue where Humio could behave incompatibly with Kafka versions prior to 2.3.0 if KAFKA_MANAGED_BY_HUMIO was true.

    • New config option IP_FILTER_NOTIFIERS, to set up IP filters for Alert Notifications, see IP Filter reference page.

    • Fixes a bug where unit:convert couldn't handle numbers in scientific notation.

    • The Humio-search-all view will no longer be removed if CREATE_HUMIO_SEARCH_ALL is set to false. The view will instead become possible to delete manually via the admin UI.

    • Fix negating join expressions.

    • API Changes (Non-Documented API): View Settings REST API has been replaced by GraphQL.

    • Reduce the number of merge target updates Humio will write to global on digest leader reassignment or reboot.

    • Fixes a bug where join function in some circumstances would fetch subquery results from other cluster nodes more than once.

    • Improve logic attempting to ensure other live nodes can act as substitutes in case the preferred digest nodes are not available when writing new segments.

    • New query function parseCEF used to parse events which are formatted according to the Common Event Format(CEF), see parseCEF().

    • Rename a few scheduler threads so they reflect whether they're associated with streaming queries ("streaming-scheduler") or not ("normal-scheduler")

    • Periodically release object pools used by mapper pipeline, to avoid a possible source of memory leaks.

    • New query function concatArray, see concatArray() reference apge.

    • Refuse to boot if the global topic in Kafka does not contain the expected starting offset.

    • Fixes a bug causing the sub-queries of join() etc. to not see events with an @ingesttimestamp occurring later than the search time interval.

    • Refuse to boot if the booting node would cause violations of the "Minimum previous Humio version" as listed in the release notes.

    • It is again possible to override a built-in parser in a repository by creating a parser with the same name.

    • New experimental query function beta:repeating(), see beta:repeating() reference page.

    • Allow running Humio on JDK-14 and JDK-15 to allow testing these new builds.

    • New config option DEFAULT_MAX_NUMBER_OF_GLOBALDATA_DUMPS_TO_KEEP.

    • Fixes the case where Humio would consider local node state when deciding which ingest data was safe to delete from Kafka.

    • Tweaked location of diagnostics regarding missing function arguments.

    • Free-text search has been fixed to behave more in line with the specification.

    • Fixes an issue causing Humio to fail to upload files to bucket storage in rare cases.

    • New experimental query function window(), enabled by config option WINDOW_ENABLED=true, see window() reference page.

    • If KAFKA_MANAGED_BY_HUMIO is true, Humio will ensure unclean leader election is disabled on the global-events topic.

    • The notifier list is sorted when selecting notifiers for an alert.

    • New experimental query function series(), enabled by config option SERIES_ENABLED=true, see series() reference page.

    • Fixes an issue which caused free-text-search to not work correctly for large (>64KB) events.

    • Fixes an issue where Humio might try to get admin access to Kafka when KAFKA_MANAGED_BY_HUMIO was false.

    • Fixes the case where datasources receiving data might not be marked idle, causing Humio to retain too much ingest data in Kafka.

    • New config option ENABLE_ALERTS makes it possible to disable alerts from running (enabled by default).

    • New query function parameter to parseJson, removePrefixes, see parseJson() reference page.

    • Improved wording of diagnostics regarding function arguments.

Humio Server 1.16.4 Stable (2020-11-26)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.16.4Stable2020-11-262021-11-261.12.0NoNo
JAR ChecksumValue
MD5d83c60916b9cb3c12501c541253b5aee
SHA1fa164160b4874f1f1524ff61d49584a62c471868
SHA256362d0640d4673b985c6ad9fcdcac7404dc127a65d33d0d423d15e20a5478c642
SHA5121803bf4fa4cd533e7fd569584cd9d5ae86d649dfccbf92fdd6cf3eae6155fee9baf40ab7d252681e84ea4045264b5408cc9144fa0d6ef3b0a8a9b631cfdce45c

Many bug fixes: related to join( ), TCP listerner threads, etc.

Bug Fixes

  • Summary

    • Fix negating join expressions.

    • Fixed a bug where the {events_html} message template was formatted as raw HTML in alert emails.

    • Fixed a bug causing the sub-queries of join etc. not to see events with an @ingesttimestamp occurring later than the search time interval.

    • Fixed an issue causing Humio to fail to upload files to bucket storage in rare cases.

    • Switched from JDK to BouncyCastle provider for AES decrypt to reduce memory usage.

    • Fixed an issue preventing the metric datasource-count from counting datasources correctly.

    • Fixed a bug where TCP listener threads could take all resources from HTTP threads.

    • Fixed a bug causing sort`/`head`/`tail to work incorrectly after other aggregating functions.

Humio Server 1.16.3 Stable (2020-11-10)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.16.3Stable2020-11-102021-11-101.12.0NoNo
JAR ChecksumValue
MD5294a84c0d1a54ccb83045af2a59a711e
SHA174088d0dcce3e2e853d236e00d18af18ad06c0e6
SHA2568bd243f29dbafa1ece847aff22ce9754b3ec3fd6fe8726d1517ed5462c5653fe
SHA512ad95a600b21990508e9e174273726b8c2514b2a0f688bf45422394971375c0ad8821626ca6ca7672faffd41e4b2f80a62c357e581cdc6b34f4c482ddb5389410

Improved memory usage of some query functions, and fixes problems with datasource cleanup, resource usage of HTTP requests, and with large free-text searches.

Bug Fixes

  • Summary

    • Fixed an issue where cleanup of empty datasource directories could race with other parts of the system and cause issues.

    • Reduce memory usage when using the match( ) or regex( ) query functions.

    • Fixed an issue when starting a query, where resources related to HTTP requests were not released in a timely manner, causing an error log when the resources were released by hitting a timeout.

    • Fixed an issue which caused free-text-search to not work correctly for large (>64KB) events.

Humio Server 1.16.2 Stable (2020-10-30)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.16.2Stable2020-10-302021-10-301.12.0NoNo
JAR ChecksumValue
MD5625e7c2ab7d9ae2ad61c6b5a6847e0ec
SHA1092049bbc1604af6fd2e0a6b8f6f53fe7f6132ae
SHA2563850217dcbda7666178a475fcf135b3c94715ef83a4b66236921b3bb2ee4c2f9
SHA512d7aec9e4c0bdd6102ce56df5dbac36cb896182c987b1cb8c84d1065610ed78e9e519bce7ef94b784412fa8946b63bfe51f6ef78071b60e59e955588c22ccf6d4

Improved delete options in large clusters, and fix problems with generating http links.

Bug Fixes

  • Summary

    • Optimize how certain delete operations in the global database are performed to improve performance in large clusters.

    • Prevent automatic URL to link conversion in email clients.

Humio Server 1.16.1 Stable (2020-10-21)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.16.1Stable2020-10-212021-10-211.12.0NoNo
JAR ChecksumValue
MD5f5a2ac232db869d279159781ba5cdf57
SHA1e165eff2f323df2702e8eb697602739ad8e71af8
SHA256eda9a02789d70732451e0bdd01a329ca878a39dc160c95c3902acc5db693f22b
SHA512aa13e65ce4b6896aaecfeb8dcb3996681d7014bacde126045c01d230c8f3b75a34a594653b9b7785ee8c4417a71df1908263c2931c8806893db30293780e1bf4

Several bug fixes related to Humio UI, Prometheus, Clusters, RegEx queries, etc. — as well as improved GroupBy( ), jvm-hiccup, etc.

Bug Fixes

  • Summary

    • Convert some non-fatal logs to warning level instead of error.

    • Add query parameter sanitization for login and signup pages.

    • Fixed an issue with truncating files on the XFS file system, leading to excess data usage.

    • Fixed an issue where missing input validation in alerts could lead to HTML injection in email notifications.

    • Fixed an issue where RegEx field extraction did not work in a query.

    • Improved the performance for GroupBy( ).

    • HTML sanitization for user fields in invitation mails.

    • Raise time to wait until deleting data to improve handling of node failures.

    • Log information about sorting of snapshots.

    • Avoid logging the license key.

    • Ensure metric label names can be sent to Prometheus.

    • Added new metric jvm-hiccup for measuring stalls/pauses in the JVM.

    • Returning bad request when hitting authentication endpoint without a provider id.

    • Fixed an issue where it was impossible to bootstrap a new cluster if ingest or storage replication factors had been configured greater than 1.

    • Fixed an issue where errors were not properly shown in the Humio UI.

    • Fixed an issue where sorting of work in the Humio input could end up being wrong.

Humio Server 1.16.0 Stable (2020-10-09)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.16.0Stable2020-10-092021-10-091.12.0NoNo
JAR ChecksumValue
MD541a3eb30f6d92f92b414661545f0c8bc
SHA131829cf2558430a4a6f170d4adf00573f7a7db08
SHA256f04127a4195e8e1e576bc9a32e9b582b48ffb6eb3fdbc368b4f2c0e2fc22e1c6
SHA51245e067a2b79618e979e9839cb987ce6bd76a27514a0d3da22dd3e9b5259f48b8b75c5c9730078ccba81f10516a456b733956bc48bdec6c9bd5adb9dd0de13363

This release promotes the latest 1.15 release from preview to stable. To see more details, go through the individual 1.15.x release notes (links in the changelog).

Humio will set ingest timestamps on all events. This is set in the field named @ingesttimestamp. In later versions, Humio will also support specifying the search time interval using @ingesttimestamp when searching. This will support use cases where data is backfilled etc.

Field based throttling: It is now possible to make an alert throttle based on a field, so that new values for the field trigger the alert, but already seen values do not until the throttle period has elapsed.

Notifier logging to a Humio repository: It is now possible to configure an alert notifier that will log all events to a Humio repository.

Slack notifier upgrade to notify multiple Slack channels: It is now possible to use the Slack notifier to notify multiple Slack channels at once.

Events as HTML table: In an email notifier, it is now possible to format the events as an HTML table using the new message template {events_html}. Currently, the order of the columns is not well-defined. This problem will be fixed in the 1.17.0 release.

Configure notifier to not use the internet proxy: It is now possible to configure an alert notifier to not use the HTTP proxy configured in Humio.

Redesigned signup and login pages. For cloud, we have have split the behavior so users have to explicitly either login or signup.

Invite flow: When adding a user to Humio they will now by default get an email telling them that they have been invited to use Humio.

Configure Humio to not use the internet proxy for S3: It is now possible to configure Humio to not use the globally configured HTTP proxy for communcation with S3.

Auto-Balanced Partition Table Suggestions

When changing digest and storage partitions it is now possible to get auto-balanced suggestions based on node zone and replication factor settings (via ZONE, DIGEST_REPLICATION_FACTOR and STORAGE_REPLICATION_FACTOR configurations). See Configuration reference pages.

The AWS SDK Humio uses has been upgraded to v2. When configuring Humio bucket storage with Java system properties, the access key must now be in the aws.secretAccessKey property instead of the aws.secretKey property.

Bug Fixes

  • Other

    • Fixed a problem where the Zone configuration would not be propagated correctly.

    • Fixed a problem where errors would not be shown in the UI

    • Other changes: (see 1.15.1 release notes)

    • Support for license files in ES512 format.

    • Add view to log lines for alerts

    • Fixed a problem preventing file export/download from the search page.

    • Improved merging of segments by evaluating less data.

    • Fixed an issue where Humio could behave incompatibly with Kafka versions prior to 2.3.0 if KAFKA_MANAGED_BY_HUMIO was true.

    • Fixed a problem with the retention job calculating what segments to delete.

    • Fixed several cases where Humio might attempt to write a larger message to Kafka than what Kafka allows.

    • Added metrics for:

      • JVM Garbage Collection

      • JVM Memory usage

      • Missing nodes count

    • Fixed a problem preventing saved queries from being edited.

    • Log query total cost when logging query information.

    • Added background job to fix problems with inconsistent data in global.

    • Log Humio cluster version in non-sensitive log.

    • Bulk Global operations for segments in S3 to avoid overloading Kafka with writes.

    • Fixed a problem where some deleted segments could show up as missing.

    • Fixed a problem with auto sharding not working when two repositories had the same tags but differing shard counts.

    • Other changes: (see 1.15.2 release notes)

    • Major changes: (see 1.15.0 release notes)

    • Fixed a problem where the QueryScheduler could spend time idling even though there was work to do in situations where digest delays were high.

    • Fixed missing cache update when deleting a view.

    • Fixed a problem where it was not possible to rename a dashboard.

    • Changed limits for what can be fetched via HTTP from inside Humio.

Humio Server 1.15.2 Preview (2020-09-29)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.15.2Preview2020-09-292020-10-091.12.0NoNo
JAR ChecksumValue
MD5682ce1370121f12351ade4d22aac9d59
SHA14b0a7d089cadc867582ab067e80ccbaa421d6869
SHA25664179665b0993212736c526d4c9e5af57511d2225673646c6de9f54c6685e9f9
SHA5123d63d22285b955637128bfaaf8223e4f59c32a92b66180997307b22cdda6d360c2436f0b63fb55ee57b52cdb34a0b0ddc2ad28f4db9d63ae62e10c8f0846dc80

Many bug fixes, including fixes related to login from Safari and Firefox, the join( ) function.

Bug Fixes

  • Summary

    • Improved handling of sub-queries polling state from the main query when using join().

    • Fixed a problem where the login link did not work in Safari and Firefox.

    • In the dialog for saving a search as an alert, the save button is no longer always grey and boring, but can actually save alerts again.

    • Fixed an issue where a slow data stream could cause Humio to retain more data in Kafka than necessary, as well as cause a restarted Humio node to reprocess too much data.

    • Generate ingest tokens in UUID format, replacing the current format for any new tokens being created.

    • Fixed a memory leak when authenticating in AWS setups.

    • Fixed a bug causing an authentication error when trying to download a file when authenticating by proxy.

    • Added logging to detect issues when truncating finished files.

    • Changed priorities when fetching segments to a node which have been offline for a longer period. This avoids waiting too long before the cluster becomes fully synced.

    • Made the login and sign up pages responsive to the device.

    • Fixed a problem with scrolling on the login page on screens with low resolution.

    • Only consider fully replicated data when calculating which offsets can be pruned from Kafka.

    • Fixed a bug in the partition table optimizer that lead to unbalanced layouts.

    • Avoid overloading kafka with updates for the global database by collecting operations in bulk.

    • Improved naming of threads to get more usable thread dumps.

    • Changed the query scheduling to account for the work of the overall query, rather than per job started. This allows fairer scheduling of queries hitting many dataspaces e.g. when using search-all.

    • Fixed an issue showing duplicate entries when searching for users.

Humio Server 1.15.1 Preview (2020-09-22)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.15.1Preview2020-09-222020-10-091.12.0NoNo
JAR ChecksumValue
MD5ec66230819ad11297969c2f8d6641c6d
SHA1f3b0201a632842dd67f104c325c241b201d246a6
SHA25681de2fd8b1ccc692f30083f0461364155f83b96b893c0cdff4444fbbb97abf32
SHA5122281a3fbf186bd96d56343a7ec46caefcd59fa6656ca8885f841af2ce16c32068739d510b7a0913e9c5db5670948fbf43e998595b8a535246299d7ecd418e21b

Fixes bugs related to AWS and STS tokens, timestamp display results, reverting Humio UI login method.

Bug Fixes

  • Summary

    • Fixed a problem with AWS, where STS tokens would fail to authenticate.

    • Fixed a problem in the UI, where the wrong timestamp was displayed as @ingesttimestamp.

    • The job for updating the IP location database now uses the configured HTTP proxy, if present.

    • Revert login Humio User Interface to same behavior as before version 1.15.0.

Humio Server 1.15.0 Preview (2020-09-15)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.15.0Preview2020-09-152020-10-091.12.0YesYes
JAR ChecksumValue
MD5516ed995115eeaa9218bdbc96aec01b2
SHA179bd7daeaa49644e7d7bcc429862f43c5d028057
SHA25626c95dacd1164ba20db16917dcc436cc8a8f5a86811b697917b6febfae9fbd61
SHA51264841a7ddfcb7c9cff0e7636e78c05c8e52cd63f5c537c858f70795e6dfb5ff52efa8705cf9d3e3fccc1f2ca3901fbae25fb3920fe09f440813f2e587b367173

Improves ingest timestamps, field based throttling, the ability to configure better alert notifiers, Slack notifiers, etc.

Humio will set ingest timestamps on all events. This is set in the field named @ingesttimestamp. In later versions, Humio will also support specifying the search time interval using @ingesttimestamp when searching. This will support use cases where data is backfilled etc.

It is now possible to make an alert throttle based on a field, so that new values for the field trigger the alert, but already seen values do not until the throttle period has elapsed.

Notifier Logging to Humio Repository

It is now possible to configure an alert notifier that will log all events to a Humio repository.

It is now possible to use the Slack notifier to notify multiple slack channels at once.

In an email notifier, it is now possible to format the events as an HTML table using the new message template {events_html}.

Configure Notifier Not to use Internet Proxy

It is now possible to configure an alert notifier to not use the HTTP proxy configured in Humio.

We introduce new signup/login pages for social login and have split the behavior so users have to explicitly either login or signup.

When adding a user to Humio they will now by default get an email telling them that they have been invited to use Humio.

The AWS SDK Humio uses has been upgraded to v2. When configuring Humio bucket storage with Java system properties, the access key must now be in the aws.secretAccessKey property instead of the aws.secretKey property.

Configure Humio Not to use Internet Proxy for S3

It is now possible to configure Humio to not use the globally configured HTTP proxy for communcation with S3.

Auto-Balanced Partition Table Suggestions

When changing digest and storage partitions it is now possible to get auto-balanced suggestions based on node zone and replication factor settings (via ZONE, DIGEST_REPLICATION_FACTOR, STORAGE_REPLICATION_FACTOR configurations). See Configuration reference pages.

Bug Fixes

  • Other

    • Bug Fix: CSV files can no longer contain unnamed columns and also trailing commas are disallowed. Queries based on such files will now fail with an error.

    • Humio will set the field @ingesttimestamp on all events.

    • Newly added users will by default get an email.

    • Improved error handling when a parser cannot be loaded. Before, this resulted in Humio returning an error to the log shipper. Now, data is ingested without being parsed, but marked with an error as described in Parser Errors.

    • New alert notifier template {events_html} formatting events as an HTML table.

    • Upgrade to AWS SDK v2. When using Java system properties for configuring Humio bucket storage, use aws.secretAccessKey instead of aws.secretKey.

    • Alert notifiers can be configured to not use an HTTP proxy.

    • Auto-balanced partition table suggestions. See ZONE, DIGEST_REPLICATION_FACTOR, STORAGE_REPLICATION_FACTOR in configuration. See Configuration reference pages.

    • New explicit signup and login pages for social login.

    • Field based throttling on alerts.

    • S3 communication can be configured to not use an HTTP proxy.

    • If automatically creating users upon login and syncing their groups from the authentication mechanims, the configuration ONLY_CREATE_USER_IF_SYNCED_GROUPS_HAVE_ACCESS now controls whether users should only be created if the synced groups have access to a repository or view. The default is false.

    • New alert notifier type logging to a Humio repository.

Humio Server 1.14.6 Stable (2020-10-30)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.14.6Stable2020-10-302021-10-301.12.0NoNo
JAR ChecksumValue
MD5d49223f102edc33a255dd9d7178d95f0
SHA170b446b461381e1e02d3a994deb88c5ba3e682f2
SHA25617d82d593a4f290867819f8095a59d0367083c022d45d9db1c33417337d7a5b8
SHA5121d7bcdd2bd5d8385af487b8cd5a1b6da11d6a1893ade5ac5b06d44817f57e48e2679df13e9fe0f99e73723b2c306e282807fdfde9650176c19ef461c646c39fc

Email Notification Improvements

Bug Fixes

  • Summary

    • Fixed an issue where missing input validation in alerts could lead to HTML injection in email notifications.

    • Prevent automatic url to link conversion in email clients.

Humio Server 1.14.5 Stable (2020-10-21)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.14.5Stable2020-10-212021-10-211.12.0NoNo
JAR ChecksumValue
MD5097c33aba188611a3157a00cdb7366af
SHA13ac3a1722ff46530ebdf6cf1a2e977437a8917e9
SHA256cb4aa5b17dba7ca6a79494401cfaaa3e1aefce77fb029b33e24a551e9fab9a22
SHA512e737fa3bddab0c236a37b0725f2210efd4d761977646581addb29833c31081f0cc6e84f5c514be7e860dc4e848afeae5a77ab0b3536347a1d6757ba4b1547be7

Bug Fixes and New Metric

Bug Fixes

  • Summary

    • Added new metric jvm-hiccup for measuring stalls/pauses in the JVM.

    • Fixed an issue where Humio might attempt to write a larger message to Kafka than what Kafka allows.

    • Fixed an issue where Humio could behave incompatibly with Kafka versions prior to 2.3.0 if KAFKA_MANAGED_BY_HUMIO was true.

Humio Server 1.14.4 Stable (2020-10-09)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.14.4Stable2020-10-092021-10-091.12.0NoNo
JAR ChecksumValue
MD51a728a2eee16db13d2c5114ada74382c
SHA1ec61329a161dce7a387976343babf7d3ff44527b
SHA2562b49f98b2b112e54ec310ffb08013debcf9005af35bf97eca36cb69e438f1366
SHA51261e0628975aee35f01b9b6d63770c307b0a2f47fe41623bef56a0bdc2f6758ec3fe3145ed1e2b4118a482c5cd0f65b1d8fc4dbf881cc63e53a724b271f4634a7

Bug Fixes and Stability Enhancements

Bug Fixes

  • Summary

    • Fixed several cases where Humio might attempt to write a larger message to Kafka than Kafka allows.

    • Fixed a problem where some deleted segments could show up as missing.

    • Changed limits for what can be fetched via HTTP from inside Humio.

    • Log Humio cluster version in non-sensitive log.

    • Fixed a problem where duplicated uploaded files would not be deleted from /tmp.

    • Avoid overloading Kafka with updates for the global database by collecting operations in bulk.

Humio Server 1.14.3 Stable (2020-09-24)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.14.3Stable2020-09-242021-09-241.12.0NoNo
JAR ChecksumValue
MD598d17b3fcca4f158e5cfe0c7d95d0ac7
SHA157dd7e54bc414213de946119b102d6612cd0f7a1
SHA256661b21efd3128da29f20d987cd6d9e89541bdfacd8e0391a99bef5ba3255d7ba
SHA5127ccf6574c4da5a92975029236e762713be319c09032f066d28473ded25462d39e446ed402fa6463f8172077e05f9d91cd224c6d3a9ad3de5876fdd472bae8c0d

Bug Fixes and Improved Query Scheduling

Bug Fixes

  • Summary

    • Improve naming of threads to get more usable thread dumps.

    • Add logging to detect issues when truncating finished files.

    • Changed the query scheduling to account for the work of the overall query, rather than per job started. This allows fairer scheduling of queries hitting many dataspaces e.g. when using search-all.

    • Fix missing cache update when deleting a view.

    • Improve handling of sub-queries polling state from the main query when using join().

    • Change priorities when fetching segments to a node which have been offline for a longer period. This avoids waiting too long before the cluster becomes fully synced.

    • Fixed an issue where a slow data stream could cause Humio to retain more data in Kafka than necessary, as well as cause a restarted Humio node to reprocess too much data.

Humio Server 1.14.2 Stable (2020-09-17)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.14.2Stable2020-09-172021-09-171.12.0NoNo
JAR ChecksumValue
MD5c3eb561c270dce0fe7468c34cbd4322f
SHA185c1c0e16507fa152c7adbba5844aed2c83c0e03
SHA2565f4e382586a6069c5ebde1d1a620ab3d1f8f1c532e9ecce972a348ab669b2c2d
SHA512f3be7379941c9f3ae677b351dc65f90da71aaf43fdc78e93eca99d3b8dfc4fd28618c9fd4d22bf4657cdc0d9b9f80d59589c3984860958aefff61f0a769251a7

Bug Fixes, HEC Endpoint Validation and New Metrics

Bug Fixes

  • Summary

    • Fixed a race condition when cleaning up datasources.

    • Fixed a problem where too many segments could be generated when restarting nodes.

    • The job for updating the IP location database now uses the configured HTTP proxy, if present.

    • Fixed a problem where segments could be downloaded to stateless frontend nodes from Bucket storage.

    • Include user email in metrics when queries end.

    • HEC endpoint is now strictly validated as documented for top-level fields, which means non-valid input will be rejected. See HEC.

    • Improved handling of data replication when nodes are offline.

    • Added log rotation for humio-non-sensitive logs.

    • New metrics for scheduling of queries:

      • local-query-jobs-wait: Histogram of time in milliseconds that each query waited between getting any work done including exports

      • local-query-jobs-queue: Count queries currently queued or active on node including exports

      • local-query-segments-queue-exports-part: Count of elements in queue as number of segments currently queued for query for exports

      • local-query-jobs-queue-exports-part: Count queries currently queued or active on node for exports

Humio Server 1.14.1 Stable (2020-09-08)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.14.1Stable2020-09-082021-09-081.12.0NoNo
JAR ChecksumValue
MD5b57e75be1b07018a158585f04cdcb9d8
SHA16e1754ba60abeb35233a728dcb78ae11f0986d8a
SHA2565939bb412601b4356ccc431d87e3e8290a48db967a0739f638b0ea587e1a9eb7
SHA512a90b03b4081cd8ee73d06c0f925705740c769ff405b09cb1c06a51b8566775d7e2540bd6275ae1f8f7e4e0a65d241d7f1f195d26c6c3474894639d6b19b7d3d3

Bug Fixes

  • Summary

    • Remove restriction on expire time when creating emergency user through the emergency user API. See Emergency Access.

    • Improve performance when processing streaming queries.

    • Remove restriction on length of group names from LDAP.

Humio Server 1.14.0 Stable (2020-08-26)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.14.0Stable2020-08-262021-08-261.12.0NoNo
JAR ChecksumValue
MD5d0ede2c5d1075119507701bff7a04b29
SHA1b4fc3f50fabe0abdea5db2a2b502c0b2b0b71aa7
SHA256e9ddafa574576eb890cf22d241e0307caf613cc5b1bd9fdc84e50e975a40d67b
SHA51216506530541f87579660b630265171c137b8de787b5c5d11b145fc1d18ff04038514b91469b040212dbd27bddc2cee4cb5cca0054f547917624137fedb23ba20

Bug fixes and updates.

Bug Fixes

  • Configuration

    • Handling of digest in the case where a node has been offline for a long time has been improved. As an example, running a Humio cluster with a replication factor of 2 and having one node go offline for a long time would leave some ingested data to only reside on one Humio node (and on the ingest queue in Kafka). But this data would not be regarded as properly replicated until the second node returned. If the only node that was left handling a digest partition did a failover, Humio would end up going far back on the Kafka ingest queue to reread data. This has been changed. Now another node from the set of digest nodes will take over if a node goes offline, to keep the replication factor as desired. This means that other hosts, than those specified for a given digest partition on the cluster management page, can actually be handling the digest data for that partition. Only digest nodes will be selected as hosts.

    • Improved handling of query restarts to avoid unnecessary restarts in some scenarios.

Humio Server 1.13.5 Preview (2020-08-12)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.13.5Preview2020-08-122020-08-261.12.0NoYes
JAR ChecksumValue
MD50e9345ea59cb8f76a14cf84c7889de19
SHA16e27b7e2ec68090ad2c6019e0b3dea56d03d4059
SHA2563f9e0865df1c28dc69d45f764c65c39aeccfacfadeb0ec04165655ef423c7fff
SHA512256ba3cbd99245327176569cdfde8d8cee3f8c15c2f60c0c2e02115e8fd6eefec0be3cd3dac5592d4fd2b6d5e2a609e414a963af2c6ead317171228cc001666b

Security and Bug Fixes

Bug Fixes

  • Summary

    • Bug Fix: missing migration of non-default groups would result in alerts failing until the user backing the alert logs in again.

    • Bug Fix: export to file can now include query parameters

    • This release fixes a security issue. More information will follow when Humio customers have had time to upgrade. See: Humio Security Disclosures.

    • Bug Fix: export to file now allows for fieldnames with special characters.

Humio Server 1.13.4 Preview (2020-08-05)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.13.4Preview2020-08-052020-08-261.12.0NoYes
JAR ChecksumValue
MD556dd1acc53af27871de4260ff14c03f2
SHA110e4f5ad2079fb9c85f5fbf7f970a40a3951910c
SHA256256b45cb00097da6ff219713d8ed4d5bf8c4dc5b1094f856de3586c2a9f7618f
SHA512411a0f5aa3b6c96eb72dd7680d9fa94ea51e3da927c318bac0df37a2c7dee0cac9714e9807473a10417f11a3106f65107982669f9c3e29f2ac7a7a1a901a93df

Security and Bug Fixes

Bug Fixes

  • Summary

    • Fix issue where a node with no digest assignment could fail to delete local segment copies in some cases.

    • This release fixes a security issue. For more information see: Humio Security Disclosures.

    • Fix issue where a query could fail to search all segments if digest reassignment was occurring at the same time as the query.

Humio Server 1.13.3 Preview (2020-08-04)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.13.3Preview2020-08-042020-08-261.12.0NoYes
JAR ChecksumValue
MD593a48eb23b149780fac8e065d28e3bc1
SHA16f78a25d48e79482c6e98cf2dc2125208d3c906f
SHA256d526f5d0d1b9f1d1061b93e0a5c1c66d5ecd2a88cf732318d6f8fe8fcee9df30
SHA512a7fed48de308a679b5907a485ac7dc54008d9dfee32a08d41c23df2f3bc2ff7f3184a0283cf211562eaf4a9b7cc926e70ef22243ba8e3d3ed463dc872b3662bd

Security and Bug Fix

Bug Fixes

  • Summary

    • Bug Fix: avoid forbidden access error on shared dashboard links by ensuring correct use of time stamps

    • This release fixes a security issue. For more information see: Humio Security Disclosures.

Humio Server 1.13.2 Preview (2020-08-03)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.13.2Preview2020-08-032020-08-261.12.0NoYes
JAR ChecksumValue
MD532b80ba726b370fc740ba7960d537ccc
SHA1fc8a67b2fad623b0806405f9409b6e2d94d713a6
SHA256fcdac4812ef43784c3dc575e8970ecdc2d45f954773867a2b43bde97c9176142
SHA5124a0e86276d19da61b795bd937ecb0145bcfdb59a9678a5d1ed93045964db7b61d937ec69d1bd13bc79447ef74555f9de925bc416388b6cb742765191f79cb08e

Bug Fixes

Bug Fixes

  • Summary

    • Bug Fix: all ingest methods now support the ALLOW_CHANGE_REPO_ON_EVENTS configuration parameter

    • Bug Fix: avoid saving invalid bucket storage configurations

    • Default groups added

    • Bug Fix: joins will now propagate limit warnings from sub queries to the main query

    • Bug Fix: export to file no longer fails/timeouts on heavy sub queries

    • Bug Fix: make sure join-subqueries gets canceled when the main query is canceled

Humio Server 1.13.1 Preview (2020-07-03)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.13.1Preview2020-07-032020-08-261.12.0NoNo
JAR ChecksumValue
MD5f097c9c95c06f12ec55c008b9963f9ee
SHA18acc122717d30f5a3333175a172e4c26a3c20569
SHA2569dd7736569cc823182140ffd7ed91609cdafb97f99586d0d91def412a37bd548
SHA512eaceff5d2ffc55c18f6175f519ecd0c97a684cb2a1d46c3e242513181bf29217331deb934eba45ba7d55f795a1cccd0ae25cf76b685dd484ed681a2f66791f01

Bug Fixes and Improved Search Speeds for Many-Core Systems

Bug Fixes

  • Summary

    • Improved query scheduling on machines with many cores. This can improve search speeds significantly.

    • Bug Fix: S3Archiving could write events twice in a special case (When a merge happens where all inputs have been archived, write in global that the merge-result was archived too).

    • Support for a new storage format for segment files that will be introduced in a later release (to support rollback)

    • Bug Fix: Bucket storage in GCP could did not clean up all tmp files

Humio Server 1.13.0 Preview (2020-06-24)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.13.0Preview2020-06-242020-08-261.12.0NoNo
JAR ChecksumValue
MD5c9dca247bec107fa41c6ec1fe5bb5d3b
SHA151e898057d10d80e6a50ab86ab5bedf71d348f5b
SHA256b5c21c0028f1d61104821e5d4749b15cea7e208aa9bfb9307a9b10e077f6f7b6
SHA5125b148d8d8fd8680fd61c642bda45f7dba2cb0aa21efeb2752b02a6467a7063036f1b31ea347816ecdcba676cf1d9d199e409620bd6b1acd2cc2fdeff78767375

Many improvements, including some related to free-text searching, load balancing queries, TLS support, IPlocation( ) query function, and some configuration changes.

Bug Fixes

  • Configuration

    • Introduced a new ChangeViewOrRepositoryDescription permission for editing the description of a view or repository. This was previously tied to ConnectView and any user with that permission will now have the new permission as well.

    • The data source for the ipLocation() query function is no longer shipped with humio but installed/updated separately.

    • Internal communication in a Humio installation can now be encrypted using TLS. See the TLS Configuration reference page.

    • Added support for WebIdentityTokenCredentialsProvider on AWS.

    • Free text search now searches all fields rather than only @rawstring.

    • Humio can now balance and reuse existing queries internally in the cluster. See Configuration reference pages

Humio Server 1.12.7 Stable (2020-09-17)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.12.7Stable2020-09-172021-09-171.10.0NoNo
JAR ChecksumValue
MD5438fc3f94d9e252184cbeaee2dacc740
SHA108254ec21b51d6522a0336b92548943d9fe0b140
SHA256814d522ef2aef4f3a81ab8380c5ad746ef9d13f302124bc0c13c64378ef4feec
SHA512e2e936e1d20a6e60e312e995d1557085976531cfa2c50daa19cd0ce474ff398acdda3cf2431ab4a0aa33625ee45dc798685e6e485d282281f668c2c587bf69be

Bug Fix and Additional Metrics

Bug Fixes

  • Summary

    • Fixed a race condition when cleaning up datasources

    • New metrics for scheduling of queries:

      • local-query-jobs-wait: Histogram of time in milliseconds that each query waited between getting any work done including exports

      • local-query-jobs-queue: Count queries currently queued or active on node including exports

      • local-query-segments-queue-exports-part: Count of elements in queue as number of segments currently queued for query for exports

      • local-query-jobs-queue-exports-part: Count queries currently queued or active on node for exports

Humio Server 1.12.6 Stable (2020-09-03)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.12.6Stable2020-09-032021-09-031.10.0NoNo
JAR ChecksumValue
MD543c5c6e2a7de76e73d63002c04f8693c
SHA1dfff8f766cedca6a7b1888e2d060b07fba035b61
SHA2563928f42354195c4217d60a86d4df70307477af81fa4ca2d87d29c921dbc1ae5a
SHA51232e8e1b008b945545159b87d183ab1ef76d649a8a96ac92f54799446c345e205a1e13953f43a8feac264596ee69de7e10e57e2a532bb860bef062559c60442a6

Bug Fixes

Bug Fixes

  • Summary

    • Remove restriction on length of group names from LDAP.

    • Improved handling of query restarts to avoid unnecessary restarts in some scenarios.

Humio Server 1.12.5 Stable (2020-08-12)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.12.5Stable2020-08-122021-08-121.10.0NoNo
JAR ChecksumValue
MD599fc31c507d0a6193c0257b3a1a1e708
SHA1d0c7fa652713473d04923d1c5921374144a38aed
SHA25694c3f8cbb84dfe6870bdcfa4771f46a124ba8bca5d85332f0a0150a3e6f54a49
SHA5121b25c775757af29f65597dbb3d5504637485a75f2fc5b29412ea646527aebee31b4f0b96f732c70e7ed9e0d4e1c48776c4c893398e3da3222c9ccce8d762676c

Security and Bug Fixes

Bug Fixes

  • Summary

    • Fix issue where a node with no digest assignment could fail to delete local segment copies in some cases.

    • Bug Fix: avoid forbidden access error on shared dashboard links by ensuring correct use of time stamps.

    • Bug Fix: missing migration of non-default groups would result in alerts failing until the user backing the alert logs in again.

    • This release fixes a security issue. More information will follow when Humio customers have had time to upgrade. See Humio Security Disclosures.

Humio Server 1.12.4 Stable (2020-08-05)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.12.4Stable2020-08-052021-08-051.10.0NoNo
JAR ChecksumValue
MD533fe0d36c64e58ff875496facf68e65a
SHA17122a470bf146e40ddce711349007dd1a4f7961c
SHA2564cd4fa7b21fbdd14b095cb20e7d5d6af0c78bccc0bbc152c7417149db5d0d194
SHA512879822ef357dbb1dcdd969ba053bd09cabaf42b4748495543b72b63f43f8c9c6b0feb25911446f07ae37468ec663e7b278c752dc441a52136762d429c18a7f5b

Security Fix

Bug Fixes

Humio Server 1.12.3 Stable (2020-08-04)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.12.3Stable2020-08-042021-08-041.10.0NoNo
JAR ChecksumValue
MD5b6de082e67d662de761d5b79915152b8
SHA178cf6419a7a092e7d2a8200000ada4535f2f5b5c
SHA256cec300a428f0f5998bbd13d56283fb54dbe47f1205d97115b23dfabf4f3dcbc7
SHA5120704b189c70073e304ce115808441e6b44b6aa267df66fe9cac3998a80adc340fe5692829469c99dfceae3cb60e6bcc152ba7f77d509331d50d9621cfc7a1bfc

Security Fix

Bug Fixes

Humio Server 1.12.2 Stable (2020-07-03)