Streaming queries that fail to validate now return a message of why validation failed.

Added validation to the 'field' and 'key parameters of the 'join' function, so empty lists will be rejected with a meaningful error message.

Improved the phrasing of the warning shown when groupBy exceeds the max or default limit.

Added validation to the 'field' parameter of the 'top' function, so empty lists will be rejected with a meaningful error message.

Fixed an issue where query auto-completion sometimes wouldn't show the documentation for the suggested functions.

Added validation to the 'field' parameter of the 'kvParse' function, so empty lists will be rejected with a meaningful error message.

Humio now logs digest partition assignments regularly. The logs can be found using the query "class=*DigestLeadershipLoggerJob*".

When editing an email action in the UI and adding multiple recipients, it is now possible to add a space after the comma in the comma-separated list of recipients.

The design of the timeselector has been updated, and it now features an "Apply" button on the dashboard page

Adds an icon and a hint to a disabled side navigation menu item that tells the user the reason for it being disabled.

Dashboards can now be configured to not update after the initial search has completed. This mode is mainly meant to be used when a dashboard is interactive and not for wall-mounted monitors that should update continually. The feature can be accessed from the Dashboard Property panel when a dashboard is put in edit-mode.

The GQL API mutation `updateDashboard` has been updated to take a new argument `updateFrequency` which can currently only be `NEVER` or `REALTIME`, which correspond respectively to "dashboard where queries are never updated after first completion" and "dashboard where query results are updated indefinitely.

All documentation links have been updated after the documentation site has been restructured. Please contact support, if you experience any broken links.

Added a new action type that creates a CSV file from the query result and uploads it to Humio to be used with the match() query function. See Upload File

Fix the `assets` GraphQL query in organizations with views that are not 1-to-1 linked

Fixed an issue where event forwarding still showed as beta

Fix performance issue for users with access to many views

Fixed an issue where query auto-completion would sometimes delete existing parentheses.

Fix an issue that could rarely cause exceptions to be thrown from Segments.originalBytesWritten, causing noise in the log.

Fixed an issue where JSON parsing on ingest and in the query language was inefficient for large JSON objects.

Fix an issue causing Humio to create a large number of temporary directories in the data directory.

Fixed an issue where validation of "+/- Infinity" as integer arguments would crash

Fixed an issue where `join()` would not produce the correct results when `mode=left` was set.

The Save As... button is now always displayed on the Search Page

Make BucketStorageUploadJob only log at info level rather than error if a segment upload fails because the segment has been removed from the host. This can happen if node X tries to upload a segment, but node Y beats it to the punch. Node X may then choose to remove its copy before the upload completes.

The 'groupBy' function now accepts 'max' as value for the 'limit' parameter, which sets the limit to the largest allowed value (as configured by the dynamic configuration 'GroupMaxLimit')

Parser installation will now be ignored when installing a package into a system repository.

Java in the docker images no longer has the `cap_net_bind_service` capability and thus Humio cannot bind directly to privileged ports when running as a non-root user.

Fixed a bug where an alert with name longer than 50 characters could not be edited.

Fix an unhandled IO exception from TempDirUsageJob. The consequence of the uncaught exception was only noise in the error log.

Fixed an issue where strings like Nana and Information could be interpreted as NaN (not-a-number) and infinity, respectively.

Fix a bug that could cause a NumberFormatException to be thrown from ZookeeperStatsClient.

Revised some of the error messages and warnings regarding `join` and `selfJoin`.

Fixed an issue where some warnings would show twice.

Add flag whether a feature is experimental.

Added detection and handling of all queries being blocked during Humio upgrades

Include the requester in logs from QuerySessions when a live query is restarted or cancelled

All feature flags now contains a textual description about what features are hidden behind the flag.

The Live checkbox is now no longer checked automatically when changing the value of the time window in the time selector

Updated styling on the log in pages

Add missing accessibility features to the login page.

Expose a new GraphQL type with feature flag descriptions and whether they are experimental.

Fixes the placement of a confirmation dialog when attempting to change retention

Fix response entities not being discarded in error cases for the "proxyqueryjobs" endpoint, which could cause warnings in the log.

When viewing the events behind e.g. a time chart, the events will now only display with the `@timestamp` and `@rawstring` columns.

The theme toggle on a shared dashboard was moved to the header panel and no longer overlaps with any widgets.

The referrer meta tag for humio has been changed from no-referrer to same-origin.

Table widgets will now break lines for newline characters in columns.

Fix a bug that could cause Humio to spuriously log errors warning about segments not being merged for datasources doing backfilling.

Introduced new dynamic configuration 'JoinRowLimit'. It can be set using graphQL. 'JoinRowLimit' can be used as an alternative to the environment variable 'MAX_JOIN_LIMIT'. If the 'JoinRowLimit' is set, then its value will be used instead of 'MAX_JOIN_LIMIT'. If it is not set, then 'MAX_JOIN_LIMIT' will be used.

Introduced new dynamic configuration 'LiveQueryMemoryLimit'. It can be set using graphQL. 'LiveQueryMemoryLimit' determines how much memory in bytes a live query can consume during its execution. For non-live queries, their memory limit is determined by the 'QueryMemoryLimit', which is 100MB by default. By default 'LiveQueryMemoryLimit' the same value as 'QueryMemoryLimit'.

All users will not have access to the audit log or search all view by default anymore. Access can be granted with permissions.

Introduced new dynamic configuration 'QueryMemoryLimit'. It can be set using graphQL. 'QueryMemoryLimit' determines how much memory in bytes a static query can consume during its execution. 'QueryMemoryLimit' replaces the environment variable 'MAX_MEMORY_FOR_REDUCE', so if you have changed the value of 'MAX_MEMORY_FOR_REDUCE', please use 'QueryMemoryLimit' now instead. 'QueryMemoryLimit' defaults to 100MB. See also 'LiveQueryMemoryLimit' for live queries.

Added a new dynamic configuration GroupDefaultLimit which sets the default value for the 'limit' parameter of groupBy(), selfJoin() and some other functions. Previously the environment variable MAX_STATE_LIMIT was used to determine the default value. This can be done through GraphQL. GroupDefaultLimit has a default value of either 20000 or the value of the config GroupMaxLimit, whichever is smallest. 'GroupDefaultLimit' cannot be larger than GroupMaxLimit. If you've changed the value of MAX_STATE_LIMIT, we recommend that you also change GroupDefaultLimit and GroupMaxLimit to the same value for a seamless upgrade.

Introduced new dynamic configuration 'StateRowLimit'. It can be set using graphQL. 'StateRowLimit' can be used as an alternative to the environment variable 'MAX_STATE_LIMIT'. If 'StateRowLimit' is set, then its value will be used instead of 'MAX_STATE_LIMIT'. If it is not set, then 'MAX_STATE_LIMIT' will be used.

Introduced new dynamic configuration 'GroupMaxLimit'. It can be set using graphQL. The 'GroupMaxLimit' sets the maximum value of the 'limit' parameter for groupBy. Previously, this parameter was bounded by 'MAX_STATE_SIZE', so if you have made any modifications to 'MAX_STATE_SIZE', please set 'GroupMaxLimit' to the same value for a seamless upgrade. The default value of 'GroupMaxLimit' is 200000.

Added a new dynamic config flag 'QueryResultRowCountLimit' that globally limits how many results (events) a query can return. The default value is either 100000 or the value of the flag 'StateRowLimit', whichever is largest. This flag can be set by administrators through graphQL.

Applied stylistic changes for the Inspector Panel used in Widget Editor.

If Humio fails to start because the cluster is being upgraded a dedicated message will show when launching the UI.

Added preview fields isClusterBeingUpdated and minimumNodeVersion to the GraphQL Cluster object type.

Support for KMS on S3 bucket for Bucket Storage. Specify full ARN of the key. The key_id is persisted in the internal BucketEntity so that a later change of the ID of the key to use for uploads will make Humio still refer the old keyID when downloading files uploaded using the previous key. Setting a new value for the target key results in a fresh internal bucket entity to track which files used kms and which did not. For simplicity it is recommended to not mix KMS and non-KMS configs on the same S3 bucket.

FDR polling is now turned on by default. Whether FDR polling should be turned on or off on a node can be configured using the ENABLE_FDR_POLLING_ON_NODE config variable.

New configurations BUCKET_STORAGE_SSE_COMPATIBLE that makes bucket storage not verify checksums of raw objects after uploading to an S3. This option is turned on automatically is KMS is enabled (see S3_STORAGE_KMS_KEY_ARN) but is available directly here for use with other S3 compatible providers where verfying even content length does not work.

Mini segments usually get merged if their event timestamps span more than MAX_HOURS_SEGMENT_OPEN. Mini segments created as part of backfilling did not follow this rule, but will now get merged if their ingest timestamps span more than MAX_HOURS_SEGMENT_OPEN.

Compute next set of Prometheus metrics only in a single thread concurrently. If more requests arrive, then the next request gets the previous response.

The audit log system repository on cloud has been replaced with a view, so that dashboards etc. can be created on top of audit log data.

Improved performance of validation of keys in tags.

Fix type in "Unregisters node" text on cluster admin UI.

Fixed a bug where using eval as an argument to a function would result in a confusing error message.

When unregistering a node from a cluster, return a validation error if it is still alive. Hosts should be shut down before attempting to remove them from the cluster. This validation can be skipped using the same accept-data-loss parameter that also disables other validations for the unregistration endpoint.

New styling of errors on search and dashboard pages.

In lists of users, with user avatars containing user initials, the current user would sometimes appear to have an opening parenthesis as their last initial.

Introducing the Heat Map Widget that visualizes aggregated data as a colorised grid.

Sorting of Pie Chart Widget categories, descending by value. Categories grouped as Others will always be last.

Better handling of dashboard connections issues during restarts and upgrades

Added empty states for all widget types that will be rendered when there are no results.

Improved error messaging of GraphQL queries and mutations for alerts, scheduled searches and actions in cases where a given repository or view cannot be found.

Remove remains of default groups and roles. The concept was replaced with UserRoles.

Fix a bug causing Humio's digest coordinator to allow nodes to take over digest without catching up to the current leader. This could cause the new leader to replay more data from Kafka than necessary.

Make a number of improvements to the digest partition coordinator. The coordinator now tries harder to avoid assigning digest to nodes that are not caught up on fetching segments from the other nodes. It also does a better job unassigning digest from dead nodes in edge cases.

The widget legend column width is now based on the custom series title (if specified) instead of the original series name.

Intermediate network issues are not reported immediately as an error in the UI.

Fixed a bug that could result in merging small ("undersized") segments even if the resulting segment would then have a wider than desired time span. The goal it to not produce segments that span more than the 10% of the retention setting for time for the repository. If no time-based retention is configured on the repository, then 3 times the value of configuration variable MAX_HOURS_SEGMENT_OPEN is applied as limit. For default settings that results in 72 hours.

Fixed a bug where the writeJson() function would write any field starting with a case-insensitive inf or infinity prefix as a null value in the resulting JSON.

FDR Ingest will no longer fail on events that are larger than the maximum allowed event size. Instead, such messages will be truncated.

Upgrade Kafka to 3.2.0 in the docker images, and in the Humio dependencies.

The Pie Chart Widget now uses the first column for the series as a fall back option.

The Bar Chart Widget now works with bucket query results.

Note Widget:

Adds a new metric for measuring the merge latency, which is defined as the latency between the last minisegment being written in a sequence with the same merge target, and those minisegments being merged. The metric name is segment-merge-latency-ms.

Adds a new logger job that logs the age of an unmerged miniSegment if the age exceeds the threshold set by the env variable MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING. The default value of MINI_SEGMENT_MAX_MERGE_DELAY_MS_BEFORE_WARNING is 2 x MAX_HOURS_SEGMENT_OPEN. MAX_HOURS_SEGMENT_OPEN defaults to 24 hours. The error log produced looks like: Oldest unmerged miniSegment is older than the threshold thresholdMs={value} miniSegmentAgeMs={value} segment={value}.

Bump the version of the Monaco code editor.

Added a log message with the maximum state size seen by the live part of live queries.

Websocket connections are now kept open when transitioning pages, and are used more efficiently for syntax highlighting.

Fix the dropdown menus closing too early on the home page.

The Time Chart Widget regression line is no longer affected by the interpolation setting.

Fix a bug causing digesters to continue digesting even if the local disk is full. The digester will now pause digesting and error log if this occurs.

Some errors messages wrongly pointed to the beginning of the query.

Bump woodstox to address SNYK-JAVA-COMFASTERXMLWOODSTOX-2928754.

Make streaming queries search segments newest-to-oldest rather than oldest-to-newest. Streaming queries do not ensure the order of exported events anyway, and searching newest-to-oldest is more efficient.

Improved keyboard accessibility for creating repositories and views.

The toggle switch is now tabbable and can be accessed using the keyboard.

Bar Chart Widget:

The dashboards page now displays the current cluster status.

Single Value Widget:

The Normalize option for the World Map Widget has been replaced by a third magnitude mode named None, which results in fixed size and opacity for all marks.

Introduced new dynamic configuration flag join-row-limit. It can be set using graphQL. The flag can be used as an alternative to the environment variable MAX_JOIN_LIMIT. If the join-row-limit flag is set, then its value will be used instead of MAX_JOIN_LIMIT. If it is not set, then MAX_JOIN_LIMIT will be used.

Introduced new dynamic configuration flags query-memory-limit. It can be set using graphQL. The flag replaces the environment variable MAX_MEMORY_FOR_REDUCE, so if you have changed the value of MAX_MEMORY_FOR_REDUCE, please use query-memory-limit now instead. query-memory-limit defaults to the maximum signed integer value.

Introduced new dynamic configuration flag state-row-limit. It can be set using graphQL. The flag can be used as an alternative to the environment variable MAX_STATE_LIMIT. If state-row-limit is set, then its value will be used instead of MAX_STATE_LIMIT. If it is not set, then MAX_STATE_LIMIT will be used.

Default value of configuration variable S3_ARCHIVING_WORKERCOUNT raised from 1 to (vCPU/4).

Added a new environment variable GROUPBY_DEFAULT_LIMIT which sets the default value for the limit parameter of groupBy(). See groupBy() documentation for details.

Added a link to humio-activity repository for debugging IDP configurations to the page for setting up the same.

The Log Collector download page has been enabled for on-prem deployments.

Adds a logger job for cluster management stats it log the stats every 2 minutes, which makes them searchable in Humio.

The logs belong to the class c.h.c.ClusterManagementStatsLoggerJob, logs for all segments contains globalSegmentStats log about singular segments starts with segmentStats.

Add warning when a multitenancy user is changing data retention on an unlimited repository.

Added a log of the approximate query result size before transmission to the frontend, captured by the approximateResultBeforeSerialization key.

Adds a new metric for the temp disk usage. The metric name is temp-disk-usage-bytes and denotes how many bytes are used.

Improved performance of NDJSON format in S3 Archiving.

Fix a bug where changing a role for a user under a repository would trigger infinite network requests.

Fix an issue causing the event forwarding feature to incorrectly reject topic names that contained a dash (-).

Fixed a bug where multiline comments weren't always highlighted correctly.

Improve file path handling in DiskSpaceJob to eliminate edge cases where the job might not have been able to tell if a file was on primary or secondary storage.

If a segment is deleted or otherwise disappears from global while Humio is attempting to upload it to bucket storage, the upload will now be dropped with an info-level log, rather than requeued with an error log.

Update org.json:json to address a vulnerability that could cause stack overflows.

Bump javax.el to address CVE-2021-28170.

Update Netty to address CVE-2022-24823.

The Save As... button is now always displayed on the Search Page.

Updated dependencies to woodstox to fix a vulnerability.

Compute next set of Prometheus metrics only in a single thread concurrently. If more requests arrive, then the next request gets the previous response.

Both the Scatter Chart and the Bar Chart widgets now support automatically adding/toggling axis and legend titles based on the mapped data.

The Format Panel is now available for changing the style of the data displayed in the Event list — see Changing the Data Display.

The Fields Panel now enables you to fetch fields beyond those from the last 200 events — see Adding and Removing Fields.

The Single Value widget is now available. Construct a query which returns any single value, or use the timeChart() query function to create a Single Value widget instance with sparkline and trend indicator.

The Gauge widget is being deprecated in favour of the Single Value widget. Configurations of the Gauge widget are compatible with the Single Value widget. This means that persisted configurations of the Gauge widget (url / dashboard widgets / saved queries / recent queries) are still valid, but are visualised using the Single Value widget instead.

Improve the error message if Humio is configured to use bucket storage, but the credentials for the bucket are not configured.

The Feature Flag, CookieAuthServerSide, has been deprecated as cookie authentication is now enabled by default. Instead, the configuration field ENABLE_BEARER_TOKEN_AUTHORIZATION has been introduced.

The Humio Log Collector can now be downloaded from the Organizational Settings page, see the Log Collector Documentation for a complete list of the supported logs formats and operating systems.

ioc:lookup() would sometimes give incorrect results when negated.

worldmap() will warn about licensing issues with IP database.

worldmap() accepts more magnitude functions, including percentile and anonymous functions.

sankey() now accepts more weight functions such as anonymous functions and percentile.

Added the fdr-message-count metric, which contains the approximate number of messages on an FDR feed's SQS queue.

Added the fdr-invisible-message-count metric, which contains the approximate number of invisible messages on an FDR feed's SQS queue.

When cleaning up a deleted data space, don't error log if two nodes race to delete the data space metadata from global.

Fixed an issue where Humio's Zookeeper monitoring page would show X/0 followers in sync.

Improved error logging, when an FDR feed fails to download data from an S3 bucket. It now clearly states when a download failed because the S3 bucket is located in a different region than the SQS queue.

Ensured that errors during view tombstone removal are logged and don't prevent the RetentionJob from performing other cleanup tasks.

Logging to the humio-activity repository is now also done for events in sandbox repositories.

Fixed an issue that if download of IOCs took more than an hour, Humio would indefinitely start a new download every hour which would eventually fail.

Specifying a versionless packageId will load the newest version of that package.

Email actions can now add the result set as a CSV attachment.

Fixed an underlying bug causing addToExistingJob did not find the existing job to be error logged unnecessarily. Humio may decide to fetch a segment from bucket storage for querying. If this decision is made right as the query is cancelled, Humio could log the message above. With this fix, Humio will instead skip downloading the segment, and not log the error.

Fixed an issue where a scheduled search could trigger actions multiple times for the same time period if actions took a long time to finish.

It is now possible to test an FDR feed in the UI, which will test that Humio can connect to the SQS queue and the S3 bucket.

Events with JSON data can now be collapsed and expanded in the Json panel.

Syntax highlighting for XML, JSON and accesslog data now uses more distinguishable colors.

Improvements to the Sankey Diagram widget, it now has multiple style options; show/hide the y-axis, sorting type, label position, and colors plus labels for series.

Added style options to either truncate or show full legend labels in widgets.

Improvements to the Pie Chart widget, it now has a max series setting similar to the time chart widget.

Introducing the new Scatter Chart (previously known as XY):

The widget dropdown can now be navigated with the keyboard.

Keep empty lines in queries when exporting assets as templates or to packages.

The @timestamp column is now allowed to be moved amongst the other columns in the event list.

When using a widget that is not compatible with the current data, the Reset Widget Type button now works again.

Improvements to the Bar Chart widget:

Improvements to the Time Chart Widget widget:

Introducing the Single Value Widget widget. Construct a query which returns any single value, or use the timeChart() query function to create a Single Value widget instance with sparkline and trend indicator.

Removed the following deprecated GraphQL fields: UserSettings.settings, UserSettings.isEventListOrderChangedMessageDismissed, and UserSettings.isNewRepoHelpDismissed.

Added a new GraphQL mutation to rename views or repositories by id.

Marked experimental language features as preview in GraphQL API.

The GraphQL queries and mutations for FDR feeds are no longer in preview.

It is now possible to refer a parser by name when creating an ingest token or assigning a parser to an existing ingest token using the GraphQL API mutations addIngestTokenV3 and assignParserToIngestTokenV2. The old mutations addIngestTokenV2 and assignParserToIngestToken have been deprecated.

Added two new organization level permissions: DeleteAllRepositories and DeleteAllViews that allow repository and view deletion, respectively, inside an organization.

Added a GraphQL mutation deleteSearchDomainById that deletes views or repositories by ID.

Removed the deprecated clientMutationId argument from the GraphQL mutation updateSettings.

Changed permission token related GraphQL endpoints to use enumerations instead of strings.

It is now possible to refer a parser by name when creating or updating an ingest listener using the GraphQL API mutations createIngestListenerV3 and updateIngestListenerV3. It is now also possible to change the repository on an ingest listener using updateIngestListenerV3. The old mutations createIngestListenerV2 and updateIngestListenerV2 have been deprecated.

Using the dynamic configuration option FdrEnable, administrators can now turn FDR polling on/off on the entire cluster with a single update. Defaults to false.

The static configuration variable ENABLE_FDR_POLLING_ON_NODE is no longer supported, as its functionality has been replaced with the dynamic configurations listed above.

Added a new configuration variable BUCKET_STORAGE_TRUST_POLICY for the dual-bucket use case. This setting configures which bucket is considered the "trusted" bucket when two buckets are configured, which impacts when Humio considers data to be safely replicated. Supported values are Primary for trusting the primary bucket, Secondary for trusting the secondary bucket, TrustEither for considering data safely replicated if it is in either bucket, and RequireBoth for considering data safely replicated only if it is in both buckets. This config replaces the BUCKET_STORAGE_2_TRUSTED configuration, true in the old configuration equates to Secondary in the new configuration. The default value of the new configuration is Secondary.

Using the dynamic configuration option FdrMaxNodes, administrators can put a cap on how many nodes should at most simultaneously poll data from the same FDR feed. Defaults to 5 nodes.

Validate block CRCs before uploading segment files to bucket storage. Can be disabled by setting VALIDATE_BLOCK_CRCS_BEFORE_UPLOAD to false.

Using the dynamic configuration option FdrExcludedNodes, administrators can now exclude specific nodes from polling from FDR. Defaults to the empty list, so all nodes will be used for polling.

Added a new config NATIVE_FALLOCATE_SUPPORT (default true) to allow turning off the use of fallocate and ftruncate internally.

Require that {S3/GCS}_STORAGE config must be set before {S3/GCS}_STORAGE_2 is set.

Introduced dynamic configuration options for changing FDR polling behaviour at runtime. FDR polling is not enabled by default, so you should take care to set up these new configurations after upgrading, or you will risk that your FDR data isn't ingested into Humio before it is deleted from Falcon.

Amended how Humio chooses segments to download from bucket storage when prefetching. If S3_STORAGE_PREFERRED_COPY_SOURCE is false, the prefetcher will only download segments that are not already on another host. Otherwise, it will download as many hosts as necessary to follow the configured replication factor. This should help avoid excessive bucket downloads when nodes in the cluster have lots of empty disk space.

Added a new config NATIVE_FADVICE_SUPPORT (default true) to allow turning off the use of fadvice internally.

Adding and removing queries from the query blocklist is now audit logged as two separate audit log event types, query-blocklist-add and query-blocklist-remove, rather than the single event type blocklist.

Added a new system-level permission allowing changing the user name of a user.

Create, update and delete operations on ingest listeners are now always audit logged. Previously, they were only logged when performed through the REST API. Also, the audit log format has been updated to be similar to the format of other assets. Look for events with the type field set to ingestlistener.create, ingestlistener.update, and ingestlistener.delete.

Renamed the Humio tarball distribution to humio-1.39.0.tar.gz instead of humio-release-1.39.0.tar.gz. The file now contains a directory named humio-1.39.0 instead of humio-release-1.39.0.

The REST API for ingest listeners has been deprecated.

Fixed an ingest bug where, under some circumstances, we would reverse the order of events in a batch.

Fixed how relative time is displayed.

Fixed an issue that could cause the query scheduler to erroneously retry searching a bucketed segment.

Ingest listeners are now only stopped, not deleted, when a user deletes a repository. If the repository is restored, the ingest listener will be restarted automatically. When it is no longer possible to restore the repository, the ingest listener will be deleted.

Added a feature that allows deletion of repositories and views on cloud.

When calculating the starting offset in Kafka for digest, Humio will now trust that if a segment in global is listed as being in bucket storage, that segment is actually present in bucket storage. Humio no longer double checks by asking bucket storage directly.

Fixed a caching-related issue with groupBy() in live queries that would briefly cause inconsistent results.

It is now possible to create a view with the same name as a deleted view.

Fixed an issue where query cancellation could in rare cases cause the query scheduler to throw exceptions.

Fixed an issue where Filebeat 8.1 would not be compatible unless output.elasticsearch.allow_older_versions was set to true.

When logging Kafka consumer and producer metrics, Humio will now log repeated metrics like records-lag-max once per partition, with the partition specified in the partition field.

Fixed an issue where OrganizationStatsUpdaterJob would repeatedly post the error com.humio.entities.organization.OrganizationSingleModeNotSupported: Not supported when using organizations in single mode when the cluster was configured for only one organization.

Fixed an issue where NetFlow parsing would crash if it received an options data record.

Added more visibility on organization limits when changing the retention settings on a repository.

Automatic system removals of queries expired from the blocklist are now audit logged as well.

Fixed an issue where audit logging of alerts, scheduled searches and actions residing on views would yield incomplete or missing audit logs.

Added support for restoring deleted repositories and views when using bucket storage. See Delete a Repository or View.

Fixed an issue where non-default log formats such as log4j2-json-stdout.xml that logs to STDOUT were not fully in control of their output stream, as log entries of level ERROR were also printed directly to stderr from within the code. The default log4j2 configuration now includes a Console appender that prints errors to stdout, achieving the same result, while allowing the other formats to fully control their output stream.

Fixed an issue where download of IOCs from another node in the cluster could start before the previous download had finished, resulting in too many open connections between nodes in the cluster.

Improved distribution onto partitions of tag combinations (datasources) that are affected by auto sharding, resulting in less collisions.

Webhook action has been updated to only allow the following HTTP verbs: GET, HEAD, POST, PUT, PATCH, DELETE and OPTIONS.

Fixed an issue where some errors showed wrong positions in the search page query field.

Fixed duplicate Change triggers and actions entry in view permission token page.

Added humio-token-hashing.sh to the Humio bin directory. This invokes a utility for generating root tokens.

Added support in fieldStats() query function for skipping events. This is used by the UI, but only in situations where we know an approximate result is acceptable and where processing all events would be too costly.

Fixed an ingest bug where sometimes we wouldn't turn event fields into tags if we fell back to using the key-value parser. Now we always turn fields into tags.

Improved the phrasing of some error messages.

Improved the flow of creating a blocked query.

When Humio detects multiple datasources for the same set of tags, it will not deduplicate them by selecting one source to keep and marking the others replaced.

Added a feature that allows regular users with delete permissions on cloud to rename views and repositories.

Made changes to Humio's tracking of bucket storage downloads. This should avoid some rare cases where downloads could get stuck.

Fixed an ingest bug where, when truncating an event with too many fields, we wouldn't count error fields, leading to the event still being larger than the maximum size.

Fixed an issue where an exception in rare cases could cause ingest requests to fail intermittently.

It is no longer possible to delete a parser that is used by an ingest listener. You must first assign another parser to the ingest listener.

Fixed a bug where accessing a csv file with records spanning multiple lines would fail with an exception.

Fixed a race condition between nodes creating the merge result for the same target segment, and also transferring it among the nodes concurrently. If a query read the file during that race, an in-memory cache of the file header might hold contents that did not match the local file, resulting in Broken segment warnings in queries.

Fixed an issue where Filebeat 8.0 would not be compatible unless setup.ilm.enabled was set to false.

Reduced the amount of time Humio will spend during shutdown waiting for in-progress data to flush to disk to 60 seconds from 150 seconds.

Humio will now periodically log node configs to the debug log, in addition to the existing log of config on node boot. These logs will come from com.humio.jobs.ConfigLoggerJob.

If the query scheduler attempts to read a broken segment file, it may be able to fetch a new copy from bucket storage in some cases. Humio will now only allow this if it can be guaranteed that no events from the broken segment have been added to the query result. Otherwise the query will receive a warning.

It is now validated, that the parser supplied when creating or updating an ingest listener, exists.

Fixed an issue that could cause an exception to be thrown in the ingest code if digest assignment changed while a local segment file being written was still empty.

Updating alert labels using the addAlertLabel and removeAlertLabel mutations now requires the ChangeTriggersAndActions permission.

Fixed an issue where the set-replication-defaults config endpoint could attempt to assign storage to nodes configured not to store segments.

It is no longer possible to create ingest listeners on system repositories using the APIs. Previously, it was only prohibited in the UI.

Humio is now more strict during a Kafka reset to avoid global desyncs. Only one node will be allowed to boot on the new epoch, remaining nodes won't be allowed to use their snapshots, and will need to fetch a fresh global snapshot from that node.

Fixed a bug with UTF-8 serialization of 4-byte codepoints (emojis etc.).

Improved performance of formatting action messages, when the query result for an alert or scheduled search contains large events.

Fixed an ingest bug where if multiple types of errors occurred for an event we would only add error fields describing one of them. Now we always report all errors.

Fixed an issue where exceptions in FDR were not properly logged.

Fixed an issue that links in alerts from OpsGenie actions were not clickable.

Fixed bugs related to repository deletes.

Added humio-decrypt-bucket-file.sh to the Humio bin directory. This invokes a utility for decrypting files downloaded from bucket storage.

Fixed an issue when using bucket storage alongside secondary storage, where Humio would download files to the secondary storage but register them as present in the primary. It will now download and register them as present on the secondary storage.

Fixed an ingest bug where we might discard @timezone and @error fields in events with too many fields. Now we always retain those and only discard other fields.

During ingest, if an event has too many fields we now sort the fields lexicographically and remove fields from the end. Before, there was no system to which fields were retained, it was effectively random.

Webhook action now includes the 'Message Body Template' for PATCH and DELETE requests as well if it is not empty.

It is no longer possible to use experimental functions in Alerts, Parsers, and Event Forwarding. They are now only available on the search page.

Fixed an issue that could cause creation of two datasources for the same tag set if messages with the same tags happened to arrive on different Kafka partitions.

The findTimestamp() function now supports date formats like 23FEB2022, that is date, literal month and year without any separators in between. Other formats still require separators between the parts.

When shared dashboards are disabled or become inaccessible because of IP filters, they will now be completely unreachable, and any dashboards already open will show an informative error message.

Fixed an issue where the UI would not detect parameters in a query when using saved queries from a package.

Improved distribution of new autosharded datasources.

The query scheduler improperly handled regex limits being hit, it should result in a warning on the query. In some cases it was handled by retrying the segment read.

Updated dependencies to fix vulnerabilities to CVE-2021-22573.

Updated java script dependencies to fix vulnerabilities.

Use latest version of Java 1.13 on Docker image.

Updated java script dependencies to fix vulnerabilities.

Use latest version of Alpine on Docker image.

Updated dependencies to Jackson to fix a vulnerability.

Added a quick-fix to convert non-ASCII quotes to ASCII quotes in the search field.

When changing focus inside a dialog with the keyboard, the focus will no longer move outside the dialog while it is open.

Visually hidden clipboard field is now hidden for assistive technologies/keyboard users.

Hover information in the search field is shown despite an overlapping warning.

The bar and pie charts now support holding the SHIFT key to display unformatted numeric values.

First row entry in the statistics table on the repo page is now a table header and added hidden content to the empty table header in the new view page.

On the time, bar and pie charts you can hold the ALT/OPTION key to display long legend titles.

Added a quick-fix for unknown escape sequences in the search field.

Reworked the hover message layout and changed the hover information on text (in the search field).

The search page now has focus states on the Language Syntax, Event List Widget and Save As buttons.

The Cluster Nodes table has been redesigned to allow for easier overview and copying the version-number.

Better accessibility for queries panel. You can now tab to focus individual queries, and open a details panel. From here you can also access all actions in the details panel by tabbing.

Minor UX improvements (ie. accessibility) on the queries panel.

Added a warning for unknown escape sequences in the search field.

When using the table visualisation in dark mode, empty table cells are now clearly discernible.

Pop-ups and drop-downs will now close automatically when focus leaves them.

Hover over parameter names and arguments in the search field now includes the default value.

Fixed a bug in the response from calling the installPackageFromZip graphql mutation. Previously the response type exposed a deprecated clientmutationid that could not be selected. Also now if form fields are missing they are properly reported in the response.

The PERMISSION_MODEL_MODE config option has been removed. All graphql related schema has also been removed.

Deprecates the ReadContents view action, in favor of ReadEvents. This also means ReadEvents has been undeprecated, as we have slightly changed how we consider read rights, and want the action names to match this.

Reduce default value of INGESTQUEUE_COMPRESSION_LEVEL, the ingest queue compression level from 1 to 0. This reduces time spent compressing before inserting into the ingest queue by roughly 4x at the expense of a 10-20% increase in size required in Kafka for the ingest queue topic.

Added config IP_FILTER_RDNS for specifying what IP addresses can be queried using the rdns query function.

Added the config CORS_ALLOWED_ORIGINS a comma separated list for CORS allowed origins, default allows all origins.

Added new config NATIVE_FALLOCATE_SUPPORT (default true) to allow turning off the use of fallocate and ftruncate internally.

Added new config NATIVE_FADVICE_SUPPORT (default true) to allow turning off the use of fadvice internally.

When Kafka topic configuration is managed by Humio (default true) set max.message.bytes on the topics to the value of Config TOPIC_MAX_MESSAGE_BYTES, default is 8388608 (8 MB). Minimum value is 2 MB.

The Property inter.broker.protocol.version in kafka.properties now defaults to 2.4 if not specified. Users upgrading Kafka can either set inter.broker.protocol.version manually in kafka.properties, or pass DEFAULT_INTER_BROKER_PROTOCOL_VERSION as an environment variable to Docker when launching the container. Please follow Kafka's upgrade guidelines when upgrading a Kafka cluster to avoid data loss https://kafka.apache.org/documentation/#upgrade_3_1_0.

Added config IP_FILTER_RDNS_SERVER for specifying what DNS servers can be allowed in the rdns query function.

Fixed a bug where TLS_KEYSTORE_TYPE and TLS_TRUSTSTORE_TYPE would only recognize lower-case values.

Added config RDNS_DEFAULT_SERVER for specifying what DNS server is the default for the rdns query function.

Added new settings for how uploads to bucket storage are validated. In the case that validation with etags are not available, content length can be used instead.

Improved the performance of deletes from global.

Fixed an issue where negated functions could lose their negation.

Fixed an issue where queries with tail() would behave in an unexpected manner when an event is focused.

Improved performance of FDRJob.

Added tombstoning to uploaded files, which helps with avoiding data loss.

Fixed an issue where users could be shown in-development feature on the client when running a local installation of Humio.

Fixed an issue where top(max) could throw an exception when given values large enough to be represented as positive infinity.

Warn at startup if CORES > AvailableProcessorCount as seen by the JVM.

Fixed an issue with epoch and offsets not always being stripped from segments.

Fixed a bug where the Add Column button on the Fields panel would do nothing

Fixed an issue where percentile() would crash on inputs larger than ~1.76e308.

For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

Fixed several issues where users could add invalid query filters via the Add filter context button after selecting text in the Event List.

LSP warnings don't crash queries any more.

Added a new system-level permission that allows changing usernames of users.

Improved off-heap memory handling. Humio now typically uses only 1 GB on systems with 32 vCPUs, down from typically 16 GB. This leaves more memory for other processes and page cache for data.

Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

Fixed an issue where tail() could produce results inconsistent with other query functions, when used in a live query.

During Digest startup, abort fetching segments from other nodes if the assigned partition set changes while fetching.

Fixed a bug where providing a bad view/repository name when blocking queries would block the query in all views and repositories.

Published new versions of the Humio Kafka Docker containers for Kafka 3.1.0.

Do not run the Global snapshot consistency check on stateless ingest nodes.

Previously a package could be updated with another package with the same name and version, but with different content. This is no longer allowed, and any attempt do so will be rejected and fail.

During identity provider configuration, it's possible to fetch SAML configuration from an endpoint.

Fixed an ingest bug where under some circumstances we would reverse the order of events in a batch.

Fixed a compatibility issue with LogStash 7.16+ and 8.0.0 when using the Elasticsearch output plugin.

Ensure only a cluster leader that still holds cluster leadership can force digesters to release partition leadership. This could cause spurious reboots in clusters where leadership was under contention.

Upgrades the Kafka client to 3.1.0 from 2.8.1. 3.1.0 enables the idempotent producer by default, which implies acks=all. Clusters that set acks to a different number via EXTRA_KAFKA_CONFIGS_FILE should update their config to also specify enable.idempotence=false

Fixed a bug where the package marketplace would redirect to unsupported package versions on older Humio instances.

Allow cluster managers access to settings for personal sandboxes and to block and kill queries in them.

Ensure a digester can only acquire or release partition leadership if no other digester has leadership of that partition. This could cause spurious reboots if digester leadership became contended.

Fixed an issue where live queries would sometimes double-count parts of the historic data.

Fixed a bug in the Sankey chart such that it now updates on updated query results.

Fixed a compatibility issue with FileBeat 8.0.0.

Improved off-heap memory handling. Humio now typically uses only 1 GB on systems with 32 vCPUs, down from typically 16 GB. This leaves more memory for other processes and page cache for data.

Added a new system-level permission that allows changing usernames of users.

Improved performance of FDRJob.

Fixed an issue where some queries using regex would use an unbounded regex engine.

Fixed an issue where users could be shown in-development feature on the client when running a local installation of Humio.

Fixed an issue where QueryFunctionValidator failed giving the error "scala.MatchError".

Visually hidden clipboard field is now hidden for assistive technologies/keyboard users.

Added a quick-fix for unknown escape sequences in the search field.

Better accessibility for queries panel. You can now tab to focus individual queries, and open a details panel. From here you can also access all actions in the details panel by tabbing.

Pop-ups and drop-downs will now close automatically when focus leaves them.

When changing focus inside a dialog with the keyboard, the focus will no longer move outside the dialog while it is open.

The Cluster Nodes table has been redesigned to allow for easier overview and copying the version-number.

Added a warning for unknown escape sequences in the search field.

First row entry in the statistics table on the repo page is now a table header and added hidden content to the empty table header in the new view page.

When using the table visualisation in dark mode, empty table cells are now clearly discernible.

The bar and pie charts now support holding the SHIFT key to display unformatted numeric values.

Added a quick-fix to convert non-ASCII quotes to ASCII quotes in the search field.

The search page now has focus states on the Language Syntax, Event List Widget and Save As buttons.

On the time, bar and pie charts you can hold the ALT/OPTION key to display long legend titles.

Hover information in the search field is shown despite an overlapping warning.

Minor UX improvements (ie. accessibility) on the queries panel.

Reworked the hover message layout and changed the hover information on text (in the search field).

Hover over parameter names and arguments in the search field now includes the default value.

Deprecates the ReadContents view action, in favor of ReadEvents. This also means ReadEvents has been undeprecated, as we have slightly changed how we consider read rights, and want the action names to match this.

The PERMISSION_MODEL_MODE config option has been removed. All graphql related schema has also been removed.

Fixed a bug in the response from calling the installPackageFromZip graphql mutation. Previously the response type exposed a deprecated clientmutationid that could not be selected. Also now if form fields are missing they are properly reported in the response.

The Property inter.broker.protocol.version in kafka.properties now defaults to 2.4 if not specified. Users upgrading Kafka can either set inter.broker.protocol.version manually in kafka.properties, or pass DEFAULT_INTER_BROKER_PROTOCOL_VERSION as an environment variable to Docker when launching the container. Please follow Kafka's upgrade guidelines when upgrading a Kafka cluster to avoid data loss https://kafka.apache.org/documentation/#upgrade_3_1_0.

Added config IP_FILTER_RDNS_SERVER for specifying what DNS servers can be allowed in the rdns query function.

When Kafka topic configuration is managed by Humio (default true) set max.message.bytes on the topics to the value of Config TOPIC_MAX_MESSAGE_BYTES, default is 8388608 (8 MB). Minimum value is 2 MB.

Reduce default value of INGESTQUEUE_COMPRESSION_LEVEL, the ingest queue compression level from 1 to 0. This reduces time spent compressing before inserting into the ingest queue by roughly 4x at the expense of a 10-20% increase in size required in Kafka for the ingest queue topic.

Added new settings for how uploads to bucket storage are validated. In the case that validation with etags are not available, content length can be used instead.

Added the config CORS_ALLOWED_ORIGINS a comma separated list for CORS allowed origins, default allows all origins.

Added config IP_FILTER_RDNS for specifying what IP addresses can be queried using the rdns query function.

Added config RDNS_DEFAULT_SERVER for specifying what DNS server is the default for the rdns query function.

Fixed a bug where TLS_KEYSTORE_TYPE and TLS_TRUSTSTORE_TYPE would only recognize lower-case values.

Ensure a digester can only acquire or release partition leadership if no other digester has leadership of that partition. This could cause spurious reboots if digester leadership became contended.

Published new versions of the Humio Kafka Docker containers for Kafka 3.1.0.

Do not run the Global snapshot consistency check on stateless ingest nodes.

Ensure only a cluster leader that still holds cluster leadership can force digesters to release partition leadership. This could cause spurious reboots in clusters where leadership was under contention.

During Digest startup, abort fetching segments from other nodes if the assigned partition set changes while fetching.

Allow cluster managers access to settings for personal sandboxes and to block and kill queries in them.

Improve the performance of deletes from global.

Added tombstoning to uploaded files, which helps with avoiding data loss.

Upgrades the Kafka client to 3.1.0 from 2.8.1. 3.1.0 enables the idempotent producer by default, which implies acks=all. Clusters that set acks to a different number via EXTRA_KAFKA_CONFIGS_FILE should update their config to also specify enable.idempotence=false

During identity provider configuration, it's possible to fetch SAML configuration from an endpoint.

Fixed a compatibility issue with LogStash 7.16+ and 8.0.0 when using the Elasticsearch output plugin.

Fixed an issue where negated functions could lose their negation.

Fixed a bug where the package marketplace would redirect to unsupported package versions on older Humio instances.

Fixed a bug where providing a bad view/repository name when blocking queries would block the query in all views and repositories.

Fixed a bug in the Sankey chart such that it now updates on updated query results.

Fixed an issue where live queries would sometimes double-count parts of the historic data.

Fixed several issues where users could add invalid query filters via the Add filter context button after selecting text in the Event List.

Fixed an issue where top(max) could throw an exception when given values large enough to be represented as positive infinity.

Fixed an issue where percentile() would crash on inputs larger than ~1.76e308.

Fixed an issue where tail() could produce results inconsistent with other query functions, when used in a live query.

Warn at startup if CORES > AvailableProcessorCount as seen by the JVM.

For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

Previously a package could be updated with another package with the same name and version, but with different content. This is no longer allowed, and any attempt do so will be rejected and fail.

Fixed an issue where queries with tail() would behave in an unexpected manner when an event is focused.

Fixed a compatibility issue with FileBeat 8.0.0.

Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

Fixes an issue with epoch and offsets not always being stripped from segments.

LSP warnings don't crash queries any more.

Fixed a bug where the Add Column button on the Fields panel would do nothing

Updated java script dependencies to fix vulnerabilities.

Updated dependencies to fix vulnerabilities to CVE-2021-22573.

Updated java script dependencies to fix vulnerabilities.

Use latest version of Alpine on Docker image.

Use latest version of Java 1.13 on Docker image.

Added new config NATIVE_FADVICE_SUPPORT (default true) to allow turning off the use of fadvice internally.

Added new config NATIVE_FALLOCATE_SUPPORT (default true) to allow turning off the use of fallocate and ftruncate internally.

Fix ingest bug where under some circumstances we would reverse the order of events in a batch.

Updated dependencies to Jackson to fix a vulnerability.

Fixed a race condition between nodes creating the merge result for the same target segment, and also transferring it among the nodes concurrently. If a query read the file during that race condition, an in-memory cache of the file header might hold contents that did not match the local file, resulting in "Broken segment" warnings in queries.

Improved off-heap memory handling. Humio now typically uses only 1 GB on systems with 32 vCPUs, down from typically 16 GB. This leaves more memory for other processes and page cache for data.

Reading hashfilter in chunks to avoid having huge off heap buffers.

Performance improvements of IngestPartitionCoordinator.

Improve the performance of deletes from global.

Downgrade to Java 1.13 on Docker image to fix rare cases of JVM crashes.

New feature to select text in the search page event list and include/exclude that in the search query.

Hovering over text within a query now shows the result of interpreting escape characters.

New dialogs for creation of parsers and dashboards.

Added ability to resize search page query field by dragging or fitting to query.

Time selector is now accessible by keyboard.

Allow more dialogs in the UI to be closed with the Esc key.

Improved dark mode toggle button's accessibility.

Improved accessibility when choosing a theme.

Disable the option to creating a view if the user does not have Connect a view permission on any repository. This is more intuitive than getting an empty dropdown of repositories to choose from.

Improved the error messages when the GraphQL queries SearchDomain.alert, SearchDomain.action, and SearchDomain.savedQuery do not find the entity with the given ID.

Added INITIAL_FEATURE_FLAGS which lets you enable/disable feature flags on startup. For instance, setting INITIAL_FEATURE_FLAGS=+UserRoles,-UsagePage enables UserRoles and disables UsagePage.

When using ZOOKEEPER_URL_FOR_NODE_UUID for assignment of node ID to Humio nodes, and value of ZOOKEEPER_PREFIX_FOR_NODE_UUID (default /humio_autouuid) does not match contents of local UUID file, acquire a fresh node uuid.

Reduce default value of INGESTQUEUE_COMPRESSION_LEVEL, the ingest queue compression level from 1 to 0. This reduces time spent compressing before inserting into the ingest queue by roughly 4x at the expense of a 10-20% increase in size required in Kafka for the ingest queue topic.

New configuration BUCKET_STORAGE_MULTIPLE_ENDPOINTS and many configurations using STORAGE_2 as prefix. See Bucket Storage.

Added the config CORS_ALLOWED_ORIGINS a comma separated list for CORS allowed origins, default allows all origins.

Make ZOOKEEPER_URL optional. When not set, the zookeeper-status-logger job does not run, and the cluster administration page does not display information about a Zookeeper cluster.

Improved caching of UI static assets.

Added option to specify an IP Filter for which addresses hostname verification should not be made.

Improved the default permissions on the group page by leaving their view expanded once the user cancels update.

Added a limit parameter to the FieldStats function. This parameter limits the number of fields to include in the result.

Improved the error message when an ingest request times out.

Added granular IP Filter support for shared dashboards (BETA - API only).

Added warning logs when errors are rendered to browser during oAuth flows.

Remove caching of API calls to prevent caching of potential sensitive data.

Added exceptions to the Humio logs from AlertJob and ScheduledSearchJob.

Improved usability of the groups page.

Added a job that scans segments which are waiting to be archived, this value is recorded in the metric:s3-archiving-latency-max.

Added job which will periodically run a query and record how long it took. By default the query is count().

Added ability to override max auto shard count for a specific repository.

Allow the same view name across organizations.

Added analytics on query language feature use to the audit-log under the fields queryParserMetrics.

Allow the query scheduler to enqueue segments and aux files for download from bucket storage more regularly. This should ensure that queries fetching small aux files can more reliably keep the download job busy.

Improved Humio's detection of Kafka resets. We now load the Kafka cluster id once on boot. If it changes after that, the node will crash.

Fixed an issue that repeatedly tried to restart live queries from a given user upon the deletion of the user.

Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

Fixed an issue where the SegmentMoverJob could delete the local copy of a segment, if a pending download of the segment failed the CRC check. The job will now keep the downloaded file at a temporary path until the CRC check completes, to avoid deleting a local copy created by other jobs, e.g. by bucket downloads.

Fixed a number of instability issues in the query scheduler. The scheduler should now more reliably ensure that each query either completes, or is cancelled.

Reenable a feature to make Humio delete local copies of bucketed segments, even if they are involved in a query.

Fixed an issue where the digest coordinator could consider a host to be alive if the coordinator hadn't seen any timestamps from that host.

Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

Fixed a race condition that could cause digesters to calculate two different offsets during startup when determining where to start consuming, and which partially written segments to discard, which could lead to data loss when partially written segments were replayed from Kafka.

Reenable a feature to make Humio fetch and check hash files from bucket storage before fetching the segments.

Queries on views no longer restart when the ordering of the view's connections is changed.

Fixed a compatibility issue with Filebeat 7.16.0.

When interacting with the REST API for files, errors now have detailed error messages.

When starting ingest, Humio checks that the computed starting position in Kafka is below the Kafka end offset. Ensure that the end offset is requested after the starting position is computed, not before. This might prevent a very rare spurious boot failure.

When creating ingest and chatter topic, reduce desired max.message.bytes to what Kafka cluster allows, if that is lower than our desired values.

No longer allow requests to /hec to specify organizations by name. We now only accept IDs.

Make writes to Kafka's chatter topic block in a similar manner as writes to global.

Errors on alerts are now cleared more granularly. Errors when starting the alert query are cleared as soon as the query is successfully started, errors from polling the query are cleared when the query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

Code completion in the query editor now also works on the right hand side of :=.

Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

Errors on scheduled searches are now cleared more granularly. Errors when starting a query are cleared as soon as another query is successfully started, errors from polling a query are cleared when a query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

Fixed an issue in the Export to file dialog on the search page. It is now possible to export fields with spaces.

Fixed an issue where the Humio query URLs sent by actions would land users on the search page in editing mode for the alert or scheduled search that had triggered. Now, they still land on the search page, but not in editing mode.

Fixed Humio always reading and discarding an already processed message from the ingest queue on boot.

The action message templates {events_str} and {query_result_summary} always evaluate to the same string. To reflect this, the UI has been updated so that these templates are combined into the same item in the template overview for Email, Slack and Webhook actions.

Fixed an issue where live queries would sometimes double-count parts of the historic data.

Reduce noise in the log when the bucket storage upload job attempts to upload a file that is deleted concurrently.

For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

From the alerts overview and the scheduled searches overview, it is now possible to clear the error status on an alert or a scheduled search.

Fixed an issue where, if a custom parser was overriding a built-in parser, then the custom parser could accidentally be overwritten by creating a new parser with the same name.

Removed a spurious warning log when requesting a non-existent hash file from S3.

Fixed session() such that it works when events arrive out of time order.

Remove script-src: unsafe-eval from content security policy.

When bootstrapping a new cluster, set the cluster version in global right away. Since nodes will not boot on a snapshot that doesn't specify a cluster version, it is important that this field exists in all snapshots.

Query partition tables updates are now rejected if written by a node that is no longer the cluster leader.

The repository/.../query endpoint now returns a status code of .0 (BadRequest) when given an invalid query in some cases where previously it returned 503 (ServiceUnavailable).

The AlertJob and ScheduledSearchJob now only log validation errors from running the queries as warnings, previously, some of these were logged as errors.

The query endpoint API now supports languageVersion for specifying Humio query language versions.

Fixed an issue where nodes could request partitions from the query partitioning table that were not present.

SAML and OIDC only - During signout, Humio background tabs will be redirected to a signout landing page instead of to the login page.

Fixed an issue where repeating queries could cause other queries to fail.

Fixed an issue where MaxMind databases would only update if a license was present at startup and not if it was added later.

Fixed an issue in the Table widget. It will no longer insert 0-values for missing fields in integer columns. Empty fields will be shown consistently, independent of the column data type.

Bumped the Humio Docker containers to Java 17. If you manually set any --add-opens flags in your JVM config, you should remove them. The container should set the right flags automatically.

Fixed an issue where top would fail if the sum of the values exceeded 2^63-1. Exceeding sums are now pegged to 2^63-1.

Humio now tries to avoid interrupting threads during shutdown, instead allowing them to finish their work. This should reduce log noise when shutting down.

Make Humio handle missing aux files a little faster when downloading segments from bucket storage.

The /hec endpoint no longer responds to OPTIONS requests saying it supports GET requests. It doesn't and never has.

No longer allow organization- and system-level ingest tokens to ingest into sandbox and system repos.

Allow more dialogs in the UI to be closed with the Esc key.

Improved dark mode toggle button's accessibility.

Improved accessibility when choosing a theme.

Time selector is now accessible by keyboard.

New feature to select text in the search page event list and include/exclude that in the search query.

Disable the option to creating a view if the user does not have Connect a view permission on any repository. This is more intuitive than getting an empty dropdown of repositories to choose from.

Added ability to resize search page query field by dragging or fitting to query.

New dialogs for creation of parsers and dashboards.

Hovering over text within a query now shows the result of interpreting escape characters.

Improved the error messages when the GraphQL queries SearchDomain.alert, SearchDomain.action, and SearchDomain.savedQuery do not find the entity with the given ID.

When using ZOOKEEPER_URL_FOR_NODE_UUID for assignment of node ID to Humio nodes, and value of ZOOKEEPER_PREFIX_FOR_NODE_UUID (default /humio_autouuid) does not match contents of local UUID file, acquire a fresh node uuid.

Make ZOOKEEPER_URL optional. When not set, the zookeeper-status-logger job does not run, and the cluster administration page does not display information about a Zookeeper cluster.

New configuration BUCKET_STORAGE_MULTIPLE_ENDPOINTS and many configurations using STORAGE_2 as prefix. See Bucket Storage

Reduce default value of INGESTQUEUE_COMPRESSION_LEVEL, the ingest queue compression level from 1 to 0. This reduces time spent compressing before inserting into the ingest queue by roughly 4x at the expense of a 10-20% increase in size required in Kafka for the ingest queue topic.

Added INITIAL_FEATURE_FLAGS which lets you enable/disable feature flags on startup. For instance, setting INITIAL_FEATURE_FLAGS=+UserRoles,-UsagePage enables UserRoles and disables UsagePage.

Improved the default permissions on the group page by leaving their view expanded once the user cancels update.

Added a job that scans segments which are waiting to be archived, this value is recorded in the metric:s3-archiving-latency-max.

Added option to specify an IP Filter for which addresses hostname verification should not be made.

Added analytics on query language feature use to the audit-log under the fields queryParserMetrics.

Allow the query scheduler to enqueue segments and aux files for download from bucket storage more regularly. This should ensure that queries fetching small aux files can more reliably keep the download job busy.

Allow the same view name across organizations.

Added exceptions to the Humio logs from AlertJob and ScheduledSearchJob.

Added a limit parameter to the FieldStats function. This parameter limits the number of fields to include in the result.

Added granular IP Filter support for shared dashboards (BETA - API only).

Improved usability of the groups page.

Improved Humio's detection of Kafka resets. We now load the Kafka cluster id once on boot. If it changes after that, the node will crash.

Added warning logs when errors are rendered to browser during oAuth flows.

Improved the error message when an ingest request times out.

Added ability to override max auto shard count for a specific repository.

Added job which will periodically run a query and record how long it took. By default the query is count().

Humio now tries to avoid interrupting threads during shutdown, instead allowing them to finish their work. This should reduce log noise when shutting down.

The AlertJob and ScheduledSearchJob now only log validation errors from running the queries as warnings, previously, some of these were logged as errors.

Errors on scheduled searches are now cleared more granularly. Errors when starting a query are cleared as soon as another query is successfully started, errors from polling a query are cleared when a query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

SAML and OIDC only - During signout, Humio background tabs will be redirected to a signout landing page instead of to the login page.

Code completion in the query editor now also works on the right hand side of :=.

Reenable a feature to make Humio fetch and check hash files from bucket storage before fetching the segments.

Fixed an issue where repeating queries could cause other queries to fail.

Make Humio handle missing aux files a little faster when downloading segments from bucket storage.

From the alerts overview and the scheduled searches overview, it is now possible to clear the error status on an alert or a scheduled search.

For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

When creating ingest and chatter topic, reduce desired max.message.bytes to what Kafka cluster allows, if that is lower than our desired values.

Fixed an issue where, if a custom parser was overriding a built-in parser, then the custom parser could accidentally be overwritten by creating a new parser with the same name.

Fixed an issue where the Humio query URLs sent by actions would land users on the search page in editing mode for the alert or scheduled search that had triggered. Now, they still land on the search page, but not in editing mode.

Errors on alerts are now cleared more granularly. Errors when starting the alert query are cleared as soon as the query is successfully started, errors from polling the query are cleared when the query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

Reenable a feature to make Humio delete local copies of bucketed segments, even if they are involved in a query.

No longer allow requests to /hec to specify organizations by name. We now only accept IDs.

Bumped the Humio Docker containers to Java 17. If you manually set any --add-opens flags in your JVM config, you should remove them. The container should set the right flags automatically.

Fixed an issue in the Table widget. It will no longer insert 0-values for missing fields in integer columns. Empty fields will be shown consistently, independent of the column data type.

Make writes to Kafka's chatter topic block in a similar manner as writes to global.

When starting ingest, Humio checks that the computed starting position in Kafka is below the Kafka end offset. Ensure that the end offset is requested after the starting position is computed, not before. This might prevent a very rare spurious boot failure.

Removed a spurious warning log when requesting a non-existent hash file from S3.

No longer allow organization- and system-level ingest tokens to ingest into sandbox and system repos.

Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

Fixed a race condition that could cause digesters to calculate two different offsets during startup when determining where to start consuming, and which partially written segments to discard, which could lead to data loss when partially written segments were replayed from Kafka.

Fixed session() such that it works when events arrive out of time order.

Fixed an issue where nodes could request partitions from the query partitioning table that were not present.

The repository/.../query endpoint now returns a status code of .0 (BadRequest) when given an invalid query in some cases where previously it returned 503 (ServiceUnavailable).

Fixed an issue where the digest coordinator could consider a host to be alive if the coordinator hadn't seen any timestamps from that host.

Fixed a compatibility issue with Filebeat 7.16.0.

The query endpoint API now supports languageVersion for specifying Humio query language versions.

Fixed an issue in the Export to file dialog on the search page. It is now possible to export fields with spaces.

Query partition tables updates are now rejected if written by a node that is no longer the cluster leader.

Queries on views no longer restart when the ordering of the view's connections is changed.

Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

The action message templates {events_str} and {query_result_summary} always evaluate to the same string. To reflect this, the UI has been updated so that these templates are combined into the same item in the template overview for Email, Slack and Webhook actions.

Fixed an issue where top would fail if the sum of the values exceeded 2^63-1. Exceeding sums are now pegged to 2^63-1.

Fixed an issue where MaxMind databases would only update if a license was present at startup and not if it was added later.

Reduce noise in the log when the bucket storage upload job attempts to upload a file that is deleted concurrently.

Fixed a number of instability issues in the query scheduler. The scheduler should now more reliably ensure that each query either completes, or is cancelled.

Fixed an issue where live queries would sometimes double-count parts of the historic data.

When bootstrapping a new cluster, set the cluster version in global right away. Since nodes will not boot on a snapshot that doesn't specify a cluster version, it is important that this field exists in all snapshots.

The /hec endpoint no longer responds to OPTIONS requests saying it supports GET requests. It doesn't and never has.

Fixed Humio always reading and discarding an already processed message from the ingest queue on boot.

Fixed an issue that repeatedly tried to restart live queries from a given user upon the deletion of the user.

Fixed an issue where the SegmentMoverJob could delete the local copy of a segment, if a pending download of the segment failed the CRC check. The job will now keep the downloaded file at a temporary path until the CRC check completes, to avoid deleting a local copy created by other jobs, e.g. by bucket downloads.

Remove script-src: unsafe-eval from content security policy.

Performance improvements of Ingest and internal caching.

Updated dependencies to follow-redirects for CVE-2022-0155.

Fixes an issue with epoch and offsets not always being stripped from segments.

Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

Updated dependencies to Jawn for CVE-2022-21653.

Updated dependencies to node-fetch for CVE-2022-0235.

Fixed an issue where live queries would sometimes double-count parts of the historic data.

Updated dependencies to nanoid for CVE-2021-23566.

Updated dependencies to Akka for CVE-2021-42697.

Updated dependencies to Netty to fix CVE-2021-43797

Updated dependencies to log4j 2.17.1 to fix CVE-2021-44832 and CVE-2021-45105

Updated dependencies to Jackson to fix a weakness

Added buttons for stopping all queries, streaming queries, and historical queries from inside the query monitor.

Validation error messages are now more precise and have improved formatting.

Updated the links for Privacy Notice and Terms and Conditions.

The overall look of message boxes in Humio has been updated.

Added autofocus to the first field when opening a dialog using the save as functionality from the Search page.

Added maximum width to tabs on the Group page, so they do not keep expanding forever.

Allow resize of columns in the event list by mouse.

Dark mode is officially deemed stable enough to be out of beta.

Disable actions if permissions are handled externally.

Added GraphQL mutation clearRecentQueries which a user can run to clear their recent queries in a specific view or repository.

The GraphQL field isEventForwardingEnabled on the HumioMetadata type is deprecated, as it is no longer in use internally. If you rely on this, please let us know.

Changed old personal user token implementation to hash based.

Renamed the deleteEvents related GraphQL mutations and queries to redactEvents. The redactEvents API is intended for redacting sensitive data from a repository, not for bulk deletion of events. We think the new name invites fewer misunderstandings.

Added three GraphQL mutations for stopping queries: stopAllQueries, stopStreamingQueries, and stopHistoricalQueries.

Added 2-phase migration that will allow old user api tokens to be used and clean global from secrets after a 30 day period.

When checking if the ViewAction.EventForwarding action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if the event forwarding is not enabled on the server.

Improved shutdown logic slightly, helping prevent thread pools from getting stuck or logging spurious errors during shutdown.

Added new metric: bucket-storage-upload-latency-max. It shows the amount of time spent for the event that that has been pending for upload to bucket storage the longest.

Refactored query functions join, selfjoin, and selfjoinfilter into user-visible and internal implementations.

Added management API to put hosts in maintenance mode.

New metric: ingest-request-delay. Histogram of ingest request time spent being delayed due to exceeding limit on concurrent processing of ingest (milliseconds).

Node roles can now be assigned/removed at runtime.

Added validation and a more clear error message for queries with a time span of 0.

Retention based on compressed size will no longer account for segment replication.

Made the transfer coordinator display more clear errors instead of an internal server error for multinode clusters.

Added Australian states to the States dropdown.

Improved partition layout auto-balancing algorithm.

Added support in the humio event collector for organization- and system-wide ingest tokens and the ability to use a parser from a different repo than the one being ingested into.

It is now possible to create actions, alerts, scheduled searches, and parsers from Yaml template files.

Query validation has been improved to include several errors which used to first show up after submitting search.

Reduce limit on number of datasources for sandbox repositories created when a user is created to .0 by default.

Improved the error reporting when installing, updating or exporting a package fails.

Added "export as yaml" function to the list pages of parsers, actions and scheduled searches.

Improved error messages when an invalid regular expression is used in replace.

Minor optimization when using groupBy with a single field.

Prepopulate email field when invited user is filling in a form with this information.

Added checksum verification within hash filter files on read.

Improved handling of multiple nodes attempting to create views with the same names at the same time, as might happen when bootstrapping a cluster.

Added a precondition that ensures that the number of ingest partitions cannot be reduced.

A compressed segment with a size of 1GB will now always count for retention as 1 GB. Previously, a compressed segment with a size of 1GB might count for more than 1GB when calculating retention, if that segment had more replicas than configured. The effect on the retention policy was that if you had configured retention of .0GB compressed bytes, Humio might retain less than .0GB of compressed data if any of those segments had too many replicas.

It is now possible to ingest logs into Humio using LogStash v.7.13 and upwards.

Improved performance of the query functions drop() and rename() by quite a bit.

Added a minSpan parameter to timechart() and bucket(), which can be used to specify a minimum span when using a short time interval.

The kvParse() query function can now parse unquoted empty values using the new parameter separatorPadding to specify if your data has whitespace around the key-value separator (typically =). The default is "Unknown", which will leave the functionality of the function unchanged.

Added a communityID function for calculating hashes of network flow tuples according to the [Community ID Spec](https://github.com/corelight/community-id-spec).

Added query function math:arctan2 to the query language.

Create, update, and delete of dashboards is now audit logged.

Query editor: improved code completion of function names.

Reword regular expression related error messages.

Added metric for the number of currently running streaming queries.

When an alert query encounters a warning and Humio is not configured to trigger alerts despite warnings (ALERT_DESPITE_WARNINGS=true, see [docs](https://library.humio.com/preview/docs/automated/alerts/throttle-period/#errors-warnings)), the warning text will now be shown as an error message on the alert in the UI.

Fixed an issue where a dashboard installed with a YAML file could be slightly different than what was specified in the file.

Fixed an issue where clicking on the counters of parsed events on the Parsers page would open an empty search page, except for built-in parsers. Now, it correctly shows the latest parsed events for all parsers (except package parsers).

Fixed a bug where shared lookup files could not be downloaded from the UI.

Fixed an issue where series() failed to serialize its state properly.

Alerts and scheduled searches are now enabled per default when created. The check disabling these entities if no actions are attached has been replaced with a warning, which informs a user that even though the entity is enabled, nothing will trigger since no actions are attached.

Fixed an issue that in rare cases would cause login errors.

Changes to the state of IOC access on organizations are now reflected in the audit log.

Fixed styling issue on the search page where long errors would overflow the screen.

Fixed an issue when adding a group to a repository or view than an error message is displayed when the user is not the organization owner or root.

Fixed an issue where missing undersized segments in a datasource might cause Humio to repeatedly transfer undersized segments between nodes.

Fixed an issue where comments spanning multiple lines wouldn't be colored correctly.

Changed field type for zip codes.

Fixed an issue where a failing event forwarder would be cached indefinitely and could negatively impact Humio performance.

Changes to the state of backend feature flags are now reflected in the audit log.

Fixed an issue where some regexes could not be used.

Fixed an issue where a scheduled search failed and was retried, if it had multiple actions and at least one action was unknown to Humio. Now, the unknown action is logged, but the scheduled search completes successfully and continues to the next scheduled run.

Fixed an issue where the web client could start queries from the beginning of time when scrolling backwards through events in the UI.

Fixed a compatibility issue with Filebeat 7.16.0

Fixed some widgets on dashboards reporting errors while waiting for data to load.

Fixed an issue on on-prem trial license that would use user count limits from cloud.

Fixed an edge case where Humio might create multiple copies of the same datasource when the number of Kafka partitions is changed. The fix ensures only one copy will be created.

Fixed an issue where OIDC without a discovery endpoint would fail to configure if OIDC_TOKEN_ENDPOINT_AUTH_METHOD was not set.

Updated dependencies to log4j 2.16 to remove of message lookups (CVE-2021-44228 and CVE-2021-45046)

Fixed an issue where the segment merger would write that the current node had a segment slightly before registering that segment in the local node.

The field vhost in internal Humio logging is now reserved for denoting the host logging the message. Other uses of vhost now uses the field hostId.

Fixed an issue where streaming (exporting) query results in JSON format could include extra "," characters within the output.

Include view+parser-name in thread dumps when time is spent inside a parser.

Addressed an issue causing Humio to sometimes error log an ArrayIndexOutOfBoundsException during shutdown.

Fixed an issue causing Humio running on Java 16+ to return incorrect search results when the input query contains Unicode surrogate pairs (e.g. when searching for an emoji).

Browser storage is now cleared when initiating while unauthenticated.

Fixed incorrect results when searching through saved queries and recent queries.

Remove the ability to create ingest tokens and ingest listeners on system repositories.

Removed a spurious warning log when requesting a non-existent hash file from S3.

Fixed an issue where an alert would not be throttled until after its actions had completed, which could make the alert trigger multiple times shortly after each other if an action was slow. Now, the alert is throttled as soon as it triggers.

Temporary fix of issue with live queries not having first aggregator as bucket() or timechart(), but then later in the query having those as a second aggregator. As a temporary fix, such queries will fail. In later releases, this will get fixed more properly.

Fixed an issue where the SegmentMoverJob could delete the local copy of a segment, if a pending download of the segment failed the CRC check. The job will now keep the downloaded file at a temporary path until the CRC check completes, to avoid deleting a local copy created by other jobs, e.g. by bucket downloads.

Fixed a bug in the validation of the ‘bits’ parameter of hashMatch() and hashRewrite().

Support Java 17.

Fixed a bug where query coordination partitions would not get updated.

When checking if the ViewAction.ChangeRepoConnections action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if checked on a repository, as the action only makes sense on views.

Fixed a bug where invalid UTF-16 characters could not be ingested. They are now converted to 'ufffd'.

Fixed an issue where certain problems would highlight the first word in a query.

Fixed a bug with the cache not being populated between restarts on single node clusters.

Removed error query param from URL when entering Humio.

Fixed an issue on sandbox renaming, that would allow you to rename a sandbox and end up in a bad state.

Use a fresh (random) name for the tmp folder below the datadir to ensure that it is a proper subdir of the datadir and not a mount point.

Changed default package type to "application" on the export package wizard.

Fixed a number of stability issues with the event redaction job.

Alerts and scheduled searches are no longer run on cloud for organizations with an expired trial license, and on-prem for any expired license.

When creating or updating an action, the backend now verifies that the host url associated with the action is prefixed with either 'http://' or 'https://'. This affects Actions of the type: Webhook, OpsGenie, Single-Channel Slack and VictorOps.

Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

Fixed an issue where error messages would show wrong input.

Fixed an issue where a digest node could be unable to rejoin the cluster after being shut down if all other digest nodes were also down at the time.

When performing jobs triggered via the Redact Events API, Humio could restart queries for unrelated views until the delete job completed. This has been improved, so only views affected by the delete will be impacted.

Fixed a bug where only part of the Users page was loading when navigating from the All organizations page.

Fixed an issue where release notes would not close when a release is open.

Fixed an issue in the interactive tutorial.

Crash the node if any of a number of critical threads die. This should help prevent zombie nodes.

No longer return the "Query Plan" in responses, but return a hash in the new field hashedQueryOnView instead. The plan could leak information not otherwise visible to the user, such as query prefixes being applied.

When checking if the ViewAction.ChangeS3ArchivingSettings action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if checked on a view, as the action only makes sense on repositories.

Fixed a bug where offsets from one Kafka partition could be used when deciding where to start consuming for another partition, in the case where there were too many datasources in the repo. This led to a crash loop when the affected node was restarted.

Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

Fixed an issue where the segment merger could mishandle errors during merge.

Fixed an issue where sort() would cause events to be read ina non-optimal order for the entire query.

When a digester fails to start, rather than restarting the JVM as previous releases did, keep retrying to start assuming that the issue is transient, such as data for a single ingest partition being unavailable for a short while. While in this situation the process reports the metric for ingest latency on the affected partitions as being uptime of the JVM process at this point. The idea is to signal that data is not flowing on those partitions, so that a monitored metric can raise an alarm somewhere. In lack of a proper latency in this situation, it's better to have a growing non-zero metrics than having the metrics being zero.

Prevent unauthorized analytics requests being sent.

Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

Fixed a compatibility issue with Filebeat 7.16.0

Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

Fixed an issue that in rare cases would cause login errors.

Fixed an issue in the interactive tutorial.

Fixed an issue where an alert would not be throttled until after its actions had completed, which could make the alert trigger multiple times shortly after each other if an action was slow. Now, the alert is throttled as soon as it triggers.

Reverted from 1.33.0 Errors on alerts, which are shown in the alert overview, are now only cleared when either the alert query is updated by a user or the alert triggers. Previously, errors that occurred when actions were triggered would be removed when the alert no longer triggered. Now, they will be displayed until the actions trigger successfully. Conversely, errors that occur when running the query may now remain until the next time the alert triggers, where they would previously be removed as soon as the query run again without errors.

See original release note entry in 1.33.0

Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

Updated a dependency to a version fixing a critical bug.

Allow resize of columns in the event list by mouse.

Disable actions if permissions are handled externally.

Dark mode is officially deemed stable enough to be out of beta.

Added autofocus to the first field when opening a dialog using the save as functionality from the Search page.

Validation error messages are now more precise and have improved formatting.

The overall look of message boxes in Humio has been updated.

Added buttons for stopping all queries, streaming queries, and historical queries from inside the query monitor.

Added maximum width to tabs on the Group page, so they do not keep expanding forever.

Updated the links for Privacy Notice and Terms and Conditions.

Renamed the deleteEvents related GraphQL mutations and queries to redactEvents. The redactEvents API is intended for redacting sensitive data from a repository, not for bulk deletion of events. We think the new name invites fewer misunderstandings.

Added GraphQL mutation clearRecentQueries which a user can run to clear their recent queries in a specific view or repository.

Changed old personal user token implementation to hash based.

The GraphQL field isEventForwardingEnabled on the HumioMetadata type is deprecated, as it is no longer in use internally. If you rely on this, please let us know.

Added three GraphQL mutations for stopping queries: stopAllQueries, stopStreamingQueries, and stopHistoricalQueries.

Added 2-phase migration that will allow old user api tokens to be used and clean global from secrets after a 30 day period.

When checking if the ViewAction.EventForwarding action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if the event forwarding is not enabled on the server.

Added a minSpan parameter to timechart() and bucket(), which can be used to specify a minimum span when using a short time interval.

Improved performance of the query functions drop() and rename() by quite a bit.

Reword regular expression related error messages.

A compressed segment with a size of 1GB will now always count for retention as 1 GB. Previously, a compressed segment with a size of 1GB might count for more than 1GB when calculating retention, if that segment had more replicas than configured. The effect on the retention policy was that if you had configured retention of .0GB compressed bytes, Humio might retain less than .0GB of compressed data if any of those segments had too many replicas.

It is now possible to create actions, alerts, scheduled searches, and parsers from Yaml template files.

Added validation and a more clear error message for queries with a time span of 0.

Made the transfer coordinator display more clear errors instead of an internal server error for multinode clusters.

Added management API to put hosts in maintenance mode.

Refactored query functions join, selfjoin, and selfjoinfilter into user-visible and internal implementations.

Improved shutdown logic slightly, helping prevent thread pools from getting stuck or logging spurious errors during shutdown.

Create, update, and delete of dashboards is now audit logged.

Added Australian states to the States dropdown.

Added support in the humio event collector for organization- and system-wide ingest tokens and the ability to use a parser from a different repo than the one being ingested into.

Improved handling of multiple nodes attempting to create views with the same names at the same time, as might happen when bootstrapping a cluster.

Added metric for the number of currently running streaming queries.

Added new metric: bucket-storage-upload-latency-max. It shows the amount of time spent for the event that that has been pending for upload to bucket storage the longest.

Node roles can now be assigned/removed at runtime.

Query validation has been improved to include several errors which used to first show up after submitting search.

Improved error messages when an invalid regular expression is used in replace.

Minor optimization when using groupBy with a single field.

Query editor: improved code completion of function names.

Added "export as yaml" function to the list pages of parsers, actions and scheduled searches.

Reduce limit on number of datasources for sandbox repositories created when a user is created to .0 by default.

Added a communityID function for calculating hashes of network flow tuples according to the [Community ID Spec](https://github.com/corelight/community-id-spec).

Improved partition layout auto-balancing algorithm.

Added checksum verification within hash filter files on read.

It is now possible to ingest logs into Humio using LogStash v.7.13 and upwards.

Prepopulate email field when invited user is filling in a form with this information.

Improved the error reporting when installing, updating or exporting a package fails.

Retention based on compressed size will no longer account for segment replication.

New metric: ingest-request-delay. Histogram of ingest request time spent being delayed due to exceeding limit on concurrent processing of ingest (milliseconds).

Added a precondition that ensures that the number of ingest partitions cannot be reduced.

Added query function math:arctan2 to the query language.

The kvParse() query function can now parse unquoted empty values using the new parameter separatorPadding to specify if your data has whitespace around the key-value separator (typically =). The default is "Unknown", which will leave the functionality of the function unchanged.

Fixed an issue where some regexes could not be used.

Temporary fix of issue with live queries not having first aggregator as bucket() or timechart(), but then later in the query having those as a second aggregator. As a temporary fix, such queries will fail. In later releases, this will get fixed more properly.

No longer return the "Query Plan" in responses, but return a hash in the new field hashedQueryOnView instead. The plan could leak information not otherwise visible to the user, such as query prefixes being applied.

Changed default package type to "application" on the export package wizard.

Fixed an issue where release notes would not close when a release is open.

Errors on alerts, which are shown in the alert overview, are now only cleared when either the alert query is updated by a user or the alert triggers. Previously, errors that occurred when actions were triggered would be removed when the alert no longer triggered. Now, they will be displayed until the actions trigger successfully. On the other hand, errors that occur when running the query may now remain until the next time the alert triggers, where they would previously be removed as soon as the query run again without errors. This change was reverted in 1.33.1.

Fixed incorrect results when searching through saved queries and recent queries.

Fixed a bug where only part of the Users page was loading when navigating from the All organizations page.

Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

Changed field type for zip codes.

Fixed an edge case where Humio might create multiple copies of the same datasource when the number of Kafka partitions is changed. The fix ensures only one copy will be created.

Fixed an issue when adding a group to a repository or view than an error message is displayed when the user is not the organization owner or root.

Fixed a bug where query coordination partitions would not get updated.

Fixed an issue where comments spanning multiple lines wouldn't be colored correctly.

Fixed styling issue on the search page where long errors would overflow the screen.

Browser storage is now cleared when initiating while unauthenticated.

When checking if the ViewAction.ChangeS3ArchivingSettings action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if checked on a view, as the action only makes sense on repositories.

Fixed an issue causing Humio running on Java 16+ to return incorrect search results when the input query contains Unicode surrogate pairs (e.g. when searching for an emoji).

When a digester fails to start, rather than restarting the JVM as previous releases did, keep retrying to start assuming that the issue is transient, such as data for a single ingest partition being unavailable for a short while. While in this situation the process reports the metric for ingest latency on the affected partitions as being uptime of the JVM process at this point. The idea is to signal that data is not flowing on those partitions, so that a monitored metric can raise an alarm somewhere. In lack of a proper latency in this situation, it's better to have a growing non-zero metrics than having the metrics being zero.

Fixed some widgets on dashboards reporting errors while waiting for data to load.

Fixed a bug in the validation of the ‘bits’ parameter of hashMatch() and hashRewrite().

Fixed an issue where a failing event forwarder would be cached indefinitely and could negatively impact Humio performance.

Fixed an issue where certain problems would highlight the first word in a query.

Removed error query param from URL when entering Humio.

Fixed an issue where series() failed to serialize its state properly.

Fixed a number of stability issues with the event redaction job.

When checking if the ViewAction.ChangeRepoConnections action is allowed (with e.g. SearchDomain.isActionAllowed), the answer will now be false if checked on a repository, as the action only makes sense on views.

Fixed an issue where a digest node could be unable to rejoin the cluster after being shut down if all other digest nodes were also down at the time.

Use a fresh (random) name for the tmp folder below the datadir to ensure that it is a proper subdir of the datadir and not a mount point.

Fixed an issue where a scheduled search failed and was retried, if it had multiple actions and at least one action was unknown to Humio. Now, the unknown action is logged, but the scheduled search completes successfully and continues to the next scheduled run.

Fixed an issue where a dashboard installed with a YAML file could be slightly different than what was specified in the file.

Fixed an issue where sort() would cause events to be read ina non-optimal order for the entire query.

Include view+parser-name in thread dumps when time is spent inside a parser.

Fixed an issue where error messages would show wrong input.

Changes to the state of backend feature flags are now reflected in the audit log.

When creating or updating an action, the backend now verifies that the host url associated with the action is prefixed with either 'http://' or 'https://'. This affects Actions of the type: Webhook, OpsGenie, Single-Channel Slack and VictorOps.

Crash the node if any of a number of critical threads die. This should help prevent zombie nodes.

Fixed a bug where invalid UTF-16 characters could not be ingested. They are now converted to 'ufffd'.

Addressed an issue causing Humio to sometimes error log an ArrayIndexOutOfBoundsException during shutdown.

Fixed an issue where the SegmentMoverJob could delete the local copy of a segment, if a pending download of the segment failed the CRC check. The job will now keep the downloaded file at a temporary path until the CRC check completes, to avoid deleting a local copy created by other jobs, e.g. by bucket downloads.

When performing jobs triggered via the Redact Events API, Humio could restart queries for unrelated views until the delete job completed. This has been improved, so only views affected by the delete will be impacted.

Fixed an issue on sandbox renaming, that would allow you to rename a sandbox and end up in a bad state.

Alerts and scheduled searches are no longer run on cloud for organizations with an expired trial license, and on-prem for any expired license.

When an alert query encounters a warning and Humio is not configured to trigger alerts despite warnings (ALERT_DESPITE_WARNINGS=true, see [docs](https://library.humio.com/preview/docs/automated/alerts/throttle-period/#errors-warnings)), the warning text will now be shown as an error message on the alert in the UI.

Support Java 17.

Prevent unauthorized analytics requests being sent.

Fixed an issue where OIDC without a discovery endpoint would fail to configure if OIDC_TOKEN_ENDPOINT_AUTH_METHOD was not set.

The field vhost in internal Humio logging is now reserved for denoting the host logging the message. Other uses of vhost now uses the field hostId.

Fixed a bug with the cache not being populated between restarts on single node clusters.

Fixed an issue where the web client could start queries from the beginning of time when scrolling backwards through events in the UI.

Alerts and scheduled searches are now enabled per default when created. The check disabling these entities if no actions are attached has been replaced with a warning, which informs a user that even though the entity is enabled, nothing will trigger since no actions are attached.

Removed a spurious warning log when requesting a non-existent hash file from S3.

Remove the ability to create ingest tokens and ingest listeners on system repositories.

Fixed a bug where shared lookup files could not be downloaded from the UI.

Fixed a bug where offsets from one Kafka partition could be used when deciding where to start consuming for another partition, in the case where there were too many datasources in the repo. This led to a crash loop when the affected node was restarted.

Fixed an issue where the segment merger could mishandle errors during merge.

Fixed an issue on on-prem trial license that would use user count limits from cloud.

Fixed an issue where the segment merger would write that the current node had a segment slightly before registering that segment in the local node.

Changes to the state of IOC access on organizations are now reflected in the audit log.

Fixed an issue where missing undersized segments in a datasource might cause Humio to repeatedly transfer undersized segments between nodes.

Fixed an issue where clicking on the counters of parsed events on the Parsers page would open an empty search page, except for built-in parsers. Now, it correctly shows the latest parsed events for all parsers (except package parsers).

Fixes issue with epoch and offsets not always being stripped from segments.

Performance improvements of Ingest and internal caching.

Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

Updated dependencies to Akka to fix CVE-2021-42697.

Updated dependencies to jawn to fix CVE-2022-21653.

Updated dependencies to Jackson to fix a weakness

Updated dependencies to log4j 2.17.1 to fix CVE-2021-44832 and CVE-2021-45105

Updated dependencies to Netty to fix CVE-2021-43797

Fixed issue where streaming (exporting) query results in JSON format could include extra "," characters within the output.

Updated dependencies to log4j 2.16 to remove of message lookups (CVE-2021-45046)

Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

Fixed a compatibility issue with Filebeat 7.16.0

Fixed an issue that would result in a query not completing when one of the involved segments was deleted locally while the query was running. This could happen on clusters using bucket storage with more data than fits the local disks.

Updated a dependency to a version fixing a critical bug.

Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

Security fix.

It is now possible to ingest logs into Humio using LogStash v.7.13 and upwards.

Removed a spurious warning log when requesting a non-existent hash file from S3.

Removed the pop-up link to edit an alert or scheduled search when on the form page. This link is only relevant when creating an entity from the search page via a dialog.

Updated the style of the email action template and made the wording used dependent on whether an alert or scheduled search was triggered.

Fixed some styling issue on Query Quotas page.

Cluster management pages style updates.

Breadcrumbs are aligned across all pages and show the package name with a link when viewing or editing an asset from a package.

The left navigation menu hides, and can be opened again, for mobile devices, on organization settings pages and repository settings pages.

The signup path was removed, together with the corresponding pages.

Identity provider pages style update.

Updated design for Package Marketplace and Installed Packages to make them easier to use and more consistent.

Added a GraphQL mutation "cancelDeleteEvents" that allows cancelling a previously submitted deletion. Cancellation is best-effort, and events that have already been deleted will not be restored.

Deprecates the package field on the SearchDomain GraphQL type, in favor of packageV2. The new field has a simpler and more correct return type.

When using the GraphQL field allowedViewActions, the two previously deprecated actions ChangeAlertsAndNotifiers and ReadEvents are no longer returned. Look for their replacements ChangeTriggersAndActions and ReadContents instead.

Added information about the use of preview fields in the result from calling the GraphQL API. The information will be in the field extensions.preview and will be a list of objects with a name and reason field.

Deprecates the two GraphQL fields id and contentHash on the File type. The two fields are considered unused, so no alternatives are provided. If you rely on them, please let us know.

The GraphQL DateTime type now supports non-UTC time. Timestamps like 2021-07-18T14:13:09.517+02.0 are now legal, and will be converted to UTC time internally.

Extended 'Relative' field type for schema files to include support for the value 'now'.

The name, displayName, and location GraphQL fields on the File type are deprecated in favor of the new nameAndPath field.

Deprecates the copyFile GraphQL mutation, as it is no longer used. If you use this mutation, please let us know.

Deprecates the installPackageFromRegistry and updatePackageFromRegistry GraphQL mutations in favor of installPackageFromRegistryV2 and updatePackageFromRegistryV2.

The fileName, displayName, and location GraphQL fields on the UploadedFileSnapshot type are deprecated in favor of the new nameAndPath field.

On a node configured as USING_EPHEMERAL_DISKS=true allow the local disk management deleting files even if a query may need them later, as the system is able to re-fetch the files from bucket storage when required. This improves the situation when there are active queries that in total have requested access to more segments than the local disk can hold.

Added compatibility mode for using IBM Cloud Object Storage as bucket storage via S3_STORAGE_IBM_COMPAT

The Scheduled Searches feature is no longer in beta and can be used by all users without enabling it first

The test action functionality no longer uses alert terminology, as actions can be invoked from both alerts and scheduled searches. Also, it is now possible to also test the scheduled search specific message templates using it.

Added focus states to text field, selection and text area components.

New metric: "ingest-request-delay". Histogram of ingest request time spent being delayed due to exceeding limit on concurrent processing of ingest.

Improved handling of local disk space relative to `LOCAL_STORAGE_MIN_AGE_DAYS`: When the local disk would overflow by respecting that config, Humio can now delete the oldest local segments that are present in bucket storage, even when they are within that time range.

When selecting actions for alerts or scheduled searches, the actions are now grouped by the package they were imported from.

Raise size limit on ingest requests from 8MB to 1 GB

Added loading and error states to the page where user selects to create a new repository or view.

Added maximum width to tabs on the Group page, so they do not keep expanding forever.

You can now export and import packages containing any of the action types: Webhook, Email, Humio Repo, Pager Duty, Slack, Slack multi channel, Ops Genie and Victor Ops.

Added Dark Mode for Query Monitor page.

Allow launching using JDK-16.

Humio docker images is now based on the Alpine linux.

Warnings when running scheduled searches now show up as errors in the scheduled search overview page if [SCHEDULED_SEARCH_DESPITE_WARNINGS](https://library.humio.com/preview/reference/environment-variables/#var-scheduled-search-despite-warnings) is set to 'false' (the default).

Fixed an issue with using the browser back button while "advanced editing" the query text of a scheduled search or an alert would hide the blue bar that allows saving the query.

Scheduled search "schedule" is explained using human readable text such as "At 9.30 on Tuesdays".

Scheduled search "schedule" field is now validated, showing accurate help for each part of the crontab expression.

Improved search for users page.

Limit pending ingest requests by rejecting excess invocations. Rejections are signalled as status 429 "Too many requests" and a Retry-After header suggesting to retry in 5 seconds. Limiting starts when queued requests exceed INGEST_REQUEST_LIMIT_PCT of the total heap size, default is 5.

Added support for including dashboard and alert labels when exporting a package.

Improved audit log for organization creation.

Added explicit distribution information for elastic bulk API for elasticsearch API compatibility.

Improved error handling when running scheduled searches, so that a failed schedules search will be retried as long as it is within the [backfill limit](https://library.humio.com/preview/docs/automated/scheduled-search/#backfill-limit).

Added support for importing packages with CSV and JSON files. Exporting packages with files is not fully supported yet, but will be in a future release.

Improved performance in IP database lookups for the functions ipLocation(), asn() and worldMap().

Added a Data subprocessors page under account.

Package installation error messages are now much more readable.

Fixed an issue where Humio attempted to fetch global from other nodes before TLS was initialized.

When accessing Humio through a URL with either a repository or view name in it and using an ingest token, it is now checked that the view on the token matches the repository or view in the URL, and a 403 Forbidden status is returned, if not.

Fixed an issue with the split() function which caused incorrect (usually, too few) query results in some cases where the output fields were refered to later in the query.

Fixed an issue where Shift+Enter would select the current completion rather than adding a newline.

Updated the examples on how to use the match() query function in the inline documentation.

Fixed a bug causing the disk space job to use an expensive code path even when a cheaper one was available.

Fixed an issue where Humio would create auxiliary files (hash files) for segments unnecessarily when moving segments between nodes.

Fixed an issue that caused some errors to be hidden behind a message about "internal error".

When a search is able to filter out segments based on the hash filter files, and a segment file is not present locally on any node, fetch only the hash filter at first, evaluate that, and only if required, fetch the segment file. This speeds up searches that target segments only present in bucket storage and that have search filters that generate hash filter checks, such as regex and literal text comparisons.

Fixed a bug where a 404 Not Found status on an internal endpoint would be incorrectly reported as an 401 Unauthorized.

Fixed an issue where it was possible to submit queries to the Delete Events API that were not valid for that API. Only pure filtering queries are allowed.

Fixed an issue where the job responsible for deleting segment files off nodes was not deleting as many segments as it should.

The DiskSpaceJob now removes newly written backfilled segments off the local disk before it chooses to remove non-backfilled segments.

Fixed an issue where the query scheduler would spend too much time "shelving" queries, and not enough on getting them executed, leading to little progress on queries.

Fixed an issue where the job responsible for deleting segment files off nodes was not running as often as expected.

Updated dependencies with security fixes.

Amended an internal limit on how many segments can be fetched from bucket storage concurrently. The old limit was based on the number of running queries. The new limit is 32.

Fixed thread safety for a variable involved in fetching from bucket storage for queries.

Fixed an issue - when creating a repository a user is automatically assigned a role but isn't able to see himself in the roles list. Also, when editing roles the assignment is not counted correctly under usage.

Fixed an issue where new groups added to a repository got a query prefix that disallowed search. The default is now to allow search with the queryprefix *.

Fixed an issue where certain problems highlighted the first word in a query, not the location of the problem.

Updated the new asset dialog button text so that it will say 'Continue' when an asset will not be created directly.

Updated Elastic ingest endpoint to accept 'create' operations in addition to 'index' operations. Both operation types result in the same ingest behavior. This update was added as Fluent-Bit v1.8.3 began using the 'create' operation rather than 'index' for ingest.

Updated Slack action for messaging multiple channels, so it propogates errors when triggered. Previously errors were ignored.

Fixed an issue where Humio would create a broken hash file for the merge result when merging minisegments that did not originally have hash files.

Fixed an issue where the DiskSpaceJob could mark segments accessed slightly out of order during boot.

Truncate long user names on the Users page.

Cloning an asset now redirects you to the edit page for the asset for all assets.

Fixed a bug on queries that triggered an error while executing due to the input (such as a regex that exceeds limits on execution time) could result in the client getting 404 as status on poll, where it should get .0.

Removed an old Cloud Signups page. The page is not necessary since organizations were implemented for the Cloud environments.

Fixed an issue where the global consistency check job would fail to perform the consistency check, instead logging lines like "Global dump requested but global had expired". This line can still occur, but only when the consistency check takes too long.

Global snapshots are now uploaded to bucket storage more often when there are a lot of updates to it, leading to shorter replay times on startup.

The DiskSpaceJob no longer initializes based off of the segment last-modified timestamp, this only happens if no access order snapshot is stored locally. If a snapshot is present, we trust that.

Fixed an issue where the DiskSpaceJob could continue tracking segments if they were deleted from global, but the files were still present locally.

The simple and advanced permission model has been merged, thus allowing users who were using the simple permission model to create their own permission roles and groups, create groups with default roles, and all other features that were previously only available in advanced permissions mode.

Creating a new dashboard now opens it after creation.

Fixed an issue that could cause UploadedFileSyncJob to crash if an uploaded file went missing.

Fixed an issue where, looking at GraphiQL, the dropdown from the navigation menu was partially hidden.

Fixed an issue where metrics of type gauge with a double value were not reported to the humio-metrics repository, but only to the humio repository.

Split package export page into dialog with multiple steps.

Reworded a confusing error message when using the top() function with a limit parameter exceeding the limits configured with TOP_K_MAX_MAP_SIZE_HISTORICAL or TOP_K_MAX_MAP_SIZE_LIVE.

Security when viewing installed packages and packages on the marketplace are now less strict. Permissions are still required for installing and uninstalling packages.

Introduced a check for compatibility for packages and humio versions.

Fixed a bug where a hidden field named "#humioAutoShard" would sometimes show up in the field list.

Fixed an issue that caused some metrics of type gauge to be reported with a wrong value.

Fixed an issue where Humio would retain segments acquired from read-only buckets if those segments were deleted. Humio will now properly delete the segments locally, and drop the reference to the copy in the read-only bucket.

Fixed a bug which potentially have caused alerts to not re-fire after the throttle period for field-based throttling had passed.

Fixed an issue that could cause cluster nodes to crash when growing the number of digest partitions.

Fixed an issue where the {time_zone} [message template](https://docs.humio.com/docs/actions/message-template/) for actions would show a full description of the scheduled search instead of only the time zone.

Fixed an issue where top() with max= can yield the same key multiple times (ei. ...| top([queryId, query], max=totalSize)).

The left navigation menu hides, and can be opened again, for mobile devices, on organization settings pages and repository settings pages.

The signup path was removed, together with the corresponding pages.

Cluster management pages style updates.

Removed the pop-up link to edit an alert or scheduled search when on the form page. This link is only relevant when creating an entity from the search page via a dialog.

Identity provider pages style update.

Updated design for Package Marketplace and Installed Packages to make them easier to use and more consistent.

Fixed some styling issue on Query Quotas page.

Breadcrumbs are aligned across all pages and show the package name with a link when viewing or editing an asset from a package.

Updated the style of the email action template and made the wording used dependent on whether an alert or scheduled search was triggered.

When using the GraphQL field allowedViewActions, the two previously deprecated actions ChangeAlertsAndNotifiers and ReadEvents are no longer returned. Look for their replacements ChangeTriggersAndActions and ReadContents instead.

Deprecates the two GraphQL fields id and contentHash on the File type. The two fields are considered unused, so no alternatives are provided. If you rely on them, please let us know.

The fileName, displayName, and location GraphQL fields on the UploadedFileSnapshot type are deprecated in favor of the new nameAndPath field.

Added a GraphQL mutation "cancelDeleteEvents" that allows cancelling a previously submitted deletion. Cancellation is best-effort, and events that have already been deleted will not be restored.

Extended 'Relative' field type for schema files to include support for the value 'now'.

The GraphQL DateTime type now supports non-UTC time. Timestamps like 2021-07-18T14:13:09.517+02.0 are now legal, and will be converted to UTC time internally.

Added information about the use of preview fields in the result from calling the GraphQL API. The information will be in the field extensions.preview and will be a list of objects with a name and reason field.

The name, displayName, and location GraphQL fields on the File type are deprecated in favor of the new nameAndPath field.

Deprecates the package field on the SearchDomain GraphQL type, in favor of packageV2. The new field has a simpler and more correct return type.

Deprecates the copyFile GraphQL mutation, as it is no longer used. If you use this mutation, please let us know.

Deprecates the installPackageFromRegistry and updatePackageFromRegistry GraphQL mutations in favor of installPackageFromRegistryV2 and updatePackageFromRegistryV2.

On a node configured as USING_EPHEMERAL_DISKS=true allow the local disk management deleting files even if a query may need them later, as the system is able to re-fetch the files from bucket storage when required. This improves the situation when there are active queries that in total have requested access to more segments than the local disk can hold.

Added compatibility mode for using IBM Cloud Object Storage as bucket storage via S3_STORAGE_IBM_COMPAT

The Scheduled Searches feature is no longer in beta and can be used by all users without enabling it first

Added loading and error states to the page where user selects to create a new repository or view.

The test action functionality no longer uses alert terminology, as actions can be invoked from both alerts and scheduled searches. Also, it is now possible to also test the scheduled search specific message templates using it.

Package installation error messages are now much more readable.

Humio docker images is now based on the Alpine linux.

Improved audit log for organization creation.

Added maximum width to tabs on the Group page, so they do not keep expanding forever.

Added support for importing packages with CSV and JSON files. Exporting packages with files is not fully supported yet, but will be in a future release.

Improved performance in IP database lookups for the functions ipLocation(), asn() and worldMap().

Improved error handling when running scheduled searches, so that a failed schedules search will be retried as long as it is within the [backfill limit](https://library.humio.com/preview/docs/automated/scheduled-search/#backfill-limit).

Added focus states to text field, selection and text area components.

Added explicit distribution information for elastic bulk API for elasticsearch API compatibility.

Scheduled search "schedule" field is now validated, showing accurate help for each part of the crontab expression.

Warnings when running scheduled searches now show up as errors in the scheduled search overview page if [SCHEDULED_SEARCH_DESPITE_WARNINGS](https://library.humio.com/preview/reference/environment-variables/#var-scheduled-search-despite-warnings) is set to 'false' (the default).

You can now export and import packages containing any of the action types: Webhook, Email, Humio Repo, Pager Duty, Slack, Slack multi channel, Ops Genie and Victor Ops.

When selecting actions for alerts or scheduled searches, the actions are now grouped by the package they were imported from.

Improved handling of local disk space relative to `LOCAL_STORAGE_MIN_AGE_DAYS`: When the local disk would overflow by respecting that config, Humio can now delete the oldest local segments that are present in bucket storage, even when they are within that time range.

Added a Data subprocessors page under account.

Allow launching using JDK-16.

Scheduled search "schedule" is explained using human readable text such as "At 9.30 on Tuesdays".

Added Dark Mode for Query Monitor page.

Added support for including dashboard and alert labels when exporting a package.

Fixed an issue with using the browser back button while "advanced editing" the query text of a scheduled search or an alert would hide the blue bar that allows saving the query.

Improved search for users page.

Removed an old Cloud Signups page. The page is not necessary since organizations were implemented for the Cloud environments.

The simple and advanced permission model has been merged, thus allowing users who were using the simple permission model to create their own permission roles and groups, create groups with default roles, and all other features that were previously only available in advanced permissions mode.

Fixed an issue that could cause UploadedFileSyncJob to crash if an uploaded file went missing.

Security when viewing installed packages and packages on the marketplace are now less strict. Permissions are still required for installing and uninstalling packages.

Fixed an issue where the {time_zone} message template for actions would show a full description of the scheduled search instead of only the time zone.

Fixed an issue where the DiskSpaceJob could mark segments accessed slightly out of order during boot.

Updated the examples on how to use the match query function in the inline documentation.

Fixed an issue where Shift+Enter would select the current completion rather than adding a newline.

Fixed an issue that caused some metrics of type gauge to be reported with a wrong value.

Fixed an issue where the global consistency check job would fail to perform the consistency check, instead logging lines like "Global dump requested but global had expired". This line can still occur, but only when the consistency check takes too long.

Fixed a bug which potentially have caused alerts to not re-fire after the throttle period for field-based throttling had passed.

Fixed a bug causing the disk space job to use an expensive code path even when a cheaper one was available.

The DiskSpaceJob no longer initializes based off of the segment last-modified timestamp, this only happens if no access order snapshot is stored locally. If a snapshot is present, we trust that.

Fixed an issue that could cause cluster nodes to crash when growing the number of digest partitions.

Creating a new dashboard now opens it after creation.

Fixed thread safety for a variable involved in fetching from bucket storage for queries.

Fixed an issue where Humio attempted to fetch global from other nodes before TLS was initialized.

Introduced a check for compatibility for packages and humio versions.

Cloning an asset now redirects you to the edit page for the asset for all assets.

Fixed an issue where metrics of type gauge with a double value were not reported to the humio-metrics repository, but only to the humio repository.

Fixed a bug on queries that triggered an error while executing due to the input (such as a regex that exceeds limits on execution time) could result in the client getting 404 as status on poll, where it should get .0.

Reworded a confusing error message when using the top() function with a limit parameter exceeding the limits configured with TOP_K_MAX_MAP_SIZE_HISTORICAL or TOP_K_MAX_MAP_SIZE_LIVE.

Truncate long user names on the Users page.

Fixed an issue where Humio would create auxiliary files (hash files) for segments unnecessarily when moving segments between nodes.

Updated Elastic ingest endpoint to accept 'create' operations in addition to 'index' operations. Both operation types result in the same ingest behavior. This update was added as Fluent-Bit v1.8.3 began using the 'create' operation rather than 'index' for ingest.

Fixed an issue where the DiskSpaceJob could continue tracking segments if they were deleted from global, but the files were still present locally.

Fixed an issue with the split() function which caused incorrect (usually, too few) query results in some cases where the output fields were refered to later in the query.

When accessing Humio through a URL with either a repository or view name in it and using an ingest token, it is now checked that the view on the token matches the repository or view in the URL, and a 403 Forbidden status is returned, if not.

Fixed a bug where a hidden field named "#humioAutoShard" would sometimes show up in the field list.

Fixed an issue where Humio would create a broken hash file for the merge result when merging minisegments that did not originally have hash files.

Global snapshots are now uploaded to bucket storage more often when there are a lot of updates to it, leading to shorter replay times on startup.

Fixed an issue where, looking at GraphiQL, the dropdown from the navigation menu was partially hidden.

Fixed an issue that caused some errors to be hidden behind a message about "internal error".

Fixed an issue where the query scheduler would spend too much time "shelving" queries, and not enough on getting them executed, leading to little progress on queries.

Split package export page into dialog with multiple steps.

Fixed an issue where the job responsible for deleting segment files off nodes was not running as often as expected.

Fixed a bug where a 404 Not Found status on an internal endpoint would be incorrectly reported as an 401 Unauthorized.

Updated Slack action for messaging multiple channels, so it propogates errors when triggered. Previously errors were ignored.

Fixed an issue where top() with max= can yield the same key multiple times (ei. ...| top([queryId, query], max=totalSize)).

Updated the new asset dialog button text so that it will say 'Continue' when an asset will not be created directly.

The DiskSpaceJob now removes newly written backfilled segments off the local disk before it chooses to remove non-backfilled segments.

Updated dependencies with security fixes.

Fixed an issue where certain problems highlighted the first word in a query, not the location of the problem.

Amended an internal limit on how many segments can be fetched from bucket storage concurrently. The old limit was based on the number of running queries. The new limit is 32.

When a search is able to filter out segments based on the hash filter files, and a segment file is not present locally on any node, fetch only the hash filter at first, evaluate that, and only if required, fetch the segment file. This speeds up searches that target segments only present in bucket storage and that have search filters that generate hash filter checks, such as regex and literal text comparisons.

Fixed an issue where new groups added to a repository got a query prefix that disallowed search. The default is now to allow search with the queryprefix *.

Fixed an issue where the job responsible for deleting segment files off nodes was not deleting as many segments as it should.

Fixed an issue where it was possible to submit queries to the Delete Events API that were not valid for that API. Only pure filtering queries are allowed.

Updated dependencies to log4j 2.17.1 to fix CVE-2021-44832 and CVE-2021-45105

Updated dependencies to Netty to fix CVE-2021-43797

Updated dependencies to log4j 2.16 to remove of message lookups (CVE-2021-45046)

Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

Fixed a compatibility issue with Filebeat 7.16.0

Updated dependencies to address a critical security vulnerability for the log4j logging framework, "log4shell", (CVE-2021-44228).

Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

Require organization level permission when changing role permissions that possibly affects all views and repositories.

Updated a dependency to a version fixing a critical bug.

Fixed an issue where a URL without content other than the protocol would break installing a package.

Fixed an issue where the job responsible for deleting segment files off nodes was not running as often as expected.

On a node configured as USING_EPHEMERAL_DISKS=true allow the local disk management deleting files even if a query may need them later, as the system is able to re-fetch the files from bucket storage when required. This improves the situation when there are active queries that in total have requested access to more segments than the local disk can hold.

Upgrade Kafka and xmlsec to address CVE-2021-38153 and CVE-2021-38153.

Fixed an issue causing Humio to log MatchExceptions from the calculateStartPoint method.

Fixed an issue where the job responsible for deleting segment files off nodes was not deleting as many segments as it should.

Fixed an issue where the query scheduler would spend too much time "shelving" queries, and not enough on getting them executed, leading to little progress on queries.

Fixed an issue where offsets from one Kafka partition could be used when deciding where to start consuming for another partition, in the case where there are too many datasources in the repo. This led to a crash loop when the affected node was restarted.

Fixed an issue where the UI page for new parser could have overflow in some browsers.

Fixed an issue where it was possible to submit queries to the Delete Events API that were not valid for that API. Only purely filtering queries are allowed.

Added a GraphQL mutation cancelDeleteEvents that allows cancelling a previously submitted deletion. Cancellation is best-effort, and events that have already been deleted will not be restored.

Remove limit on search interval on cloud sandboxes

Fixed an issue where the error TooManyTagValueCombination would prevent Humio from starting

Fixed an issue where, looking at GraphQL, the dropdown from the navigation menu was partially hidden.

Fixed an issue where if a package failed to be installed, and it contained an action, the failed installation might not be cleaned up properly.

Fixed an issue that could cause UploadedFileSyncJob to crash, if an uploaded file went missing

Fixed an issue where new groups added to a repository got a query prefix that disallowed search. The default is now to allow search with the query prefix * (wildcard).

Field createIngestListener was deprecated in Mutation type, use createIngestListenerV2 instead

Field updateIngestListener was deprecated in Mutation type, use updateIngestListenerV2 instead

Removed the Usage feature flag which is now always enabled. This breaks backwards compatibility for internal graphql feature flag mutations and queries.

Removed the argument includeUsageView from the graphql mutation createOrganizationsViews which breaks backwards compatibility for this internal utility method.

Field assignIngestToken was deprecated in Mutation type, use assignParserToIngestToken instead

Field addIngestToken was deprecated in Mutation type, use addIngestTokenV2 instead

Field copyParser was deprecated in Mutation type, use cloneParser instead

Deprecated argument name was removed from Mutation.updateParser field

Deprecated argument repositoryName was removed from Mutation.updateParser field

Humio nodes will now pick a UUID for themselves using the ZOOKEEPER_PREFIX_FOR_NODE_UUID prefix, even if Zookeeper is not used. This should make it easier to enable Zookeeper id management in existing clusters going forward.

Add a soft limit on the primary disk based on PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE (roughly the average of the two values). When the soft limit is hit and secondary storage is configured, the segment mover will prefer moving segments to secondary storage right away, instead of fetching them to primary and waiting for the secondary storage transfer job to move them.

Allow the internal profiler to be configured via an environment variable. See Environment Variables

Enabled dark mode for cluster administration pages.

Make GlobalConsistencyCheckerJob shut down more cleanly, it could previously log some ugly exceptions during shutdown.

Return the responder's vhost in the metadata json.

Integrates the editing of alert searches and scheduled searches better with the search page

Created a new Dropdown component, and replaced some uses of the old component with the new.

Improved global snapshot selection in cases where a Kafka reset has been performed

Added dark mode support to Identity provider pages.

When editing a query, Enter no longer accepts a suggestion. Use Tab instead. The Enter key conflicted with the "Run" button for running the query.

Previously, the server could report that a user was allowed to update parsers for a view, even though parsers cannot be used on views, only repositories. Now the server will always say the user cannot change parsers on views.

Packages now support Webhook actions and references between these and alerts in the Alert schema.

Scheduled searches are now allowed to run once every minute instead of only once every hour.

Internal change to parsers adding an id, where previously they only had a name as key.

The "Save Search as Dashboard" Widget dialog now gives user feedback about missing input in a manner consistent with other forms.

In thread dumps include the job and query names in separate fields rather than as part of the thread name.

Speed up the SecondaryStorageTransferJob. The job will now delete primary copies much earlier after moving them to the secondary volume.

Organization pages refactoring.

Fixed an issue where exporting a saved query did not include the options for the visualization, e.g. column layout on the event list.

When testing a Parser and more events are returned in a test an info message is now displayed conveying that only the first event is shown.

Fixed a bug where word wrapping in the event list was not always working for log messages with syntax highlighting (e.g. JSON or XML messages)

Fixed an issue with "show in context" feature of the event list did not quote the field names in the produced query string.

Fixed an issue related to validation of integer arguments. Large integer arguments would be silently truncated and lower limits weren't checked, which led to unspecified behavior. Range errors are now reported in the following functions:

Fixed bugs in the test parser UI, so that it should now always produce a result and be able to handle parsers that either drop events or produce multiple events per input event.

Fixed a bug causing match() to let an empty key field match a table with no rows.

Fixed a bug in the blocklist which caused "exact pattern" query patterns to be interpreted as glob patterns.

Fixed race condition that could cause event forwarding rules to not update correctly in rare cases

Fixed race condition that could cause parsers to not update correctly in rare cases

Address edge cases where QueryScheduler could throw exceptions with messages similar to "Requirement failed on activeMapperCount=-36"

Avoiding a costly corner case in some uses of glob-patterns.

Fixed an issue where the axis titles on the timechart were not showing up in dark mode

Fixed a bug in the Search View. After editing and saving a saved query in the Search View, the notification message would disappear in an instant, making it impossible to read and to click the link therein.

Fix a bug where offsets from one Kafka partition could be used when deciding where to start consuming for another partition, in the case where there are too many datasources in the repo. This led to a crash loop when the affected node was restarted.

Upgrade Kafka and xmlsec to address CVE-2021-38153 and CVE-2021-38153.

The signup path was removed, together with the corresponding pages. Before, anyone could sign up for the Humio SaaS solution. However, with stricter policies, this became obsolete and had to be removed. The new process redirecta a potential customer to Humio's official website, where they have to fill in a form in order to be vetted. Once the vetting process is complete, Humio support creates an organization for the customer.

Fixed an issue that could cause cluster nodes to crash when growing the number of digest partitions.

Fixed an issue that could cause UploadedFileSyncJob to crash if an uploaded file went missing