Humio Server 1.26.0 Stable (2021-05-20)

VersionTypeRelease DateEnd of SupportUpgrades FromData MigrationConfig. Changes
1.26.0Stable2021-05-202022-05-201.16.0NoNo
ValueJAR Checksum
MD55f8abd037b3f73eaac8d5882fa58e4ec
SHA185971d1f18228a81f46f6f6334196fd918647438
SHA2564e0ad70a2c9275742aee8a0181eee2e20c6496ba16b8f6fb93490b84b5031b5e
SHA512425cacd3de3f54c2813dd3915ad35aed67de2f11a80d9c2fbf96055b030158b5d60c31686e121e613df855e6f0bdaad9d02f1c9e61a4df24b8f69cfd3193f56d

The HEC ingest endpoint will no longer implicitly parse logs using the built-in kv parser. Previously, a log ingested using this endpoint would implicitly be parsed with the kv parser when the supplied event field was given as a string. For instance, this log:

json
{
 "time" : 1537537729.0,
 "event" : "Fri, 21 Sep 2018 13:48:49 GMT - system started name=webserver",
 "source" : "/var/log/application.log",
 "sourcetype" : "applog",
 "fields" : { "#env" : "prod" }
 }

Would be parsed, so that the resulting Humio event would contain the field name=webserver.

If you don't wish this behavior to change, you will have to perform this parsing operation explicitly.

When ingesting into the HEC endpoint, you are using an ingest token to authenticate with Humio. If that token does not have an associated parser, all you need to do is assign the kv parser to the token.

If your ingest token already has an assigned parser, you will need to prepend the code of that parser with this code snippet:

kvParse(@rawstring) | findTimestamp(addErrors=false) |

Bug Fixes

Known Issues

  • Other

    • A regression can cause 1.26.0 to repeatedly error log and fail to start queries in cases where the list of hosts in the cluster is not fixed. This is particularly likely to affect clusters running with ephemeral disks. The regression is fixed in 1.26.1.