Falcon LogScale Documentation

Updated Kafka and Zookeeper Docker images to use Kafka 2.4. Updating to Kafka 2.4 should be straightforward using Humio's Kafka/Zookeeper Docker images. Zookeeper image will handle migration. Stop all Kafka nodes. Stop all Zookeeper nodes. Start all Zookeeper nodes on the new version. Start all Kafka nodes on the new version. Before updating Kafka/Zookeeper, we recommend backing up the Zookeeper data directory. Then, add the Zookeeper properties described below. If you are deploying Kafka/Zookeeper using other tools, for example Ansible scripts, be aware there is a migration involved in updating Zookeeper.

Humio's NetFlow support has been extended to also support IPFIX. See Humio's documentation for NetFlow.

To prevent the charts from getting cluttered, you can adjust the maximum number of series that should be shown in the chart. Any series that are not part of the top-most series will be summed together and added to a new series called Other.

Each chart type now supports assigning colors to specific series. This will allow you to, for instance, assign red to errors and green to non-errors.

Now, you can click Edit Styling in the widget menu and modify styling directly from the dashboard view.

Since charts are such a central feature, we allow disabling the new implementation of widgets if you are experiencing issues with them. You can disable Vega charts globally using the ENABLE_VEGA_CHARTS=false flag.

Linear interpolation is now the default, and we have added a new type of interpolation: Basis.

Role Based Access Control (RBAC) through the UI is now the only permission model in Humio. Please see the Authorization documentation for more information.

This version replaces our chart library with Vega. The goal is to create a better, customizable, and more interactive charting experience in Humio. This first iteration is largely just a feature replacement for the existing functionality, with a few exceptions

Be aware that updating Kafka also requires you to update Zookeeper to 3.5.6. There is a migration involved in updating Zookeeper. See Zookeeper's migration FAQ here. Use the migration approach using an empty snapshot. The other proposed solution can loose data.

You can find the series configuration controls in the Style tab of the Search page.

Improved (reduced) memory consumption for live groupby, and for groupby involving many distinct keys.

The overall health of a Humio system is determined by a set of individual health checks. For more information about individual checks see the Health Check page and the Health Check API page.

Queries involving join can now be with 'used export to file' and the /query HTTP endpoint.

Updated Humio to use Kafka 2.4. Humio can still use versions of Kafka down through 1.1.

New selectLast function, which is like select but aggregate.

You can now style your pie charts, and they will default to having a center radius (actually making them donuts!).

When updating Kafka/Zookeeper we recommend setting these Zookeeper properties

New caseSensitive option added to the parseTimestamp query function.

You can now style your bar charts to control things like label position and colors.