• The following GraphQL APIs are deprecated and will be removed in version 1.225 or later:

  In the updateSettings mutation, these input arguments are deprecated:

  • isPackageDocsMessageDismissed

  • isDarkModeMessageDismissed

  • isResizableQueryFieldMessageDismissed

  On the UserSettings type, these fields are deprecated:

  • isPackageDocsMessageDismissed

  • isDarkModeMessageDismissed

  Note

  The deprecated input arguments will have no effect, and the deprecated fields will always return true until their removal.

• The updateUploadFileAction() GraphQL mutation is deprecated. Use instead updateUploadFileActionV2().

• A system metric used in the Fleet overview interface is now deprecated. New collectors communicating with Fleet management will instead ship two new separate metrics: one containing errors and another containing log sources information. This allows for only shipping the information if anything has changed - thereby reducing load.

• The datasource-count metric has been deprecated and will be removed in version 1.201 of LogScale.

  The information about the total number of datasources is available via the logs by the GlobalSegmentStatsLoggerJob in the datasources field. When a new datasource is created or marked as deleted, the total number of datasources is logged in the datasourceCount field.

• The updateScheduledSearchV2 GraphQL mutation has been deprecated in favor of updateScheduledSearchV3, which now includes field triggerOnEmptyResult .

• rdns() has been deprecated and will be removed in version 1.249. Use reverseDns() as an alternative function.

• The Humio-Usage package has been deprecated and scheduled for removal in version 1.189 LTS.

• The setConsideredAliveUntil and setConsideredAliveFor GraphQL mutations are deprecated and will be removed in 1.195.

• The removeLimit() GraphQL mutation is being deprecated and replaced by the new mutation removeLimitWithId().

• The removeLimit() GraphQL mutation is being deprecated and replaced by the new mutation removeLimitWithId().

• LogScale is deprecating free-text searches that occur after the first aggregate function in a query. These searches likely did not and will not work as expected. Starting with version 1.190.0, this functionality will no longer be available. A free-text search after the first aggregate function refers to any text filter that is not specific to a field and appears after the query's first aggregate function. For example, this syntax is deprecated:

  logscale Syntax

  "Lorem ipsum dolor"
  | tail(200)
  | "sit amet, consectetur"

  Some uses of the wildcard() function, particularly those that do not specify a field argument are also free-text-searches and therefore are deprecated as well. Regex literals that are not particular to a field, for example /(abra|kadabra)/ are also free-text-searches and are thus also deprecated after the first aggregate function.

  To work around this issue, you can:

  • Move the free-text search in front of the first aggregate function.

  • Search specifically in the @rawstring field.

  If you know the field that contains the value you're searching for, it's best to search that particular field. The field may have been added by either the log shipper or the parser, and the information might not appear in the @rawstring field.

  Free-text searches before the first aggregate function continue to work as expected since they are not deprecated. Field-specific text searches work as expected as well: for example, myField=/(abra|kadabra)/ continue to work also after the first aggregate function.

• The use of the event functions eventInternals(), eventFieldCount(), and eventSize() after the first aggregate function is deprecated. For example:

  Invalid Example for Demonstration - DO NOT USE

  logscale

  eventSize() 
  | tail(200) 
  | eventInternals()

  Usage of these functions after the first aggregate function is deprecated because they work on the original events, which are not available after the first aggregate function.

  Using these functions after the first aggregate function will be made unavailable in version 1.190.0 and onwards.

  These functions will continue to work before the first aggregate function, for example:

  logscale

  eventSize() 
  | tail(200)

• The storage task of the GraphQL NodeTaskEnum is deprecated and scheduled to be removed in version 1.189. This affects the following items:

  • The supportedTasks field of the ClusterNode type.

  • The assignedTasks field of the ClusterNode type.

  • The unassignedTasks field of the ClusterNode type.

  • The assignTasks() mutation.

  • The unassignTasks() mutation

  • The INITIAL_DISABLED_NODE_TASKS configuration variable.

• The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

• The color field on the Role type has been marked as deprecated (will be removed in version 1.195).

• The following GraphQL mutations and field have been deprecated, since the starring functionality is no longer in use for alerts and scheduled searches:

  • addStarToAlertV2()

  • removeStarFromAlertV2()

  • addStarToScheduledSearch()

  • removeStarFromScheduledSearch()

  • isStarred field on the Alert and ScheduledSearch types.

• The deprecated JDK-less server.tar.gz tarball release is no longer being published. Users should switch to either server-linux_x64.tar.gz or server-alpine_x64.tar.gz depending on their operating system.

• The following GraphQL mutations and field have been deprecated, since the starring functionality is no longer in use for alerts and scheduled searches:

  • addStarToAlertV2()

  • removeStarFromAlertV2()

  • addStarToScheduledSearch()

  • removeStarFromScheduledSearch()

  • isStarred field on the Alert and ScheduledSearch types.

• The deprecated JDK-less server.tar.gz tarball release is no longer being published. Users should switch to either server-linux_x64.tar.gz or server-alpine_x64.tar.gz depending on their operating system.

• The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

• The server.tar.gz release artifact has been deprecated. Users should switch to the OS/architecture-specific server-linux_x64.tar.gz or server-alpine_x64.tar.gz, which include bundled JDKs. Users installing a Docker image do not need to make any changes. With this change, LogScale will no longer support bringing your own JDK, we will bundle one with releases instead.

  We are making this change for the following reasons:

  • By bundling a JDK specifically for LogScale, we can customize the JDK to contain only the functionality needed by LogScale. This is a benefit from a security perspective, and also reduces the size of release artifacts.

  • Bundling the JDK ensures that the JDK version in use is one we've tested with, which makes it more likely a customer install will perform similar to our own internal setups.

  • By bundling the JDK, we will only need to support one JDK version. This means we can take advantage of enhanced JDK features sooner, such as specific performance improvements, which benefits everyone.

  The last release where server.tar.gz artifact is included will be 1.154.0.

• The following API endpoints are deprecated and marked for removal in 1.148.0:

  • POST /api/v1/clusterconfig/kafka-queues/partition-assignment

  • GET /api/v1/clusterconfig/kafka-queues/partition-assignment

  • POST /api/v1/clusterconfig/kafka-queues/partition-assignment/set-replication-defaults

  The deprecated methods are used for viewing and changing the partition assignment in Kafka for the ingest queue. Administrators should use Kafka's own tools for editing partition assignments instead, such as the bin/kafka-reassign-partitions.sh and bin/kafka-topics.sh scripts that ship with the Kafka install.

• The HUMIO_JVM_ARGS environment variable in the LogScale Launcher Script script will be removed in 1.154.0.

  The variable existed for migration from older deployments where the launcher script was not available. The launcher script replaces the need for manually setting parameters in this variable, so the use of this variable is no longer required. Using the launcher script is now the recommended method of launching LogScale. For more details on the launcher script, see LogScale Launcher Script. Clusters that still set this configuration should migrate to the other variables described at LogScale Launcher Script.

• The following GraphQL queries and mutations for interacting with parsers are deprecated and scheduled for removal in version 1.142.

  • The deprecated createParser() mutation is replaced by createParserV2() . The differences between the old and new mutation are:

    • testData input field is replaced by testCases, which can contain more data than the old tests could. This includes adding assertions to the output of a test. These assertions are not displayed in the UI yet. To emulate the old API, you can take the old test string and put it in the ParserTestEventInput inside the ParserTestCaseInput, and they will behave the same as before.

    • fieldsToBeRemovedBeforeParsing can now be specified as part of the parser creation.

    • force field is renamed to allowOverwritingExistingParser.

    • sourceCode field is renamed to script.

    • tagFields field is renamed to fieldsToTag.

    • languageVersion is no longer an enum, but a LanguageVersionInputType instead.

    • The mutation returns a Parser, instead of a Parser wrapped in an object.

    • The mutation fails when a parser has more than 2,000 test cases, or the test input in a single test case exceeds 40,000 characters.

  • The deprecated removeParser() mutation is replaced by deleteParser(). The difference between the old and new mutation is:

    • The mutation returns boolean to represent success or failure, instead of a Parser wrapped in an object.

  • The deprecated testParser() mutation is replaced by testParserV2() . The differences between the old and new mutation are:

    • The test cases are now structured types, instead of just being strings. To emulate the old API, take the test string and put it in the ParserTestEventInput inside the ParserTestCaseInput, and they will behave the same as before.

    • The new test cases can contain assertions about the contents of the output.

    • The mutation output is significantly different from before, as it provides more detailed information on how a test case has failed.

    • The mutation now accepts both a language version and list of fields to be removed before parsing.

    • The parserScript field is renamed to script.

    • The tagFields field is renamed to fieldsToTag.

  • The deprecated updateParser() mutation is replaced by updateParserV2() where more extensive test cases can be set. Continuing to use the previous API may result in test information on parsers being lost. To ensure information is not unintentionally erased, please migrate away from the deprecated APIs for both reading and updating parser test cases and use updateParserV2() instead. The differences between the previous and the new mutation are:

    • testData input field is replaced by testCases, which can contain more data than the old tests could. This includes adding assertions to the output of a test. These assertions are not displayed in the UI yet. To emulate the old API, you can take the old test string and put it in the ParserTestEventInput inside the ParserTestCaseInput, and they will behave the same as before.

    • sourceCode field, used to updating the parser script, is changed to the script field, which takes a UpdateParserScriptInput object. This updates the parser script and the language version together.

    • tagFields field is renamed to fieldsToTag.

    • The languageVersion is located inside the UpdateParserScriptInput object, and is no longer an enum, but a LanguageVersionInputType instead.

    • The repositoryName and id fields are now correctly marked as mandatory in the schema. Previously this wasn't the case, even though the mutation would fail without them.

    • The mutation returns a Parser, instead of a Parser wrapped in an object.

    • The old mutation had a bug where it would overwrite the languageVersion with a default value in some cases, which is fixed in the new one.

    • The mutation fails when a parser has more than 2,000 test cases, or the test input in a single test case exceeds 40,000 characters.

  On the Parser type:

  • testData field is deprecated and replaced by testCases.

  • sourceCode field is deprecated and replaced by script.

  • tagFields field is deprecated and replaced by fieldsToTag.

  For more information, see DeleteParserInput , LanguageVersionInputType , createParserV2() , testParserV2() , updateParserV2() , Parser .

• The any argument to the type parameter of sort() and table() has been deprecated and will be removed in version 1.142.

  Warnings prompts will be shown in queries that fall into either of these two cases:

  • If you are explicitly supplying an any argument, please either simply remove both the parameter and the argument, for example change sort(..., type=any) to sort(...) or supply the argument for type that corresponds to your data.

  • If you are sorting hexadecimal values by their equivalent numerical values, please change the argument of type parameter to hex e.g. sort(..., type=hex).

  In all other cases, no action is needed.

  The new default value for sort() and table() will be number. Both functions will fall back to lexicographical ordering for values that cannot be understood as the provided argument for type.

• The QUERY_COORDINATOR environment variable is deprecated. To control whether a node should be allowed to be a query coordinator, use the query node task instead. Node tasks can be assigned and unassigned at runtime using the assignTasks() and unassignTasks() GraphQL mutations respectively, or controlled using the INITIAL_DISABLED_NODE_TASKS environment variable.

  For more information, see INITIAL_DISABLED_NODE_TASKS.

• We are deprecating the humio/kafka and humio/zookeeper Docker images due to low use. The planned final release for these images will be with LogScale 1.148.0.

  Better alternatives are available going forward. We recommend the following:

  • If your cluster is deployed on Kubernetes: STRIMZI

  • If your cluster is deployed to AWS: MSK

  If you still require humio/kafka or humio/zookeeper for needs that cannot be covered by these alternatives, please contact Support and share your concerns.

• The humio Docker image is deprecated in favor of humio-core. humio is no longer considered suitable for production use, as it runs Kafka and ZooKeeper on the same host as LogScale, which our deployment guidelines no longer recommend. The final release of humio Docker image will be in version 1.130.0.

  The new humio-single-node-demo image is an all-in-one container suitable for quick and easy demonstration setups, but which is entirely unsupported for production use.

  For more information, see Installing Using Containers.

• In the GraphQL API, the name argument to the parser field on the Repository datatype has been deprecated and will be removed in version 1.136 of LogScale.

• In the GraphQL API, the ChangeTriggersAndAction enum value for both the Permission and ViewAction enum is now deprecated and will be removed in version 1.136 of LogScale.

• The assetType GraphQL field on Alert, Dashboard, Parser, SavedQuery and ViewInteraction datatypes has been deprecated and will be removed in version 1.136 of LogScale.

• The QUERY_COORDINATOR environment variable is deprecated. To control whether a node should be allowed to be a query coordinator, use the query node task instead. Node tasks can be assigned and unassigned at runtime using the assignTasks() and unassignTasks() GraphQL mutations respectively, or controlled using the INITIAL_DISABLED_NODE_TASKS environment variable.

  For more information, see INITIAL_DISABLED_NODE_TASKS.

• GraphQL mutation updateOrganizationMutability() is deprecated in favor of the new setBlockIngest() mutation.

• GraphQL mutation updateOrganizationMutability() is deprecated in favor of the new setBlockIngest() mutation.

• The following REST endpoints for deleting events have been deprecated:

  • /api/v1/dataspaces/(Id)/deleteevents

  • /api/v1/repositories/(id)/deleteevents

  The new GraphQL mutation redactEvents() should be used instead.

• The following REST endpoints for deleting events have been deprecated:

  • /api/v1/dataspaces/(Id)/deleteevents

  • /api/v1/repositories/(id)/deleteevents

  The new GraphQL mutation redactEvents() should be used instead.

• The REST endpoint for testing actions has been deprecated. api/v1/repositories/repoId/alertnotifiers/actionId/test() has been deprecated. The new GraphQL mutations should be used instead.

• The REST endpoint for testing actions has been deprecated. api/v1/repositories/repoId/alertnotifiers/actionId/test() has been deprecated. The new GraphQL mutations should be used instead.

• The following environment variables are deprecated as of this release. Their removal will be announced in a future version.

  • ZOOKEEPER_URL_FOR_NODE_UUID

  • ZOOKEEPER_URL

  • ZOOKEEPER_PREFIX_FOR_NODE_UUID

  • ZOOKEEPER_SESSIONTIMEOUT_FOR_NODE_UUID

  The recommended steps for migrating off of ZooKeeper are described in Falcon LogScale 1.70.0 LTS (2023-01-16).

  Note

  When using Operator and Kubernetes deployments, you must upgrade to 0.17.0 of operator to support migration away from the ZooKeeper requirement. See Operator Release Notes.

• The query function holtwinters() is now deprecated and will be removed along with the release of future version 1.73; therefore, its usage in alerts is not recommended.

• Deprecated enabledFeatures() query. Use the new featureFlags() query instead.

• Deprecated enabledFeatures() query. Use the new featureFlags() query instead.

• The Feature Flag, CookieAuthServerSide, has been deprecated as cookie authentication is now enabled by default. Instead, the configuration field ENABLE_BEARER_TOKEN_AUTHORIZATION has been introduced.

• The local disk based backup feature described at Making Back-Ups is deprecated, and is planned for removal in September 2022. We have found that restoring backups using this feature is difficult in practice, it is not commonly used, and the backup/restore functionality is covered by the bucket storage feature as well. For these reasons, we are deprecating this feature in favour of bucket storage.

  The DELETE_BACKUP_AFTER_MILLIS configuration parameter, which controls the delay between data being deleted in Humio and removed from backup, will be retained, since it controls a similar delay for bucket storage. Customers using local disk based backups should migrate to using bucket storage instead. Systems not wishing to use a cloud bucket storage solution can keep backup support by instead installing an self-hosted S3- or GCS-compatible solution, such as MinIO.

• Deprecates the copyFile() GraphQL mutation, as it is no longer used. If you use this mutation, please let us know.

• Deprecates the two GraphQL fields id and contentHash on the File type. The two fields are considered unused, so no alternatives are provided. If you rely on them, please let us know.

• Deprecates the copyFile() GraphQL mutation, as it is no longer used. If you use this mutation, please let us know.

• Field addIngestToken was deprecated in Mutation type, use addIngestTokenV2 instead.

• Field assignIngestToken was deprecated in Mutation type, use assignParserToIngestToken instead.

• Deprecated GraphQL mutation setRecentQueries(), use addRecentQuery() in future. The mutation will be removed after 2021-10-01. While setRecentQueries will remain in the API to not break existing clients, it will not modify the set of recent queries.

• Deprecated GraphQL mutations addAlertLabel(), removeAlertLabel(), addStarToAlert() and removeStarFromAlert() as they did not follow the standard for mutation input.

• New config MAXMIND_IP_LOCATION_EDITION_ID for selecting the maxmind edition of the IP location database. Deprecates MAXMIND_EDITION_ID, but old config will continue to work.

• The configuration options AUTH0_API_CLIENT_ID and AUTH0_API_CLIENT_SECRET have been deprecated in favor of AUTH0_CLIENT_ID and AUTH0_CLIENT_SECRET respectively - the old names will continue to work as aliases.