Falcon LogScale 1.151.0 Preview (2024-08-13)
Version? | Type? | Release Date? | Availability? | End of Support | Security Updates | Upgrades From? | JDK Compatibility? | Config. Changes? |
---|---|---|---|---|---|---|---|---|
1.151.0 | Preview | 2024-08-13 | Cloud | Next Stable | No | 1.112 | 21-22 | No |
Bug fixes and updates.
Deprecation
Items that have been deprecated and may be removed in a future release.
The
server.tar.gz
release artifact has been deprecated. Users should switch to theOS/architecture-specific server-linux_x64.tar.gz
orserver-alpine_x64.tar.gz
, which include bundled JDKs. Users installing a Docker image do not need to make any changes. With this change, LogScale will no longer support bringing your own JDK, we will bundle one with releases instead.We are making this change for the following reasons:
By bundling a JDK specifically for LogScale, we can customize the JDK to contain only the functionality needed by LogScale. This is a benefit from a security perspective, and also reduces the size of release artifacts.
Bundling the JDK ensures that the JDK version in use is one we've tested with, which makes it more likely a customer install will perform similar to our own internal setups.
By bundling the JDK, we will only need to support one JDK version. This means we can take advantage of enhanced JDK features sooner, such as specific performance improvements, which benefits everyone.
The last release where
server.tar.gz artifact
is included will be 1.154.0.The
HUMIO_JVM_ARGS
environment variable in the LogScale Launcher Script script will be removed in 1.154.0.The variable existed for migration from older deployments where the launcher script was not available. The launcher script replaces the need for manually setting parameters in this variable, so the use of this variable is no longer required. Using the launcher script is now the recommended method of launching LogScale. For more details on the launcher script, see LogScale Launcher Script. Clusters that still set this configuration should migrate to the other variables described at Override garbage collection configuration within the launcher script.
The lastScheduledSearch field from the
ScheduledSearch
datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to theScheduledSearch
datatype to replace lastScheduledSearch.
New features and improvements
UI Changes
The Client type item in the Query details tab has been removed. Previously, Dashboard was incorrectly displayed as the value for both live dashboard and alert query types.
For more information, see Query Monitor — Query Details.
The design of the file editor for Lookup Files has been improved. The editor is now also more responsive and has support for tab navigation.
LogScale administrators can now set the default timezone for their users.
For more information, see Setting Time Zone.
Automation and Alerts
It is no longer possible to use @id as throttle field in filter alerts, as this has no effect. Any existing filter alerts with @id as throttle field will continue to run, but the next time the filter alert is updated, the throttle field must be changed or removed.
For more information, see Field-Based Throttling.
GraphQL API
A new field named searchUsers has been added on the group() output type in graphql, which is used to search users in the group. The field also allows for pagination, ordering and sorting of the result set.
Configuration
The
QueryBacktrackingLimit
feature is now enabled by default. The default value for the max number of backtracks (number of times a single event can be processed) a query can do has been reduced to2,000
.
Ingestion
To avoid exporting redundant fields in the parsers, LogScale will now omit YAML fields with a
null
value when exporting YAML templates — even when such fields are contained inside a list. Omitting fields with anull
value previously only happened for fields outside a list.
Fixed in this release
UI Changes
The settings used to disable automatic searching would not be respected when creating a new alert. This issue has now been fixed.
When Creating a File, saving an invalid
.csv
file was possible in the file editor. This wrong behavior has now been fixed.
Ingestion
Event Forwarding using
match()
orlookup()
with a missing file would continue to fail after the file was uploaded. This issue has now been fixed.Event Forwarding would fail silently if an error occurred while executing the query. This issue has now been fixed.
Dashboards and Widgets
Shared dashboards created on the special humio-search-all view wouldn't load correctly. This issue has now been fixed.
Log Collector
Queries that were nested too deeply would crash LogScale nodes. This issue has now been fixed.
Functions
writeJson()
would write invalid JSON by not correctly quoting numbers starting with unary plus or ending with a trailing.
(dot).