Available for download two days after release.

Bug fixes and updates.

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

• Automation and Alerts

  • Important Notice: Downgrade Considerations

    Enhancements to Aggregate alerts in version 1.176 include additional state tracking for errors and warnings. While this is an improvement, it does require attention if you need to downgrade to an earlier version.

    Potential Impact:

    If you downgrade from 1.176 or above to 1.175 or below, you may encounter errors related to Aggregate Alerts, causing Aggregate Alerts to not run to completion.

    Resolution Steps:

    After downgrading, if you encounter errors containing Error message and error in phase must either both be set or not set, do the following:

    1. Identify affected Aggregate Alerts by executing the following GraphQL query:

       graphql

       query q1 {
         searchDomains {
           name    
           aggregateAlerts {id, lastError, lastWarnings}
         }
       }

       Document the IDs of any affected alerts having warnings and no errors set.

    2. Apply the resolution – for each identified alert with warnings (optionally and/or errors), apply this GraphQL mutation, replacing INSERT with your actual view name and alert ID:

       graphql

       mutation m1 {
         clearErrorOnAggregateAlert(input:{viewName:"INSERT",id:"INSERT"}) {id}
       }

       Keep track of modified alert IDs for future reference.

    3. Verify the resolution – confirm that the system returns to normal operation, and monitor for any additional error messages using a LogScale query and/or alert, such as:

       logscale

       #kind=logs
       class="c.h.c.Context"
       "Error message and error in phase must either both be set or not set"

    These steps will reset the Aggregate Alerts and restore the system to normal operation.

Deprecation

Items that have been deprecated and may be removed in a future release.

• The color field on the Role type has been marked as deprecated (will be removed in version 1.195).

• The storage task of the GraphQL NodeTaskEnum is deprecated and scheduled to be removed in version 1.185. This affects the following items:

  • The supportedTasks field of the ClusterNode type.

  • The assignedTasks field of the ClusterNode type.

  • The unassignedTasks field of the ClusterNode type.

  • The assignTasks() mutation.

  • The unassignTasks() mutation

  • The INITIAL_DISABLED_NODE_TASKS configuration variable.

• LogScale is deprecating free-text searches that occur after the first aggregate function in a query. These searches likely did not and will not work as expected. Starting with version 1.189.0, this functionality will no longer be available. A free-text search after the first aggregate function refers to any text filter that is not specific to a field and appears after the query's first aggregate function. For example, this syntax is deprecated:

  logscale Syntax

  "Lorem ipsum dolor" 
  | tail(200)         
  | "sit amet, consectetur"

  Some uses of the wildcard() function, particularly those that do not specify a field argument are also free-text-searches and therefore are deprecated as well. Regex literals that are not particular to a field, for example /(abra|kadabra)/ are also free-text-searches and are thus also deprecated after the first aggregate function.

  To work around this issue, you can:

  • Move the free-text search in front of the first aggregate function.

  • Search specifically in the @rawstring field.

  If you know the field that contains the value you're searching for, it's best to search that particular field. The field may have been added by either the log shipper or the parser, and the information might not appear in the @rawstring field.

  Free-text searches before the first aggregate function continue to work as expected since they are not deprecated. Field-specific text searches work as expected as well: for example, myField=/(abra|kadabra)/ continue to work also after the first aggregate function.

• The use of the event functions eventInternals(), eventFieldCount(), and eventSize() after the first aggregate function is deprecated. For example:

  Invalid Example for Demonstration - DO NOT USE

  logscale

  eventSize() | tail(200) | eventInternals()

  Usage of these functions after the first aggregate function is deprecated because they work on the original events, which are not available after the first aggregate function.

  Using these functions after the first aggregate function will be made unavailable in version 1.189.0 and onwards.

  These functions will continue to work before the first aggregate function, for example:

  logscale

  eventSize() | tail(200)

• The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

• The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

• Configuration

  • The semantics of S3_STORAGE_PREFERRED_COPY_SOURCE variable has been adjusted so that LogScale now attempts to fetch from local nodes first, and if that fails, it will try bucket storage. Previously, LogScale would try fetching from both local nodes and bucket storage in parallel. The new behavior should reduce the number of fetches from bucket storage on clusters configured this way.

New features and improvements

Fixed in this release

Improvement