Available for download two days after release.

Bug fixes and updates.

Removed

Items that have been removed as of this release.

GraphQL API

• The following items have been removed:

  • assetType field on the types Alert, Dashboard, ViewInteraction, and SavedQuery.

  • GraphQL mutations createAlertFromTemplate, createAlertFromPackageTemplate, createScheduledSearchFromTemplate, and createScheduledSearchFromPackageTemplate.

  • Enumeration value ChangeTriggersAndActions from the enumeration types Permission and ViewAction.

Deprecation

Items that have been deprecated and may be removed in a future release.

• The color field on the Role type has been marked as deprecated (will be removed in version 1.195).

• The storage task of the GraphQL NodeTaskEnum is deprecated and scheduled to be removed in version 1.185. This affects the following items:

  • The supportedTasks field of the ClusterNode type.

  • The assignedTasks field of the ClusterNode type.

  • The unassignedTasks field of the ClusterNode type.

  • The assignTasks() mutation.

  • The unassignTasks() mutation

  • The INITIAL_DISABLED_NODE_TASKS configuration variable.

• LogScale is deprecating free-text searches that occur after the first aggregate function in a query. These searches likely did not and will not work as expected. Starting with version 1.189.0, this functionality will no longer be available. A free-text search after the first aggregate function refers to any text filter that is not specific to a field and appears after the query's first aggregate function. For example, this syntax is deprecated:

  logscale Syntax

  "Lorem ipsum dolor" 
  | tail(200)         
  | "sit amet, consectetur"

  Some uses of the wildcard() function, particularly those that do not specify a field argument are also free-text-searches and therefore are deprecated as well. Regex literals that are not particular to a field, for example /(abra|kadabra)/ are also free-text-searches and are thus also deprecated after the first aggregate function.

  To work around this issue, you can:

  • Move the free-text search in front of the first aggregate function.

  • Search specifically in the @rawstring field.

  If you know the field that contains the value you're searching for, it's best to search that particular field. The field may have been added by either the log shipper or the parser, and the information might not appear in the @rawstring field.

  Free-text searches before the first aggregate function continue to work as expected since they are not deprecated. Field-specific text searches work as expected as well: for example, myField=/(abra|kadabra)/ continue to work also after the first aggregate function.

• The use of the event functions eventInternals(), eventFieldCount(), and eventSize() after the first aggregate function is deprecated. For example:

  Invalid Example for Demonstration - DO NOT USE

  logscale

  eventSize() | tail(200) | eventInternals()

  Usage of these functions after the first aggregate function is deprecated because they work on the original events, which are not available after the first aggregate function.

  Using these functions after the first aggregate function will be made unavailable in version 1.189.0 and onwards.

  These functions will continue to work before the first aggregate function, for example:

  logscale

  eventSize() | tail(200)

• The setConsideredAliveUntil and setConsideredAliveFor GraphQL mutations are deprecated and will be removed in 1.195.

• The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

• The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

• Configuration

  • KAFKA_MANAGED_BY_HUMIO has an updated behavior. When the default setting KAFKA_MANAGED_BY_HUMIO=true is applied, LogScale will:

    • Set up new topics (ingest queue, global and chatter) using default settings

    • No longer modify existing topic configurations to conform to these defaults

    Key benefits of this change:

    • Clearer separation of responsibilities between LogScale and Kafka

    • Topic settings management should be handled via Kafka admin scripts, not by editing LogScale settings.

    Important

    Ensure Kafka cluster is fully operational and verify the required number of brokers in the Kafka cluster: LogScale will fail to start if topic creation is needed and the available Kafka brokers are less than the number necessary to hit the configured replication factor.

    The following configuration options now only apply on initial creation of a topic:

    • TOPIC_MAX_MESSAGE_BYTES (max.message.bytes for the chatter and ingest-queue topics)

    Customers wishing to customize these can do so via the scripts shipping with their Kafka install, for example kafka/bin/kafka-configs.sh.

    The following configuration variables are now available, and are only applied when a topic is being initially created:

    • CHATTER_INITIAL_REPLICATION_FACTOR (default is 3)

    • INGEST_QUEUE_INITIAL_REPLICATION_FACTOR (default is 3)

    • GLOBAL_INITIAL_REPLICATION_FACTOR (default is 3)

    The min.insync.replicas setting will be initially set to the replication factor minus 1, to allow for the loss of one replica.

    You can customize these settings via the scripts shipping with your Kafka install, for example kafka/bin/kafka-topics.sh and kafka/bin/kafka-configs.sh.

    The default initial replication factor for the ingest queue is now 3, it was previously 2.

Upgrades

Changes that may occur or be required during an upgrade.

• Installation and Deployment

  • The bundled JDK version is now being upgraded to Java 24.

    Due to a version update of the bundled timezone database in the JDK, users may encounter slight changes in LogScale query behavior: previously, the EST, HST and MST time zone identifiers were linked to the -05:00, -07:00 and -10:00 time zone offsets. They are now linked to America/Panama, America/Honolulu and America/Phoenix. While this doesn't change the time zone behavior itself, it may impact queries that look for time zone identifier strings. For example, the query:

    logscale

    createEvents("a=b") 
     | kvParse() 
     | formatTime(format="%Z", as="timezone", timezone=EST) 
     | select(timezone)

    would return -05:00 on earlier releases. As of this release, it will return America/Panama.

    Due to a version update of the bundled CLDR locale data in the JDK, users may encounter slight changes in LogScale query behavior:

    • First day of week is Monday in UAE, see CLDR-15697

    • Default numbering system for Arabic in non-Arabic-speaking locations, see CLDR-17553

    • Comma is added for some date formatting patterns, see CLDR-17812

    • Some time zone names changed due to them becoming links to other zones, see CLDR-17960

    Due to a version update of the bundled Unicode version in the JDK, users may encounter slight changes in LogScale query behavior:

    • Sorting on strings and case-insensitive regex matching may change to be more correct now if your data contains certain Unicode characters.

    • This Java release upgrades the Unicode version to 16.0, which includes updated versions of the Unicode Character Database and Unicode Standard Annexes #9, #15, and #29.

    • Unicode has added 5,185 new characters, for a total of 154,998 characters. The new additions include seven new scripts:

      • Garay is a modern-use script from West Africa.

      • Gurung Khema, Kirat Rai, Ol Onal and Sunuwar are four modern-use scripts from Northeast India and Nepal.

      • Todhri is an historic script used for Albanian.

      • Tulu-Tigalari is an historic script from Southwest India.

    For more details about Unicode 16.0, refer to Unicode Consortium's release note.

New features and improvements

Fixed in this release

Improvement