Available for download two days after release.

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

• Functions

  • Starting from release 1.195, the query functions asn() and ipLocation() will display an error instead of a warning should an error occur with their external dependency. This change will align their behavior to functions using similar external resources, like match(), iocLookup(), and cidr().

Deprecation

Items that have been deprecated and may be removed in a future release.

• The color field on the Role type has been marked as deprecated (will be removed in version 1.195).

• The setConsideredAliveUntil and setConsideredAliveFor GraphQL mutations are deprecated and will be removed in 1.195.

• The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

• The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

• rdns() has been deprecated and will be removed in version 1.249. Use reverseDns() as an alternative function.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

• Functions

  • When running on ingest time, select() now retains @ingesttimestamp internally, even when this field is not selected in the function. This way, functions that require @ingesttimestamp continue to work even if this field is not selected.

    For example, this query works correctly even without selecting @ingesttimestamp:

    logscale

    select([foo, bar])
    | tail(100)

    Unless explicitly selected, @ingesttimestamp is not part of the query result. For instance:

    logscale

    select([foo, bar, contextTimestamp])
    | tail(200)
    | parseTimestamp(contextTimestamp, as=@ingesttimestamp)

    This query outputs foo and bar fields only, but not @ingesttimestamp because it is not explicitly included in select().

    To include @ingesttimestamp in the results, you can either:

    • Add @ingesttimestamp to select() explicitly

    • Give the parsed timestamp a different name.

    This change makes the timestamp behaviour when using select() consistent between queries running on @timestamp and @ingesttimestamp.

New features and improvements

Fixed in this release

Improvement