Humio Server 1.36.2 LTS (2022-03-01)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.36.2LTS2022-03-01

Cloud

On-Prem

2023-01-31No1.26.01.26.0No

Hide file download links

Show file download links

Hide file hashes

Show file hashes

These notes include entries from the following previous releases: 1.36.0, 1.36.1, 1.36.0, 1.36.1, 1.36.0, 1.36.1

Performance and stability improvements.

New features and improvements

  • User Interface

    • New feature to select text in the search page event list and include/exclude that in the search query.

      Imported from 1.36.1

    • Improved dark mode toggle button's accessibility.

      Imported from 1.36.1

    • Disable the option to creating a view if the user does not have Connect a view permission on any repository. This is more intuitive than getting an empty dropdown of repositories to choose from.

      Imported from 1.36.1

    • Improved accessibility when choosing a theme.

      Imported from 1.36.1

    • Allow more dialogs in the UI to be closed with the Esc key.

      Imported from 1.36.1

    • Added ability to resize search page query field by dragging or fitting to query.

      Imported from 1.36.1

    • Time Selector is now accessible by keyboard.

      Imported from 1.36.1

    • Hovering over text within a query now shows the result of interpreting escape characters.

      Imported from 1.36.1

    • New dialogs for creation of parsers and dashboards.

      Imported from 1.36.1

  • GraphQL API

    • Improved the error messages when the GraphQL queries SearchDomain.alert(), SearchDomain.action(), and SearchDomain.savedQuery() do not find the entity with the given ID.

      Imported from 1.36.1

  • Configuration

    • Added the config CORS_ALLOWED_ORIGINS a comma separated list for CORS allowed origins, default allows all origins.

      Imported from 1.36.1

    • When using ZOOKEEPER_URL_FOR_NODE_UUID for assignment of node ID to Humio nodes, and value of ZOOKEEPER_PREFIX_FOR_NODE_UUID (default /humio_autouuid) does not match contents of local UUID file, acquire a fresh node uuid.

      Imported from 1.36.1

    • Make ZOOKEEPER_URL optional. When not set, the zookeeper-status-logger job does not run, and the cluster administration page does not display information about a ZooKeeper cluster.

      Imported from 1.36.1

    • New configuration BUCKET_STORAGE_MULTIPLE_ENDPOINTS and many configurations using STORAGE_2 as prefix. See Bucket Storage.

      Imported from 1.36.1

    • Added INITIAL_FEATURE_FLAGS which lets you enable/disable feature flags on startup. For instance, setting 

      INITIAL_FEATURE_FLAGS=+UserRoles,-UsagePage

      Enables UserRoles and disables UsagePage.

      Imported from 1.36.1

  • Functions

    • Added job which will periodically run a query and record how long it took. By default the query is count().

      Imported from 1.36.1

    • Added a limit parameter to the fieldstats() function. This parameter limits the number of fields to include in the result.

      Imported from 1.36.1

  • Other

    • Added option to specify an IP Filter for which addresses hostname verification should not be made.

      Imported from 1.36.1

    • Added granular IP Filter support for shared dashboards (BETA - API only).

      Imported from 1.36.1

    • Added exceptions to the Humio logs from AlertJob and ScheduledSearchJob.

      Imported from 1.36.1

    • Added analytics on query language feature use to the audit-log under the fields queryParserMetrics.

      Imported from 1.36.1

    • Allow the query scheduler to enqueue segments and aux files for download from bucket storage more regularly. This should ensure that queries fetching small aux files can more reliably keep the download job busy.

      Imported from 1.36.1

    • Remove caching of API calls to prevent caching of potential sensitive data.

      Imported from 1.36.1

    • Added warning logs when errors are rendered to browser during OAuth flows.

      Imported from 1.36.1

    • Added ability to override max auto shard count for a specific repository.

      Imported from 1.36.1

    • Improved the default permissions on the group page by leaving their view expanded once the user cancels update.

      Imported from 1.36.1

    • Allow the same view name across organizations.

      Imported from 1.36.1

    • Improved caching of UI static assets.

      Imported from 1.36.1

    • Improved the error message when an ingest request times out.

      Imported from 1.36.1

    • Added a job that scans segments which are waiting to be archived, this value is recorded in the metric:s3-archiving-latency-max.

      Imported from 1.36.1

    • Improved Humio's detection of Kafka resets. We now load the Kafka cluster id once on boot. If it changes after that, the node will crash.

      Imported from 1.36.1

    • Improved usability of the groups page.

      Imported from 1.36.1

Fixed in this release

  • Summary

    • Reading hashfilter in chunks to avoid having huge off heap buffers.

      Imported from 1.36.1

    • Performance improvements of IngestPartitionCoordinator.

      Imported from 1.36.1

    • Improve the performance of deletes from global.

      Imported from 1.36.1

    • Improved off-heap memory handling. Humio now typically uses only 1 GB on systems with 32 vCPUs, down from typically 16 GB. This leaves more memory for other processes and page cache for data.

    • Downgrade to Java 1.13 on Docker image to fix rare cases of JVM crashes.

      Imported from 1.36.1

  • User Interface

    • For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

      Imported from 1.36.1

    • Remove script-src: unsafe-eval from content security policy.

      Imported from 1.36.1

    • The action message templates {events_str} and {query_result_summary} always evaluate to the same string. To reflect this, the UI has been updated so that these templates are combined into the same item in the template overview for Email, Slack and Webhook actions.

      Imported from 1.36.1

    • The query endpoint API now supports languageVersion for specifying Humio query language versions.

      Imported from 1.36.1

    • Fixed a compatibility issue with Filebeat 7.16.0.

      Imported from 1.36.1

    • Make writes to Kafka's chatter topic block in a similar manner as writes to global.

      Imported from 1.36.1

    • The repository/.../query endpoint now returns a status code of .0 (BadRequest) when given an invalid query in some cases where previously it returned 503 (ServiceUnavailable).

      Imported from 1.36.1

    • Fixed an issue where top would fail if the sum of the values exceeded 2^63-1. Exceeding sums are now pegged to 2^63-1.

      Imported from 1.36.1

    • When bootstrapping a new cluster, set the cluster version in global right away. Since nodes will not boot on a snapshot that doesn't specify a cluster version, it is important that this field exists in all snapshots.

      Imported from 1.36.1

    • Reenable a feature to make Humio delete local copies of bucketed segments, even if they are involved in a query.

      Imported from 1.36.1

    • Fixed an issue where repeating queries could cause other queries to fail.

      Imported from 1.36.1

    • Fixed an issue where the SegmentMoverJob could delete the local copy of a segment, if a pending download of the segment failed the CRC check. The job will now keep the downloaded file at a temporary path until the CRC check completes, to avoid deleting a local copy created by other jobs.

      Imported from 1.36.1

    • Fixed an issue in the Table widget. It will no longer insert 0-values for missing fields in integer columns. Empty fields will be shown consistently, independent of the column data type.

      Imported from 1.36.1

    • Make Humio handle missing aux files a little faster when downloading segments from bucket storage.

      Imported from 1.36.1

    • Fixed an issue where choosing a UI theme would not get saved properly in the user's settings.

      Imported from 1.36.1

    • Removed a spurious warning log when requesting a non-existent hash file from S3.

      Imported from 1.36.1

    • No longer allow requests to /hec to specify organizations by name. We now only accept IDs.

      Imported from 1.36.1

    • Fixed a race condition that could cause Humio to delete more segments than expected when initializing a digester node.

      Imported from 1.36.1

    • The /hec endpoint no longer responds to OPTIONS requests saying it supports GET requests. It doesn't and never has.

      Imported from 1.36.1

    • Fixed an issue in the Export to file dialog on the search page. It is now possible to export fields with spaces.

      Imported from 1.36.1

    • Fixed an issue where the Humio query URLs sent by actions would land users on the search page in editing mode for the alert or scheduled search that had triggered. Now, they still land on the search page, but not in editing mode.

      Imported from 1.36.1

    • Fixed a race condition that could cause digesters to calculate two different offsets during startup when determining where to start consuming, and which partially written segments to discard, which could lead to data loss when partially written segments were replayed from Kafka.

      Imported from 1.36.1

    • Queries on views no longer restart when the ordering of the view's connections is changed.

      Imported from 1.36.1

    • Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

      Imported from 1.36.1

    • Code completion in the query editor now also works on the right hand side of :=.

      Imported from 1.36.1

    • Fixed an issue where MaxMind databases would only update if a license was present at startup and not if it was added later.

      Imported from 1.36.1

    • Fixed session() such that it works when events arrive out of time order.

      Imported from 1.36.1

    • Fixed an issue that repeatedly tried to restart live queries from a given user upon the deletion of the user.

      Imported from 1.36.1

    • Fixed an issue where live queries would sometimes double-count parts of the historic data.

      Imported from 1.36.1

    • Bumped the Humio Docker containers to Java 17. If you manually set any --add-opens flags in your JVM config, you should remove them. The container should set the right flags automatically.

      Imported from 1.36.1

    • When interacting with the REST API for files, errors now have detailed error messages.

      Imported from 1.36.1

    • The AlertJob and ScheduledSearchJob now only log validation errors from running the queries as warnings, previously, some of these were logged as errors.

      Imported from 1.36.1

    • Fixed an issue where, if a custom parser was overriding a built-in parser, then the custom parser could accidentally be overwritten by creating a new parser with the same name.

      Imported from 1.36.1

    • Reenable a feature to make Humio fetch and check hash files from bucket storage before fetching the segments.

      Imported from 1.36.1

    • From the alerts overview and the scheduled searches overview, it is now possible to clear the error status on an alert or a scheduled search.

      Imported from 1.36.1

    • Errors on alerts are now cleared more granularly. Errors when starting the alert query are cleared as soon as the query is successfully started, errors from polling the query are cleared when the query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

      Imported from 1.36.1

    • Reduce noise in the log when the bucket storage upload job attempts to upload a file that is deleted concurrently.

      Imported from 1.36.1

    • Errors on scheduled searches are now cleared more granularly. Errors when starting a query are cleared as soon as another query is successfully started, errors from polling a query are cleared when a query is successfully polled, and errors from invoking actions are cleared when at least one action has been successfully triggered.

      Imported from 1.36.1

    • No longer allow organization- and system-level ingest tokens to ingest into sandbox and system repos.

      Imported from 1.36.1

    • SAML and OIDC only - During signout, Humio background tabs will be redirected to a signout landing page instead of to the login page.

      Imported from 1.36.1

    • Humio now tries to avoid interrupting threads during shutdown, instead allowing them to finish their work. This should reduce log noise when shutting down.

      Imported from 1.36.1

    • Fixed an issue where nodes could request partitions from the query partitioning table that were not present.

      Imported from 1.36.1

    • When starting ingest, Humio checks that the computed starting position in Kafka is below the Kafka end offset. Ensure that the end offset is requested after the starting position is computed, not before. This might prevent a very rare spurious boot failure.

      Imported from 1.36.1

    • Fixed Humio always reading and discarding an already processed message from the ingest queue on boot.

      Imported from 1.36.1

    • Fixed a number of instability issues in the query scheduler. The scheduler should now more reliably ensure that each query either completes, or is cancelled.

      Imported from 1.36.1

    • Fixed an issue where the digest coordinator could consider a host to be alive if the coordinator hadn't seen any timestamps from that host.

      Imported from 1.36.1

    • When creating ingest and chatter topic, reduce desired max.message.bytes to what Kafka cluster allows, if that is lower than our desired values.

      Imported from 1.36.1

  • Queries

    • Query partition tables updates are now rejected if written by a node that is no longer the cluster leader.

      Imported from 1.36.1

  • Other

    • Fixed a race condition between nodes creating the merge result for the same target segment, and also transferring it among the nodes concurrently. If a query read the file during that race condition, an in-memory cache of the file header might hold contents that did not match the local file, resulting in "Broken segment" warnings in queries.