Humio Server 1.56.4 LTS (2022-12-21)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.56.4LTS2022-12-21

Cloud

On-Prem

2023-09-30No1.30.01.26.0No

Hide file download links

Show file download links

Hide file hashes

Show file hashes

These notes include entries from the following previous releases: 1.56.2, 1.56.3, 1.56.2, 1.56.3, 1.56.2, 1.56.3

Bug fixes and updates.

New features and improvements

  • Security

    • The version of Jackson has been upgraded to address CVE-2022-42003 vulnerability.

  • Falcon Data Replicator

    • The feature flag for FDR feeds has been removed. FDR feeds are now generally available.

      Imported from 1.56.3

  • User Interface

    • It is now possible to scroll to the selected event on the Search page.

      Imported from 1.56.3

    • It is now possible to interact directly with the JSON properties and values in the EventList.

      Imported from 1.56.3

    • In the Event List you can assign data types to a column field. You can now make the setting the default for a fields and the setting is remembered when even the field is added to the Event List, for example from the fields panel on the Search page. The button for assigning default data type to a field can be found in the Data type dropdown menu in the column headers of the event list widget. See Field Data Types.

      Imported from 1.56.3

    • Add UI for enabling and disabling social logins on the identity providers page.

      Imported from 1.56.3

    • The Log line format type in the Event List will now render fully expanded JSON when a JSON structure starts with a square bracket or curly bracket followed by a newline.

      Imported from 1.56.3

    • The event lists column header menus have been redesigned to be simpler:

      • You can now click the border between columns header in the event to fit the column to the content.

      • The Event List column Format Panel has been updated to make it easier to manage columns.

      See Format Columns.

      Imported from 1.56.3

    • Humio is now a Falcon product. The Humio owl logo and icons are therefore replaced by beautiful falcons.

      Imported from 1.56.3

  • Documentation

  • Automation and Triggers

    • When creating new Actions, the new name will now stay when you change the Action Type without getting cleared. This also works when you want to change the New Action name while creating a New Action.

      Imported from 1.56.3

    • When you create or edit an action it will now show a warning dialog if you have unsaved changes.

      Imported from 1.56.3

    • A major change has been made to how alert queries are run in order to better reuse live queries when nodes are restarted in a Humio cluster. Find more details at Triggers.

      Imported from 1.56.3

    • With the new implementation for running alerts, alerts will now start faster after a node has been restarted, making it easier for alerts with a small search interval to be able to alert on events during the downtime.

      Imported from 1.56.3

  • GraphQL API

    • Deprecates the defaultSharedTimeIsLive input field on the updateDashboard() GraphQL mutation, in favor of updateFrequency.

      Imported from 1.56.3

  • Configuration

    • New dynamic configuration MinimumHumioVersion, default value is 0.0.0, that allows setting a minimum Humio version that this cluster will accept starting on. This allows protecting against inadvertently later rolling back too far for some other feature to be turned on, that has an implied minimum version for support of that feature.

      Imported from 1.56.3

    • On cloud: added a configuration on dynamic identity providers to configure if users are allowed to be lazily created.

      Imported from 1.56.3

    • Added environment variable ENABLE_SANDBOXES to make it possible to enable and disable sandbox repositories.

      Imported from 1.56.3

  • Dashboards and Widgets

    • Implemented support for widgets with a fixed time interval on dashboards.

      Imported from 1.56.3

  • Queries

    • Reduced memory usage for queries that include noResultUntilDone: true in their inputs. This reduces memory usage in queries that do "export" of an aggregate result via the Query API, as well as the "inner" queries in joins, and queries from scheduled searches.

      Imported from 1.56.3

    • When searching for queries using the Query Monitor in Cluster Administration you can now filter queries based on internal and external query IDs.

      Imported from 1.56.3

  • Functions

    • Improved warning message when using groupBy() with limit=max and the limit is exceeded.

      Imported from 1.56.3

    • Query functions selectFromMin() and selectFromMax() are now generally available for use.

      Imported from 1.56.3

    • BREAKING CHANGE: Changes to the serialization format of the Intermediate Language representation of queries.

      Description: The serialization format used to serialize the intermediate language representation of queries has changed to a JSON format. This has multiple consequences for self-hosted customers. During upgrades to this version and rollbacks from this version you can expect the following:

      • Queries can be slower than usual initially as the query cache clears itself.

      • Queries may cause deserialization errors if they are run during upgrade and two or more nodes have different versions. It is recommended to block all queries upon upgrade and downgrade to and from this version and have all nodes upgrade at the same time.

      Imported from 1.56.3

  • Other

    • In case view is not found we will try to fixup the cache on all cluster nodes.

      Imported from 1.56.3

    • It is now possible to select an entire permissions group when configuring permissions for a role.

      Imported from 1.56.3

      • Added the possibility of creating a role that grants permissions on the system and organization levels from the UI.

      • Updated the flow of creating and editing roles in the Understand Organizations pages.

      Imported from 1.56.3

    • In the dialog for entering a name, when creating a new entity (Triggers, Actions, Scheduled Searches, Parse Data), hitting Enter without filling out the name field will now show an error and will not let you go on to the next page.

      Imported from 1.56.3

    • When saving a parser, validate that the fields designated as tag fields have names that are valid as tag field names. Since packages with invalid parsers cannot be installed, if you have an invalid parser in a package, you will need to edit it to keep being able to install it.

      Imported from 1.56.3

    • Allow any root user and any user with the PatchGlobal permission to use the global patch API. Previously required using the server-local special bootstraps root token, that would be valid only on the local node, thus hard to use via a load balancer.

      Imported from 1.56.3

    • Added support for writing H in place of minutes in the cron schedule of scheduled searches — see Cron Scheduling for details.

      Imported from 1.56.3

    • Added new system permission, PatchGlobal, enabling access to the global patch API.

      Imported from 1.56.3

    • Permit the first character in the field name of a field being turned into a tag to be anything. If the first character does not match [a-zA-Z] then strip that from the resulting tag name. This does not alter the set of allowed names for tags, but allows the field names being turned into tags to have any character as the leading one, for example permitting examples such as &path and *path as field names to turn into the tag #path.

      Imported from 1.56.3

    • Added an option to make token hashing output in json format. See tokenhashing usage described at Hashed root access token.

      Imported from 1.56.3

    • When configuring SAML and OIDC for an organization, for users with the ManageOrganizations permission to enable/disable whether the IDP is Default and Humio managed.

      Imported from 1.56.3

Fixed in this release

  • Security

    • Update Netty to address CVE-2022-41915.

    • Update Scala to address CVE-2022-36944.

      Imported from 1.56.3

  • Falcon Data Replicator

    • Fixed a bug where a dropdown for choosing a parser was not visible in a dialog when creating a new FDR feed.

      Imported from 1.56.3

    • Removed the deprecated feature flag FdrFeeds

      Imported from 1.56.3

  • User Interface

    • Fixed a bug in the computation of query metadata that is used by the UI, which, for example, caused problems showing pie charts with queries containing both groupBy() and top().

      Imported from 1.56.3

  • GraphQL API

    • Fixed an error when querying for actions in GraphQL on a deleted view.

      Imported from 1.56.3

    • Marked all feature flags as preview in GraphQL, which means that once they are no longer needed, they will be removed without being deprecated first.

      Imported from 1.56.3

  • Dashboards and Widgets

    • Fixed an issue where word wrap did not work in the Inspect Panel.

      Imported from 1.56.3

    • Fixed a bug where certain queries would make it seem that all widgets were incompatible, even though the table view still works.

      Importing a dashboard with Shared time enabled and Live disabled would import the dashboard with Live enabled. Likewise, when creating a new dashboard from a template, Live would be on.

      Imported from 1.56.3

    • The Apply Filter button on the dashboard correctly applies the typed filter again.

      Imported from 1.56.3

    • The Single Value color threshold list could get into a state where you could not type threshold values into the four text fields.

      Imported from 1.56.3

  • Functions

    • Fixed a recent bug which caused the category links from groupBy()-groups to be lost when a subsequent sort() was used, and also made grouping-based charts (bar, pie, heat map) unusable in such cases.

      Imported from 1.56.3

  • Other

    • Fixing an issue, where the sessions of a user wasn't revoked when the user was deleted.

      Imported from 1.56.3

    • Fixed a bug in decryption code used when decrypting downloaded files from bucket storage when version-for-bucket-writes=3. The bug did not allow to decrypt files larger than 2GB.

    • Fixes a bug where a placeholder would appear for the region selector on the login pages, even though it itself wouldn't be shown since it has no configured regions.

      Imported from 1.56.3

    • It is no longer possible to have an upload file action with a path in the file name. This would result in an unusable file being created.

      Imported from 1.56.3

    • Fixed an issue where some segments could stall the background process implementing event redaction. This could then result in segments not being merged. The visible symptom would be segments with topOffset attribute being -1, and MiniSegmentMergeLatencyLoggerJob logging that some segments are not being merged.

      Imported from 1.56.3

    • Fixed an issue where queries could fail when the requests within the cluster were more than 8 MB each.

      Imported from 1.56.3

    • Fixed an issue where delete events from a mini-segment could result in the merge of those mini-segments into the resulting target segment never got executed.

      Imported from 1.56.3

    • Fixed an issue where the HTTP threads (Akka pool) could get blocked while sending ingest requests to Kafka, which could result in Humio HTTP endpoints not responding.

      Imported from 1.56.3

    • Fixed an issue with tags in Event Forwarding, so that it is now possible to filter on tags using event forwarding rules, and the tags are present in the forwarded events.

      Imported from 1.56.3

    • Fixed an issue where LogScale could log secrets to the debug log when configured to use LDAP or when configured to use SSL for Kafka.

    • We have removed the @host field from the humio-activity logs and the #host tag from the humio-audit log, as we can no longer provide meaningful values for these. The @host field in the humio-metrics logs will remain, but its value will be changed to the vhost id (an integer number).

      Imported from 1.56.3

    • Fix a regression introduced in 1.46.0 that can cause Humio to fail to properly replay data from Kafka when a node is restarted.

      Imported from 1.56.3

  • Packages

    • Previously parsing packages was very strict, falling when detecting unsupported files. This is no longer the case, unsupported files will now be ignored and won't stop the package from installing.

      Imported from 1.56.3