All Humio Releases

Below is a list of all releases of Humio, in reverse order of their release — the latest at the top and the oldest at the bottom. Remember, when the secondary number is an even number, it indicates it’s a stable release; and when the secondary number is an odd number, it indicates it’s a preview of the stable release that will follow it. See the main Humio Releases page for a more detailed explanation of this numbering system.

Go to the Stable Releases page for a list of just stable releases, or to the Preview Releases for a list of just them.

1.24.2

Minor bug fix release

Release Date: 2021-04-19
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.24.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.24.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Fixed an issue where cost spent in a long-running query got accounted as spent “now” when the query ended in terms of Query Quota
  • Fixed an issue where a repository with very high number of datasources could trigger an error writing an oversized message to kafka from the ingest-reader-leader thread
  • Reduced off-heap memory usage

1.24.1

Minor bug fix release

Release Date: 2021-04-12
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.24.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.24.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Ensure that if the Kafka leader loop thread dies, it kills the Humio process. In rare cases it was possible for this thread to die, leaving the node incapable of performing digest work
  • Allow reverse proxies using 10s as timeout to work also for a query that takes longer than that to initialize
  • Fixes an issue where the user would get stuck in infinite loading after having been invited into an organization
  • Fixed a bug where ingestOnly nodes could not start on a more recent version that the statefull nodes in the cluster

1.24.0

Humio activity log and GraphQL API policy

Release Date: 2021-04-06
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: true
Type: stable

This release promotes the latest 1.23 release from preview to stable.

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.24.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.24.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

New humio-activity repository

Humio will make some internal logs available in a new repository called humio-activity. This is meant for logs that are relevant to users of Humio, as compared to logs that are only relevant for operators. The latter logs are still put into the humio repository. For this release, only new log events will be put into humio-activity, but in later releases, some existing log events that are relevant for users, will be put into the humio-activity repository instead of the humio repository.

For cloud users, the logs for your organization can be accessed through the humio-organization-activity view.

For on-prem users, the logs can be accessed directly through the humio-activity repository. They are also output into a new log file named humio-activity.log which can be ingested into the humio repository, if you want it available there as well. If you do and you are using the Humio Insights Application, you should upgrade that to version 0.0.4. For more information, see docs.

GraphQL API policy

Humio has decided to adopt an evoutionary approach to its GraphQL API, meaning that we will strive to do only backwards compatible changes. Instead of making non-backwards compatible changes to existing fields, we will instead add new fields alongside the existing fields. The existing fields will be deprecated and might be removed in some later release. We reserve the right to still do non-backwards compatible changes, for instance to fix security issues.

For new experimental features, we will mark the corresponding GraphQL fields as PREVIEW. There will be no guarantees on backwards compatibility on fields marked as PREVIEW.

Deprecations and preview

Deprecated and preview fields and enum values will be marked as such in the GraphQL schema and will be shown as deprecated or preview in the API Explorer. Apart from that, the result of running a GraphQL query using a deprecated or preview field will contain a new field extensions, which contains a field deprecated with a list of all deprecated fields used in the query and a field preview with a list of all preview fields used in the query. Example:

{
  "data": ...
  "extensions": {
    "deprecated": [
      {
        "name": "alert",
        "reason": "[DEPRECATED: Since 2020-11-26. Deprecated since 1.19.0. Will be removed March 2021. Use 'searchDomain.alert' instead]"
      }
    ]
  }
}

Deprecated fields and enum values will also be noted in the release note, when they are first deprecated. All use of deprecated fields and enum values will also be logged in the Humio repository humio-activity. They will have #category=GraphQL, subCategory=Deprecation and #severity=Warning. If you are using the API, consider creating an alert for such logs.

Removed support for CIDR shorthand

Previous version of Humio supported a shorthand for IPv4 CIDR expressions.

For example 127.1/16 would be equivalent to 127.1.0.0/16. This was contrary to other implementations like the Linux function inet_aton, where 127.1 expands to 127.0.0.1. Support for this shorthand has been removed and the complete address must now be written instead.

Changelog

  • Major changes: 1.23.0 1.23.1
  • Fixed a scrolling issues on the Kafka cluster admin page
  • Fixed an issue which prevented Safari users from seeing alert actions
  • Fixed an issue which caused problems with forward/backward compatibility of LanguageVersion in GraphQL
  • Fixed an issue on the search page that prevented the event list from scrolling correctly.
  • Removed the QUERY_QUOTA_EXCEEDED_PENALTYconfig (introduced in 1.19.0).
  • The query scheduler now prioritizes new queries started by a user based on the cumulative cost of recent queries started by that user. Added new config QUERY_SPENT_FACTOR with the default value 0.5, which defines the weight of recent query costs when scheduling. Higher values mean that users with high recent query costs will see their queries penalized harder in the scheduling.

1.23.1

Humio activity log and GraphQL API policy

Release Date: 2021-03-24
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.23.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.23.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Allow users group to be represented as a json string and not only array when logging in with oauth.
  • New config: S3_ARCHIVING_IBM_COMPAT for compatility with S3 archiving to IBM Cloud Object Storage.

1.23.0

Humio activity log and GraphQL API policy

Release Date: 2021-03-18
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.23.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.23.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

New humio-activity repository

Humio will make some internal logs available in a new repository called humio-activity. This is meant for logs that are relevant to users of Humio, as compared to logs that are only relevant for operators. The latter logs are still put into the humio repository. For this release, only new log events will be put into humio-activity, but in later releases, some existing log events that are relevant for users, will be put into the humio-activity repository instead of the humio repository.

For cloud users, the logs for your organization can be accessed through the humio-organization-activity view.

For on-prem users, the logs can be accessed directly through the humio-activity repository. They are also output into a new log file named humio-activity.log which can be ingested into the humio repository, if you want it available there as well. If you do and you are using the Humio Insights Application, you should upgrade that to version 0.0.4. For more information, see docs.

GraphQL API policy

Humio has decided to adopt an evoutionary approach to its GraphQL API, meaning that we will strive to do only backwards compatible changes. Instead of making non-backwards compatible changes to existing fields, we will instead add new fields alongside the existing fields. The existing fields will be deprecated and might be removed in some later release. We reserve the right to still do non-backwards compatible changes, for instance to fix security issues.

For new experimental features, we will mark the corresponding GraphQL fields as PREVIEW. There will be no guarantees on backwards compatibility on fields marked as PREVIEW.

Deprecations and preview

Deprecated and preview fields and enum values will be marked as such in the GraphQL schema and will be shown as deprecated or preview in the API Explorer. Apart from that, the result of running a GraphQL query using a deprecated or preview field will contain a new field extensions, which contains a field deprecated with a list of all deprecated fields used in the query and a field preview with a list of all preview fields used in the query. Example:

{
  "data": ...
  "extensions": {
    "deprecated": [
      {
        "name": "alert",
        "reason": "[DEPRECATED: Since 2020-11-26. Deprecated since 1.19.0. Will be removed March 2021. Use 'searchDomain.alert' instead]"
      }
    ]
  }
}

Deprecated fields and enum values will also be noted in the release note, when they are first deprecated. All use of deprecated fields and enum values will also be logged in the Humio repository humio-activity. They will have #category=GraphQL, subCategory=Deprecation and #severity=Warning. If you are using the API, consider creating an alert for such logs.

Removed support for CIDR shorthand

Previous version of Humio supported a shorthand for IPv4 CIDR expressions.

For example 127.1/16 would be equivalent to 127.1.0.0/16. This was contrary to other implementations like the Linux function inet_aton, where 127.1 expands to 127.0.0.1. Support for this shorthand has been removed and the complete address must now be written instead.

Changelog

  • Added IP Filter for readonly dashboard links, and started to audit log readonly dashboard access. In this initial version. The readonly ip filter can be configured with the graphql mutation: mutation { updateReadonlyDashboardIPFilter(ipFilter: “FILTER”) } The FILTER is expected in this format: ip-filter From Humio 1.25 this can be configured in the configuration UI.
  • Added GraphQL queries and mutations for alerts and actions, which correspond to the deprecated REST endpoints for those entities.
  • Added GraphQL mutations addAlertLabelV2, removeAlertLabelV2, addStarToAlertV2 and removeStarFromAlertV2.
  • Added an option to make it easier to diagnose problems by detecting inconsistencies between globals in different Humio instances. Each Humio instance has its own copy of the global state which must all be identical. It has happened that they were not, so now we check and if there is a difference we report an error and dump the global state into a file.
  • Added a new introduction message to empty repositories.
  • Added mode parameter to match(), allowing different ways to match the key.
  • Added support for CIDR matching on match() using mode=cidr.
  • Improved performance when using match() with mode=cidr compared to using cidr() with file().
  • Negated, non-strict match() or lookup is no longer allowed.
  • Deprecated glob parameter on match(), use mode=glob instead.
  • Deprecated file and column parameter on cidr(). Use match() with mode=cidr instead.
  • Deprecated the ReadEvents enum variant from the ViewAction enum in GraphQL. Use the ReadContents variant instead, which has the same semantics, but a more accurate name. ReadEvents will be removed in a future release.
  • Deprecated the REST endpoints for alerts and actions.
  • Deprecated GraphQL mutations addAlertLabel, removeAlertLabel, addStarToAlert and removeStarFromAlert as they did not follow the standard for mutation input.
  • The GraphiQL API Explorer is now available from inside Humio. You can access it using the Help->API Explorer menu.
  • The GraphiQL API Explorer has been upgraded to a newer version. The new version includes a history of the queries that have been run.
  • The SearchDomain.queries GraphQL field has been deprecated, and will be removed in a future release. Use SearchDomain.savedQueries instead.
  • The SearchDomain.viewerCanChangeConnections GraphQL field has been deprecated, and will be removed in a future release. Use SearchDomain.isActionAllowed instead.
  • Allow turning encryption of files stored in bucket storage off by explicitly setting S3_STORAGE_ENCRYPTION_KEY=off (similar for GCP_ )
  • Removed the deprecated Repository.isFreemium GraphQL field.
  • Removed support for shorthand IPv4 CIDR notation in cidr(). See section “Removed support for CIDR shorthand”.
  • Changed the URL of the Kafka cluster page in the settings.
  • Implemented toggle button for dark mode.
  • UI enhancements for the new repository Access Permissions page.
  • Mark required fields on the Accept Terms and Conditions page.
  • Enforce accepting terms and conditions.
  • Enforce permissions to enter Organization Settings page.
  • Enforce permissions to enter creating new repository page.
  • Refactor All Organizations page.
  • Refactor Organization Overview page.
  • Refactor client side action cache of allowed permissions.
  • Refactor how the width of the repository name in the main navigation bar is calculated.
  • It is again possible to sort the events on the test parser page.
  • Made the S3 archiving save button work again.
  • Restyled the alert dialogue.
  • Improved memory use for certain numerical aggregrating functions
  • Improved performance of free-text search using regular expressions
  • Fixed the requirement condition for the time retention on a repository.
  • Fixed an issue which caused ingest-to-multiple-repos() to break, when the parser used copyEvent to duplicate the input events into multiple repositories
  • Fixed an issue causing undersized segment merging to repeatedly fetch the same segments, in cases where the merger job took too long to finish.
  • Fixed an issue where regular expressions too large to handle would sometimes cause the query to hang. Now we report an error.
  • Fixed an issue with the Missing Segments API that caused missing segments to not appear in the missing segments list if they had a replacement segment.
  • Fixed an issue where changes to files would not propagate to parsers or event forwarders.
  • Fixed an issue where Prometheus metrics always reported 0.0 for humio_primary_disk_usage
  • Fixed a bug in event forwarding that made start(), end() and now() return the time at which the event forwarding rule was cached. Instead, now() will return the time at which the event forwarding rule was run. start() and end() were never meant to be used in an event forwarding rule and will return 0, which means Unix Epoch.
  • Fixes a bug where events deleted with the delete-event API would appear deleted at first, but then resurface again after 24h. If user applying delete did not have permission to search the events being deleted.
  • Fixed a bug which caused in() with values=[] to give incorrect results
  • Fixed a bug which caused match() to give incorrect results in certain cases due to incorrect caching
  • Fixed a bug which caused glob-patterns in match() to not match newline characters
  • Fixed a bug which caused tag-filters in anonymous functions to not work in certain cases (causing to many events to be let through)
  • Fixed a bug where the same regex pattern occurring multiple times in a query could cause incorrect results

1.22.1

Minor bug fix release

Release Date: 2021-03-02
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.22.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.22.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Fixes problem where alertpages have no height in safari.
  • Fixes parserlist having no height on safari
  • Fixes overflowing editor bug

1.22.0

Complete UI revamp

Release Date: 2021-03-02
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: true
Type: stable

This release promotes the latest 1.21 release from preview to stable.

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.22.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.22.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

UI revamp

In this version the UI has been given a complete makeover.

Details

To see more details, go through the individual 1.21.x release notes (links in the changelog).

Changelog

  • Major changes: 1.21.0 1.21.1
  • Fixed issue where root users were not allowed to set unlimited time in retention settings
  • Fixed issue where tag filters in anonymous parts within an aggregate did not get applied
  • Increase HTTP chunk size from 16MB to 128MB
  • Add the “ProxyOrganization” header to the list of general auth headers used on REST calls
  • Restrict concurrency when mirroring uploaded files within the cluster
  • Change log lines creating a ‘kind’ field. Kind is used as a tag for the different humio logs
  • Fix issue where updating account settings would present the user with an error even though the update was successful
  • Fixed issue where local segment files would not get deleted in time, potentially filling the disk

1.21.1

Minor bug fix

Release Date: 2021-02-23
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.21.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.21.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Improve performance of “decrypt step” in downloads from bucket storage
  • New “prefetch from bucket” job. When a node starts with an empty disk it will download a relevant subset of segment files from the bucket in order to have them present locally for queries.
  • Server: header in responses from from Humio HTTP server now includes (Vhost, NodeRole) after the version string.

1.21.0

Complete UI revamp

Release Date: 2021-02-22
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.21.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.21.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • The default parser kv has been changed from using the parseTimestamp() function to use the findTimestamp() function. This will make it able to parse more timestamp formats. It will still only parse timestamps with a timezone. It also no longer adds a timezone field with the extracted timestamp string. This was only done for parsing the timestamp and not meant for storing on the event. To keep the old functionality, clone the kv parser in the relevant repositories and store the cloned parser with the name kv. This can be done before upgrading to this release. See docs.
  • kvParse() now unescapes backslashes when they’re inside (' or ") quotes.
  • kvParse() now only unescapes quotes and backslashes that are inside a quoted string.
  • kvParse() now also unescapes single quotes. (')
  • The findTimestamp() function has been changed, so that it no longer has a default value for the timezone parameter. Previously, the default was UTC. If no timezone argument is supplied to the function, it will not parse timestamps that do not contain a timezone. To get the old functionality, simply add timezone=UTC to the function. This can be done before upgrading to this release.
  • The deprecated built-in parser json-for-notifier has been deleted. It has been replaced by the parser json-for-action.
  • The deprecated built-in parser bro-json has been deleted. It has been replaced by the parser zeek-json.
  • Split() no longer adds a @display field to the event it outputs.
  • Make the thread dump job run on a dedicated thread, rather than running on the thread pool shared with other jobs.
  • Added support for disaster recovery of a cluster where all nodes including Kafka has been lost, restoring the state present in bucket storage as a fresh cluster using the old bucket as read-only, and forming a fresh cluster from that. New Configs: S3_RECOVER_FROM_REPLACE_REGION and S3_RECOVER_FROM_REPLACE_BUCKET to allow modifying names of region/bucket while recovering to allow running on a replica, specifying read-only source using S3_RECOVER_FROM_* for all the bucket storage target parameters otherwise named S3_STORAGE_*
  • Improve hit rate of query state cache by allowing similar but not identical queries to share cache when the entry in the cache can form the basis for both. The cache format is incompatible with previous versions, this is handled internally by handling incompatible cache entries as cache misses.
  • Improve performance of writeJson() a bit.
  • Improve number formatting in certain places by being better at removing trailing zeros.
  • Change handling of groupBy() in live-queries which should in many cases reduce memory cost.
  • The experimental function moment has been removed.
  • subnet() now reports an error if its argument bits is outside the range 0 to 32.
  • The transpose function now reports an error if the arguments header or column is provided together with the argument pivot.
  • The replace() function now reports an error if the arguments replacement and with are provided at the same time.
  • The replace() function now reports an error if an unsupported flag is provided in the flags argument.
  • The functions worldMap() and geohash() now errors if requested precision is greater than 12.
  • When on ephemeral disks, nodes being replaced with new ones on empty disks no longer download most of the segments they had before being replaced, but instead schedule downloads based on is being searhed.
  • The Auth0 login page will no longer load a local version of the Auth-Lock library, but instead load a login script hosted on Auth0’s CDN. This may require opening access to https://cdn.auth0.com/ if hosting Humio behind a firewall.
  • Lowered the severity level for some loggings for running alerts.
  • Made loggings for running alerts more consistent and more structured. All loggings regarding a specific alert will contain the keys alertId, alertName and viewId. Loggings regarding the alert query will always contain the key externalQueryId and sometimes also the keys queryId with the internal id and query with the actual query string. If there are problems with the run-as-user, the id of that user is logged with the key user.
  • Made loggings for running scheduled searches more consistent and more structured. All loggings regarding a specific alert will contain the keys scheduledSearchId, scheduledSearchName and viewId. Loggings regarding the alert query will always contain the key externalQueryId and sometimes also the keys queryId with the internal id and query with the actual query string. If there are problems with the run-as-user, the id of that user is logged with the key user.
  • Prevent Humio from booting when Zookeeper has been reset but Kafka has not.
  • Create, update and delete of an alert, scheduled search or action is now recorded in the audit log.
  • Running test of a parser is no longer recorded in the audit log, and irrelevant fields are no longer recorded upon parser deletion.
  • When using filters on dashboards, you can now easily reset the filter, either removing it completely, or using the default filter if one is present.
  • Made sure the humio view humio default parser is only installed when missing, instead of overwriting it every time humio starts.
  • When exporting a package, you now get a preview of the icon you’ve added for the package.
  • Packages can now be updated with the same version but new content. This makes iterating over a package before finalizing it easier.
  • Humio insights package installed if missing on the humio view when humio is started.
  • Raised the parser test character length limit to 20000.
  • Raised the note widget text length limit to 20000.
  • Fixed a performance and a robustness problem with the function unit:convert(). The formatting of the numbers in its output may in some cases be different now.
  • Fixed a number of potential concurrency issues.
  • Fixed a memory leak in rdns() in cases where many different name servers are used.
  • Fixed a bug in parseJson which resulted in failed JSON parsing if an object contained an empty key ("").
  • Fixed a bug which caused eventInternals() to crash if used late in the pipeline.
  • Fixed a bug which caused validation to miss rejecting window() inside window() and session().
  • Fixed a bug which could cause saving of query state cache to take a rather long time.
  • Fixed a bug which could potentially cause a query state cache file to be read in an incomplete state.
  • Fixed a bug in upper() and lower() which could cause its output to be corrupted (in cases where no characters had been changed).
  • Fixed a bug where analysis of a regex could consume extreme amounts of memory.
  • Fixed a bug in lowercase() which caused the case lowercase(field=”*", include="values”) to not process all fields but only the field named “*".
  • Fixed a bug where referenced saved queries were not referenced correctly after exporting them as part of a package.
  • Fixed bugs in format() which caused output from ‘%e’/'%g’ to be incorrect in certain cases.
  • Fixed an issue causing Humio to crash when attempting to delete an idle empty datasource right as the datasource receives new data.
  • Fixed an issue with the validation of the query prefix set on a view for each repository within the view: Invoking macros is not allowed and was correctly rejected when creating a view, but was not rejected when editing an existing connection.
  • Fixed an issue where merge of segments were reported as failed due to input files being deleted while merging. This is not an error, and is no longer reported as such.
  • Fixed an issue where the segment mover might schedule too many segments for transfer at a time.
  • Fixed an issue with lack of escaping in filename when downloading.
  • Fixed an issue causing segment tombstones to potentially be deleted too early if bucket storage is enabled, causing an error log.
  • Fixed an issue causing event redirection to break when using copyEvent to get the same events ingested into multiple repositories.
  • Fixed an issue where repeating queries would not validate in alerts
  • Fixed an issue where cancelled queries could be cached
  • Bumped minimum supported versions of Chrome and Chromium from 60 to 69 due to updated dependencies - note added late

1.20.4

Minor bug fix release

Release Date: 2021-02-22
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.4 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.4. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Fixed an issue causing event redirection to break when using copyEvent() to get the same events forwarded to multiple repositories.
  • Connecting to the Package Marketplace now respects the Humio proxy configuration
  • Fix newline glob handling in in() and match()

1.20.3

Minor bug fix release

Release Date: 2021-02-16
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.3 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.3. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Improve auto completion suggestions.

1.20.2

Minor bug fix release

Release Date: 2021-02-11
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.2 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.2. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Improve query cache hit rate by not starting queries locally when the preferred nodes are down, if the local node has just started - as there is a fair chance the preferred nodes will show up shortly too.
  • Query scheduling now tracks cost spent across queries for each user and tends to select next task so that users (rather than queries) each get a fair share of available CPU time.
  • Fixed a bug that exporting a package using a saved query with spaces in the name would not export the correct name.
  • Fixed a bug that exporting a package with dashboard parameters would not set the correct name space for a saved query called in a parameter.
  • Reduce triggering of auto completion in the query editor.
  • Handle inconsistencies in the global entities file gracefully rather than crashing.
  • Fixed a bug in parseJson which resulted in failed JSON parsing if an object contained an empty key ("").
  • Fixed a bug in upper() and lower() which could cause its output to be corrupted (in cases where no characters had been changed).
  • Fixed a bug where fields panel was not scrollable in safari
  • Fixed an issue where some parts of regexes did not shown in the parser editor
  • Fixed an issue where cloning a dashboard or parser would clone the wrong entity

1.20.1

Minor bug fix release

Release Date: 2021-02-01
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Minor fix to Humio internal JSON logging when using the configuration HUMIO_LOG4J_CONFIGURATION=log4j2-json-stdout.xml

1.20.0

New query editor, Packages (in beta)

Release Date: 2021-01-28
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: true
Type: stable

This release promotes the latest 1.19 release from preview to stable.

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.20.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.20.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Packages

This version introduces Humio packages - a way of bundling and sharing assets such as dashboards and parsers. You can create your own packages to keep your Humio assets in Git or create utility packages that can be installed in multiple repositories. All assets can be serialized to YAML files (like what has been possible for dashboards for a while). With tight integration with Humio’s CLI humioctl you can install packages from local disk, URL, or directly from a Github repository. Packages are still in beta, but we encourage you do start creating packages yourself, and sharing them with the community. At Humio we are also very interested in talking with package authors about getting your packages on our upcoming marketplace. Read more about packages on our package documentation.

Humio Insights application

With the introduction of Humio packages we have created the application Humio Insights. The application is a collection of dashboards and saved searches making it possible to monitor and observe a Humio cluster.

New Query Editor

The new query editor has a much better integration with Humio’s query language. It will give you suggestions as you type, and gives you inline errors if you make a mistake. We will continue to improve the capabilities of the query editor to be aware of fields, saved queries, and other contextual information.

If Humio is running behind a reverse proxy, it must be configured to permit WebSockets to pass through. Given this scenario, if when using the query editor in Humio, if you’re not seeing syntax coloring, it’s an indication that this is not yet configured and the reverse proxy is blocking the sockets. (edited)

New Test Function

A new function called test() has been added for convenience. What used to be done like: tmp := <expression> | tmp=true can now be done using: test( <expression> ). Inside <expression> field names appearing on the right hand side of an equality test, such as field1==field2 compares the values of the two fields. When comparing using = at top-level field1=field2 compares the value of field1 against the string "field2". This distinction is a cause of confusion for some users, and using test() simplifies that.

Changes to Humio’s internal logging

We have made small changes to how Humio logs internally. We did this to better support the new Humio Insights Application. We have tried to keep the changes as small and compatible as possible, but we have made some changes that can break existing searches in the humio repository (or other repositories receiving Humio logs). We made these changes as we think they are important in order to improve things moving forward. One of the benefits is the new Humio Insights App Read more about the details here

Details

To see more details, go through the individual 1.19.x release notes (links in the changelog).

Changelog

  • Major changes: 1.19.0
  • Fixed an issue causing the secondary storage transfer job to plan more segments for transfer than necessary.
  • Segment download timeout raised from 120s to 1800s. Avoids situations where large segments could not be moved around a cluster.
  • Fixed a bug where merged segments could grow too large if the source events were large.
  • Enable Package marketplace (in beta)

1.19.2

Bug fix release

Release Date: 2021-01-25
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.19.2 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.19.2. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to an earlier release can result in data loss.

Changelog

  • Fixed an issue for on-prem users not on multitenant setup by reverted a metric change introduced in 1.18.0, jmx and Slf4j included an OrgId in all metrics for repositories.
  • Fixed automatic installation of Humio Insights package to the humio repository

1.19.1

Bug fix release

Release Date: 2021-01-19
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.19.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.19.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to an earlier release can result in data loss.

Changelog

  • Fixed bug where the format() function produced wrong output for some floating-point numbers
  • Update dependencies with known vulnerabilities
  • Do not retry a query when getting a HTTP 400 error
  • Do not cache cancelled queries.
  • Fixed bug in a saved query in the Humio Insights package
  • Fixed an issue - Do not delete datasource before the segments have been deleted also in bucket storage if present there.

1.19.0

New query editor, Packages (in beta)

Release Date: 2021-01-14
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: true
Type: preview

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.19.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.19.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Packages

This version introduces Humio packages - a way of bundling and sharing assets such as dashboards and parsers. You can create your own packages to keep your Humio assets in Git or create utility packages that can be installed in multiple repositories. All assets can be serialized to YAML files (like what has been possible for dashboards for a while). With tight integration with Humio’s CLI humioctl you can install packages from local disk, URL, or directly from a Github repository. Packages are still in beta, but we encourage you do start creating packages yourself, and sharing them with the community. At Humio we are also very interested in talking with package authors about getting your packages on our upcoming marketplace. Read more about packages on our package documentation.

Humio Insights application

With the introduction of Humio packages we have created the application Humio Insights. The application is a collection of dashboards and saved searches making it possible to monitor and observe a Humio cluster.

New Query Editor

The new query editor has a much better integration with Humio’s query language. It will give you suggestions as you type, and gives you inline errors if you make a mistake. We will continue to improve the capabilities of the query editor to be aware of fields, saved queries, and other contextual information.

If Humio is running behind a reverse proxy, it must be configured to permit WebSockets to pass through. Given this scenario, if when using the query editor in Humio, if you’re not seeing syntax coloring, it’s an indication that this is not yet configured and the reverse proxy is blocking the sockets. (edited)

New Test Function

A new function called test() has been added for convenience. What used to be done like: tmp := <expression> | tmp=true can now be done using: test( <expression> ). Inside <expression> field names appearing on the right hand side of an equality test, such as field1==field2 compares the values of the two fields. When comparing using = at top-level field1=field2 compares the value of field1 against the string "field2". This distinction is a cause of confusion for some users, and using test() simplifies that.

Changes to Humio’s internal logging

We have made small changes to how Humio logs internally. We did this to better support the new Humio Insights Application. We have tried to keep the changes as small and compatible as possible, but we have made some changes that can break existing searches in the humio repository (or other repositories receiving Humio logs). We made these changes as we think they are important in order to improve things moving forward. One of the benefits is the new Humio Insights App Read more about the details here

Changelog

  • Introduced humio insights package that is installed per default on startup on the humio repository
  • Raised the limit for note widget text length to 20000
  • Raised the parser test character length to 20000.
  • No longer overwrite the humio parser in the humio repository on startup.
  • Improved app loading logic.
  • Kafka client inside Humio has been bumped from 2.4.1 to 2.6.0.
  • Improve handling of broken local cache files
  • New config QUERY_QUOTA_EXCEEDED_PENALTY with value 50 by default. When set >= 1.0 then this throttles queries from users that are over their quota by this factor rather than stopping their queries. Set to 0 to disable and revert to stopping queries.
  • For ingest using a URL with a repository name in it, Humio now fails ingest if the repository in the URL does not match the repository of the ingest token. Previously, it would just use the repository of the ingest token.
  • “Notifiers” have been renamed to “actions” throughout the UI and in log statements. The REST APIs have not been changed and all message templates can still be used.
  • In the GraphQL API, on the Alert type, the notifiers field has been deprecated and will be removed in a later release. It has been replaced by the actions field.
  • In the GraphQL API, the value ChangeAlertsAndNotifiers on the Permission enum has been deprecated and will be removed in a later release. It has been replaced by the ChangeTriggersAndActions value. The same is true for the ViewAction enum. On the ViewPermissionsType type, the administerAlertsfield has been deprecated and will be removed in a later release. It has been replaced by the administerTriggersAndActions field.
  • The built-in json-for-notifier parser used by the Humio Repository action (formerly notifier) is deprecated and will be removed in a later release. It has been replaced by an identical parser with the name json-for-action, see docs.
  • The built-in bro-json parser is deprecated and will be removed in a later release. It has been replaced by an identical parser with the name zeek-json, see docs.
  • The configuration option IP_FILTER_NOTIFIERS has been renamed to IP_FILTER_ACTIONS. The old name will continue to work.
  • The configuration option HTTP_PROXY_ALLOW_NOTIFIERS_NOT_USE has been renamed to HTTP_PROXY_ALLOW_ACTIONS_NOT_USE. The old name will continue to work.
  • New feature “Scheduled Searches” making it possible to run queries on a schedule and trigger actions (formerly notifiers) upon query results. See docs.
  • New feature “Event forwarding” making it possible to forward events during ingest out of Humio to a Kafka server. See docs. Currently only available for on-prem customers.
  • The Humio Repository action (formerly notifier) now replaces a prefix ‘#’ character in field names with @tag. so that #source becomes @tag.source. This is done to make them searchable in Humio. You can change the name by creating a custom parser. See docs for more details.
  • The names of the metadata fields added by the Humio Repository action (formerly notifier) has been changed to accomodate that it can now also be used from scheduled searches. See docs for more details.
  • New filter function test( <boolean expression> ) makes it convenient to test complex expressions.
  • New ingest endpoint /api/v1/ingest/raw for ingesting singular webcalls as events. See docs.
  • API Changes (Non-Documented API): getFileContent has been moved to a field on the SearchDomain type.
  • API Changes (Non-Documented API): Queries and Mutations for Parser now expects an id field in place of a name field, when fetching and updating parsers.
  • API Changes (Non-Documented API): Getting Alert by ID has been moved to a field on the SearchDomain type.
  • New feature: “stateless Ingest-only nodes”: A node that the rest of the cluster does not know exists, but is capable of ingesting events into the ingest queue. Enable using NODE_ROLES=ingestonly.
  • unit on timechart (and bucket) now works also when the function within uses nesting and anonymous pipielines.
  • New feature “Custom ingest tokens” making it possible for root users to create ingest tokens with a custom string.
  • The function parseCEF() now deals with extension fields with labels, i.e. cs1=Value cs1Label=Key becomes cef.label.Key=Value.
  • Added asn function for retrieving the ASN number for a given IP address, see docs.
  • New config AUTO_UPDATE_MAXMIND for enabling/disabling updating of all maxmind databases. Deprecates AUTO_UPDATE_IP_LOCATION_DB, but old config will continue to work.
  • New config MAXMIND_IP_LOCATION_EDITION_ID for selecting the maxmind edition of the IP location database. Deprecates MAXMIND_EDITION_ID, but old config will continue to work.
  • New function hash for computing hashes of fields. See docs.
  • Renamed LOG4J_CONFIGURATION environment variable to HUMIO_LOG4J_CONFIGURATION. See Docs. The old variable will no longer work.
  • New validation when creating an ingest token using the API that the parser, if specified, actually exists in the repository.
  • Humio no longer deletes an existing humio-search-all view if the CREATE_HUMIO_SEARCH_ALL environment variable is false. The view instead becomes deleteable via the admin page.
  • When a host dies and Humio reassigns digest, it will warn if a fallback host is picked that is in the same zone as existing replicas. Eliminate warning if falling back to a host in the null zone.
  • Reduced the number of writes to global on restart, due to merge targets not being properly reused.
  • Cluster management stats now shows segments as underreplicated if they are replicated to enough hosts, but are not present on all configured hosts.
  • Add an error message to the event if the user is trying to redirect it to another repo using #repo, and the target repo is invalid.
  • Make the query functions window and series be enabled by default. They can be disabled by seting the configuration options WINDOW_ENABLED and SERIES_ENABLED to false, respectively.
  • The transfer job will delete primary copies shortly after transferring the segments to secondary storage. The copies would previously only be deleted once a full bulk had been moved.
  • Added config option for Auth0 based sign on method: AUTH_ALLOW_SIGNUP defaults to true. The config is forwarded to the auth0 configuration for the lock widget setting: allowSignUp
  • Reduce contention on the query scheduler input queue. It was previously possible for large queries to prevent each other from starting, leading to timeouts.
  • Made cluster nodes log their own version as well as the versions of all other nodes. This makes it easier to tell which versions are running in the cluster.
  • Introduction of the new log file humio-requests.log. Also the log format for the files humio-metrics.log and humio-nonsensitive.log has changed as described above. The guide for sending Humio logs to another Humio cluster has been updated.
  • Custom made saved queries, alerts and dashboards in the humio repository searching for events of the kinds metrics, requests or nonsensitive may need to be modified. This is described in more detail here.
  • Upgraded Log4j2 from 2.13.3 to 2.14.0.
  • Removed config IDLE_POLL_TIME_BEFORE_DASHBOARD_QUERY_IS_CANCELLED_MINUTES. Queries on dashboards now have the same life cycle as other queries.
  • Updated the permission checks when polling queries. This will results in dashboard links “created by users who are either deleted or lost permissions to the view” to get unauthorized. To list all dashboard links, run this graphql query as root: query { searchDomains {dashboards { readOnlyTokens { createdBy name token } } } }
  • Added mutation to update the runAsUser for a read only dashboard token.
  • Added timeout for TCP ingest listeners. By default the connection is closed if no data is received after 5 minutes. This can be changed by setting TCP_INGEST_MAX_TIMEOUT_SECONDS. See docs.
  • Humio will only allow using Zookeeper for node id assignment (ZOOKEEPER_URL_FOR_NODE_UUID) when configured for ephemeral disks (USING_EPHEMERAL_DISKS). When using persistent disks, there is no need for the extra complexity added by Zookeeper.
  • Fixed a rare issue where a node that was previously assigned digest could write a segment to global, even though it was no longer assigned the associated partition.
  • Fixed an rare issue where the digest coordinator would assign digest fewer hosts than configured.
  • Fixed an issue which caused free-text-search to not work correctly for large (>64KB) events.
  • Fixed crash in CleanupDatasourceFilesJob when examining a file size fails due to that file being deleted concurrently.
  • Fixed an issue where the segment rewrite job handling event deletion might rewrite segments sooner than configured.
  • Fixed an issue where cancelling queries could produce a spurious error log.
  • Fixed an issue with the cidr function that would make some IPv4 subnets accept IPv6 addresses and some strings that were not valid IP addresses.
  • Fixed an issue that could cause node id assignment to fail when running on ephemeral disks and using Zookeeper for node id assignment. Nodes in this configuration will now try to pick a new id if their old id has been acquired by another node.
  • Fixed an issue causing Humio to retain deleted minisegments in global for longer than expected.
  • Fixed an issue where unit-convertion (by timechart) did not take effect through groupBy() and window().
  • Fixed an issue causing queries using kvParse() to filter out too much in specific circumstances when filtering on a field assigned before kvParse().
  • Fixed an issue causing queries using kvParse() to be executed incorrectly in certain circumstances when kvParse() assigned fields starting with a non-alphanumeric character.
  • Fixed an issue causing the secondary storage transfer job to select and queue too many segments for transfer at once. The job will now stop and recalculate the bulk to transfer periodically.
  • Fixed an issue with updating user profile, in some situations save failed.
  • Fixed an issue where the filter and groupBy buttons on the search page would not restart the search automatically
  • Fixed logic for when the organization owner panel should be shown in the User’s Danger zone.
  • Fixed an issue where segment merge occasionally reported BrokenSegmentException when merging, while the segments where not broken.
  • Fixed timeout issue in S3 Archving
  • Fixed bug where repeating queries would not validate in alerts.
  • Fixed a bug where fullscreen mode could end up blank

1.18.4

Bug fix release

Release Date: 2021-01-25
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.4 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.18.4. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Fixed an issue for on-prem users not on multitenant setup by reverted a metric change introduced in 1.18.0, jmx and Slf4j included an OrgId in all metrics for repositories.

1.18.3

Bug fix release

Release Date: 2021-01-20
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.3 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.18.3. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Fixed bug where the format() function produced wrong output for some floating-point numbers
  • Update dependencies with known vulnerabilities
  • Do not retry a query when getting a HTTP 400 error
  • Do not cache cancelled queries.

1.18.2

Bug fix release

Release Date: 2021-01-08
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.2 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded at least to 1.16.0 before trying to upgrade to 1.18.2. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer. Rolling directly back to an earlier release can result in data loss.

Changelog

  • Fixed bug where Humio could end in a corrupted state, needing manual intervention before working again.
  • Fixed bug so as to reduce contention on the Query input queue.
  • Adds a new configuration option for auth0: AUTH_ALLOW_SIGNUP. Default value is true.
  • Resolves problem when starting a query spanning very large data sets, a time-out could prevent the browser from getting responses initially.
  • Improves handling when many transfers to secondary storage are pending.

1.18.1

Bug fix release

Release Date: 2020-12-17
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.1 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.18.1. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to an earlier release can result in data loss.

Changelog

  • Fixes a bug where some valid repeating queries would not validate in alerts
  • Fixes a bug where the merge of mini segments could fail during sampling of input for compression.
  • Fixes a bug where a query would not start automatically when requesting to filter or group by a value.
  • Fixes a bug that would allow users with read access to be able to delete a file (#10133)
  • Fixes a bug where queries with @timestamp=x where x was a timestamp with the current search interval could fail
  • Fixes a bug where the permissions check on editing a connection from a view to a repository allowed altering the search prefix of connections other than the one the user currently was allowed to edit.
  • Fixes a bug where top([a,b], sum=f) ignored events where f was not a positive integer. Now it ignores negative and non-numerical input but rounds decimal numbers to integer value.
  • Fixes a bug where the to parameter to unit:convert would cause internal server errors instead of validation errors.
  • Only install default Humio parser to the Humio view if it is missing. No longer overwriting local changes.
  • Add GraphQL mutation to update the runAsUser for a read only dashboard token.
  • Increase number of vCPUs used when parsing TCP ingest, twice the number of the 1.18.0 build.
  • Improve handling of a node being missing from the cluster for a long time by letting other nodes handle the parts of the query that node would normally do.
  • Improve performance of S3 archiving when many repositories have the feature enabled.
  • Add non-sensitive logging that lists the versions of Humio running in the cluster. These logs can be found by searching the Humio debug log for “cluster_versions”.

1.18.0

Repeating Queries, search result caching and new query functions.

Release Date: 2020-11-26
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: true
Type: stable

Repeating Queries, search result caching and new query functions.

This release promotes the latest 1.17 release from preview to stable.

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.18.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.18.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to an earlier release can result in data loss.

Repeating Queries

Humio can now run repeating queries using the beta:repeating() function. These are live queries that are implemented by repeatedly making a query. This allows using functions in alerts and dashboards that typically do not work in live queries, such as selfJoin() or selfJoinFilter(). See the function docs for more information.

Improved Security for Alerts

In order to prevent alert notifiers being used to probe services on the internal network (eg. Zookeeper or the AWS metadata service), Humio now has an IP filter on alert notifiers. The default is to block access to all link-local addresses and any addresses on the internal network; however, you can opt-in to the old behavior by setting the configuration option IP_FILTER_NOTIFIERS to allow all. See IP Filter documentation.

New experimental query function series()

A new experimental query function called series() has been added. It needs to be explicitly enabled on the cluster using the config option SERIES_ENABLED=true.

series() improves upon session() and collect() for grouping events into transactions.

What used to be done with:

groupby(id, function=session(function=collect([fields, ...])))

can now be done using:

groupby(id, function=series([fields, ..])).

See docs for more details.

Search result caching

This new feature stores a copy of live search results to the local disk in the server nodes, and reuses the relevant parts of that cached result when an identical live search is later started. Caching is controlled with the config option QUERY_CACHE_MIN_COST, which has a default value of 1000. To disable caching, set the config option to a very high number, such as 9223372036854775807 (max long value).

Details

To see more details, go through the individual 1.17.x release notes (links in the changelog).

Changelog

  • Major changes: 1.17.0
  • Removed config IDLE_POLL_TIME_BEFORE_DASHBOARD_QUERY_IS_CANCELLED_MINUTES. Queries on dashboards now have the same life cycle as other queries.
  • Changed behaviour when the config ZONE is set to the empty string. It is now considered the same as omitting ZONE.
  • Fixed a bug where TCP listener threads could take all resources from HTTP threads

1.17.0

Repeating Queries, search result caching and new query functions.

Release Date: 2020-11-18
Minimum previous Humio version: 1.16.0
Requires data migrations: false
Has changes to configuration: true
Type: preview

Repeating Queries, search result caching and new query functions.

Important information about upgrading

Beginning with version 1.17.0, if your current version of Humio is not directly able to upgrade to the new version, you will get an error if you attempt to start up the incompatible version. The 1.17.0 release is only compatible with Humio release 1.16.0 and newer. This means that you will have to ensure that you have upgraded to minimum 1.16.0 before trying to upgrade to 1.17.0. In case you need to do a rollback, this can also ONLY happen back to 1.16.0 or newer, rolling directly back to earlier release can result in data loss.

Repeating Queries

Humio can now run repeating queries using the beta:repeating() function. These are live queries that are implemented by repeatedly making a query. This allows using functions in alerts and dashboards that typically do not work in live queries, such as selfJoin() or selfJoinFilter(). See the function docs for more information.

Improved Security for Alerts

In order to prevent alert notifiers being used to probe services on the internal network (eg. Zookeeper or the AWS metadata service), Humio now has an IP filter on alert notifiers. The default is to block access to all link-local addresses and any addresses on the internal network; however, you can opt-in to the old behavior by setting the configuration option IP_FILTER_NOTIFIERS to allow all. See IP Filter documentation.

New experimental query function series()

A new experimental query function called series() has been added. It needs to be explicitly enabled on the cluster using the config option SERIES_ENABLED=true.

series() improves upon session() and collect() for grouping events into transactions.

What used to be done with:

groupby(id, function=session(function=collect([fields, ...])))

can now be done using:

groupby(id, function=series([fields, ..])).

See docs for more details.

Search result caching

This new feature stores a copy of live search results to the local disk in the server nodes, and reuses the relevant parts of that cached result when an identical live search is later started. Caching is controlled with the config option QUERY_CACHE_MIN_COST, which has a default value of 1000. To disable caching, set the config option to a very high number, such as 9223372036854775807 (max long value).

Changelog

  • New config option IP_FILTER_NOTIFIERS, to set up IP filters for Alert Notifications, see docs.
  • New config option ENABLE_ALERTS makes it possible to disable alerts from running (enabled by default), see docs.
  • New config option ALERT_DESPITE_WARNINGS makes it possible to trigger alerts even when warnings occur, see docs.
  • New config option DEFAULT_MAX_NUMBER_OF_GLOBALDATA_DUMPS_TO_KEEP, see docs.
  • New query function parameter to parseJson, removePrefixes, see docs.
  • New query function concatArray, see docs.
  • New query function parseCEF used to parse events which are formatted according to the Common Event Format(CEF), see docs.
  • New experimental query function beta:repeating(), see docs.
  • New experimental query function series(), enabled by config option SERIES_ENABLED=true, see docs.
  • New experimental query function window(), enabled by config option WINDOW_ENABLED=true, see docs.
  • The {events_html} notifier template will now respect the field order from the query, see docs.
  • It is again possible to override a built-in parser in a repository by creating a parser with the same name.
  • Periodically release object pools used by mapper pipeline, to avoid a possible source of memory leaks.
  • Fix negating join expressions.
  • Fixes a bug where join function in some circumstances would fetch subquery results from other cluster nodes more than once.
  • Setting the default query for a view in the UI has been moved from the “Save as Query” to the View’s “Settings” tab.
  • The notifier list is sorted when selecting notifiers for an alert.
  • Improved wording of diagnostics regarding function arguments.
  • Tweaked location of diagnostics regarding missing function arguments.
  • API Changes (Non-Documented API): Saved Query REST API has been replaced by GraphQL.
  • API Changes (Non-Documented API): View Settings REST API has been replaced by GraphQL.
  • Allow running Humio on JDK-14 and JDK-15 to allow testing these new builds.
  • Free-text search has been fixed to behave more in line with the specification.
  • Refuse to boot if the global topic in Kafka does not contain the expected starting offset.
  • Crash the node if an exception occurs while reading from the global Kafka topic, rather than trying to recover.
  • Reduce the max fetch size for Kafka requests, as the previous size would sometimes lead to request timeouts.
  • Improve logic attempting to ensure other live nodes can act as substitutes in case the preferred digest nodes are not available when writing new segments.
  • Fixes the case where datasources receiving data might not be marked idle, causing Humio to retain too much ingest data in Kafka.
  • Fixes the case where Humio would consider local node state when deciding which ingest data was safe to delete from Kafka.
  • Fix several cases where Humio might attempt to write a message to Kafka larger than what Kafka will allow.
  • Fixes the issue where Humio could behave incompatibly with Kafka versions prior to 2.3.0 if KAFKA_MANAGED_BY_HUMIO was true.
  • Refuse to boot if the booting node would cause violations of the “Minimum previous Humio version” as listed in the release notes.
  • Fixes an issue which caused free-text-search to not work correctly for large (>64KB) events.
  • Fixes a bug where unit:convert couldn’t handle numbers in scientific notation.
  • Rename a few scheduler threads so they reflect whether they’re associated with streaming queries (“streaming-scheduler”) or not (“normal-scheduler”)
  • Fixes an issue where Humio might try to get admin access to Kafka when KAFKA_MANAGED_BY_HUMIO was false.
  • If KAFKA_MANAGED_BY_HUMIO is true, Humio will ensure unclean leader election is disabled on the global-events topic.
  • The Humio-search-all view will no longer be removed if CREATE_HUMIO_SEARCH_ALL is set to false. The view will instead become possible to delete manually via the admin UI.
  • Reduce the number of merge target updates Humio will write to global on digest leader reassignment or reboot.
  • Fixes a bug causing join() to not work after an aggregating function.
  • Fixes a bug causing sort()/head()/tail() to work incorrectly after other aggregating functions.
  • Fixes a bug causing the sub-queries of join() etc. to not see events with an @ingesttimestamp occurring later than the search time interval.
  • Fixes an issue causing Humio to fail to upload files to bucket storage in rare cases.
  • Switch from JDK to BouncyCastle provider for AES decrypt to reduce memory usage.
  • Changed default TLS ciphers and protocols accepted by Humio, see docs.

1.16.4

Bugfixes

Release Date: 2020-11-26
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bugfixes

Changelog

  • Fixed an issue causing Humio to fail to upload files to bucket storage in rare cases.
  • Switched from JDK to BouncyCastle provider for AES decrypt to reduce memory usage.
  • Fix negating join expressions.
  • Fixed a bug causing sort/head/tail to work incorrectly after other aggregating functions.
  • Fixed a bug causing the sub-queries of join etc. not to see events with an @ingesttimestamp occurring later than the search time interval.
  • Fixed a bug where the {events_html} message template was formatted as raw HTML in alert emails.
  • Fixed a bug where TCP listener threads could take all resources from HTTP threads.
  • Fixed an issue preventing the metric datasource-count from counting datasources correctly.

1.16.3

Bugfixes

Release Date: 2020-11-10
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bugfixes

Changelog

  • Reduce memory usage when using the “match” or “regex” query functions.
  • Fixed an issue where cleanup of empty datasource directories could race with other parts of the system and cause issues.
  • Fixed an issue when starting a query, where resources related to HTTP requests were not released in a timely manner, causing an error log when the resources were released by hitting a timeout.
  • Fixed an issue which caused free-text-search to not work correctly for large (>64KB) events.

1.16.2

Email and global database improvements

Release Date: 2020-10-30
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Email and global database improvements

Changelog

  • Optimize how certain delete operations in the global database are performed to improve performance in large clusters.
  • Prevent automatic url to link conversion in email clients.

1.16.1

Bug fixes and stability enhancements.

Release Date: 2020-10-21
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes and stability enhancements.

Changelog

  • Fixed an issue where errors were not properly shown in the Humio UI.
  • Convert some non-fatal logs to warning level instead of error.
  • Avoid logging the license key.
  • Ensure metric label names can be sent to Prometheus.
  • Fixed an issue with truncating files on the XFS file system, leading to excess data usage.
  • Fixed an issue where it was impossible to bootstrap a new cluster if ingest or storage replication factors had been configured greater than 1.
  • Fixed an issue where RegEx field extraction did not work in a query.
  • Fixed an issue where missing input validation in alerts could lead to HTML injection in email notifications.
  • Improved the performance for GroupBy.
  • Added new metric jvm-hiccup for measuring stalls/pauses in the JVM.
  • Fixed an issue where sorting of work in the Humio input could end up being wrong.
  • Log information about sorting of snapshots.
  • Raise time to wait until deleting data to improve handling of node failures.
  • Add query parameter sanitization for login and signup pages.
  • HTML sanitization for user fields in invitation mails.
  • Returning bad request when hitting authentication endpoint without a provider id.

1.16.0

Improved alerts and addition of ingest timestamps

Release Date: 2020-10-09
Minimum previous Humio version: 1.12.0
Requires data migrations: true
Has changes to configuration: true
Type: stable

This release promotes the latest 1.15 release from preview to stable.

New features

Ingest timestamps

Humio will set ingest timestamps on all events. This is set in the field named @ingesttimestamp. In later versions, Humio will also support specifying the search time interval using @ingesttimestamp when searching. This will support use cases where data is backfilled etc.

Alerts and notifiers

Field based throttling

It is now possible to make an alert throttle based on a field, so that new values for the field trigger the alert, but already seen values do not until the throttle period has elapsed. See docs.

Notifier logging to a Humio repository

It is now possible to configure an alert notifier that will log all events to a Humio repository. See docs.

Slack notifier upgrade to notify multiple Slack channels

It is now possible to use the Slack notifier to notify multiple Slack channels at once. See docs.

Events as HTML table

In an email notifier, it is now possible to format the events as an HTML table using the new message template {events_html}. Currently, the order of the columns is not well-defined. This problem will be fixed in the 1.17.0 release. See docs.

Configure notifier to not use the internet proxy

It is now possible to configure an alert notifier to not use the HTTP proxy configured in Humio. See docs.

User signup/login flow

Signup & Login

Redesigned signup/login pages. For cloud, we have have split the behavior so users have to explicitly either login or signup.

Invite flow

When adding a user to Humio they will now by default get an email telling them that they have been invited to use Humio. See docs.

Configure Humio to not use the internet proxy for S3

It is now possible to configure Humio to not use the globally configured HTTP proxy for communcation with S3. See docs.

Auto-balanced partition table suggestions

When changing digest and storage partitions it is now possible to get auto-balanced suggestions based on node zone and replication factor settings (via ZONE, DIGEST_REPLICATION_FACTOR and STORAGE_REPLICATION_FACTOR configurations). See docs.

Breaking changes

AWS Java SDK V2

The AWS SDK Humio uses has been upgraded to v2. When configuring Humio bucket storage with Java system properties, the access key must now be in the aws.secretAccessKey property instead of the aws.secretKey property.

Details

To see more details, go through the individual 1.15.x release notes (links in the changelog).

Changelog

  • Major changes: 1.15.0
  • Other changes: 1.15.1
  • Other changes: 1.15.2
  • Fixed missing cache update when deleting a view.
  • Fixed a problem where it was not possible to rename a dashboard.
  • Added metrics for:
    • JVM Garbage Collection
    • JVM Memory usage
    • Missing nodes count
  • Add view to log lines for alerts
  • Log query total cost when logging query information.
  • Fixed a problem where some deleted segments could show up as missing.
  • Added background job to fix problems with inconsistent data in global.
  • Changed limits for what can be fetched via HTTP from inside Humio.
  • Log Humio cluster version in non-sensitive log.
  • Fixed a problem preventing file export/download from the search page.
  • Fixed a problem preventing saved queries from being edited.
  • Fixed a problem where errors would not be shown in the UI
  • Fixed several cases where Humio might attempt to write a larger message to Kafka than what Kafka allows.
  • Fixed an issue where Humio could behave incompatibly with Kafka versions prior to 2.3.0 if KAFKA_MANAGED_BY_HUMIO was true.
  • Fixed a problem with the retention job calculating what segments to delete.
  • Fixed a problem where the QueryScheduler could spend time idling even though there was work to do in situations where digest delays were high.
  • Fixed a problem with auto sharding not working when two repositories had the same tags but differing shard counts.
  • Improved merging of segments by evaluating less data.
  • Bulk Global operations for segments in S3 to avoid overloading Kafka with writes.
  • Support for license files in ES512 format.
  • Fixed a problem where the Zone configuration would not be propagated correctly.

1.15.2

Bugfixes and stability enhancements.

Release Date: 2020-09-29
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Bugfixes and stability enhancements.

Changelog

  • Generate ingest tokens in UUID format, replacing the current format for any new tokens being created.
  • In the dialog for saving a search as an alert, the save button is no longer always grey and boring, but can actually save alerts again.
  • Fixed a problem where the login link did not work in Safari and Firefox.
  • Fixed a problem with scrolling on the login page on screens with low resolution.
  • Made the login and sign up pages responsive to the device.
  • Fixed a bug in the partition table optimizer that lead to unbalanced layouts.
  • Fixed a bug causing an authentication error when trying to download a file when authenticating by proxy.
  • Fixed an issue showing duplicate entries when searching for users.
  • Fixed a memory leak when authenticating in AWS setups.
  • Avoid overloading kafka with updates for the global database by collecting operations in bulk.
  • Only consider fully replicated data when calculating which offsets can be pruned from Kafka.
  • Improved naming of threads to get more usable thread dumps.
  • Changed the query scheduling to account for the work of the overall query, rather than per job started. This allows fairer scheduling of queries hitting many dataspaces e.g. when using search-all.
  • Changed priorities when fetching segments to a node which have been offline for a longer period. This avoids waiting too long before the cluster becomes fully synced.
  • Improved handling of sub-queries polling state from the main query when using join().
  • Fixed an issue where a slow data stream could cause Humio to retain more data in Kafka than necessary, as well as cause a restarted Humio node to reprocess too much data.
  • Added logging to detect issues when truncating finished files.

1.15.1

Bugfixes and IP location DB HTTP_PROXY support.

Release Date: 2020-09-22
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Bugfixes and IP location DB HTTP_PROXY support.

Changelog

  • The job for updating the IP location database now uses the configured HTTP proxy, if present. See docs.
  • Fixed a problem with AWS, where STS tokens would fail to authenticate.
  • Fixed a problem in the UI, where the wrong timestamp was displayed as @ingesttimestamp.
  • Revert login UI to same behavior as before 1.15.0.

1.15.0

Improved alerts and addition of ingest timestamps

Release Date: 2020-09-15
Minimum previous Humio version: 1.12.0
Requires data migrations: true
Has changes to configuration: true
Type: preview

Ingest timestamps

Humio will set ingest timestamps on all events. This is set in the field named @ingesttimestamp. In later versions, Humio will also support specifying the search time interval using @ingesttimestamp when searching. This will support use cases where data is backfilled etc.

Alerts and notifiers

Field based throttling

It is now possible to make an alert throttle based on a field, so that new values for the field trigger the alert, but already seen values do not until the throttle period has elapsed. See docs.

Notifier logging to a Humio repository

It is now possible to configure an alert notifier that will log all events to a Humio repository. See docs.

Slack notifier upgrade to notify multiple Slack channels

It is now possible to use the Slack notifier to notify multiple slack channels at once. See docs.

Events as HTML table

In an email notifier, it is now possible to format the events as an HTML table using the new message template {events_html}. See docs.

Configure notifier to not use the internet proxy

It is now possible to configure an alert notifier to not use the HTTP proxy configured in Humio. See docs.

User signup/login flow

Signup & Login

We introduce new signup/login pages for social login and have split the behavior so users have to explicitly either login or signup.

Invite flow

When adding a user to Humio they will now by default get an email telling them that they have been invited to use Humio. See docs.

AWS Java SDK V2

The AWS SDK Humio uses has been upgraded to v2. When configuring Humio bucket storage with Java system properties, the access key must now be in the aws.secretAccessKey property instead of the aws.secretKey property.

Configure Humio to not use the internet proxy for S3

It is now possible to configure Humio to not use the globally configured HTTP proxy for communcation with S3. See docs.

Auto-balanced partition table suggestions

When changing digest and storage partitions it is now possible to get auto-balanced suggestions based on node zone and replication factor settings (via ZONE, DIGEST_REPLICATION_FACTOR, STORAGE_REPLICATION_FACTOR configurations). See docs.

Changelog

  • Bugfix: CSV files can no longer contain unnamed columns and also trailing commas are disallowed. Queries based on such files will now fail with an error.
  • Improved error handling when a parser cannot be loaded. Before, this resulted in Humio returning an error to the data shipper. Now, data is ingested without being parsed, but marked with an error as described in Parser Errors.
  • If automatically creating users upon login and syncing their groups from the authentication mechanims, the configuration ONLY_CREATE_USER_IF_SYNCED_GROUPS_HAVE_ACCESS now controls whether users should only be created if the synced groups have access to a repository or view. The default is false.
  • Humio will set the field @ingesttimestamp on all events.
  • S3 communication can be configured to not use an HTTP proxy. See docs.
  • Upgrade to AWS SDK v2. When using Java system properties for configuring Humio bucket storage, use aws.secretAccessKey instead of aws.secretKey.
  • New explicit signup and login pages for social login.
  • Newly added users will by default get an email. See docs.
  • Alert notifiers can be configured to not use an HTTP proxy. See docs.
  • Field based throttling on alerts. See docs.
  • New alert notifier type logging to a Humio repository. See docs.
  • New alert notifier template {events_html} formatting events as an HTML table. See docs.
  • Auto-balanced partition table suggestions. See ZONE, DIGEST_REPLICATION_FACTOR, STORAGE_REPLICATION_FACTOR in configuration. See docs.

1.14.6

Email notification improvements

Release Date: 2020-10-30
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Email notification improvements.

Changelog

  • Fixed an issue where missing input validation in alerts could lead to HTML injection in email notifications.
  • Prevent automatic url to link conversion in email clients.

1.14.5

Bug fixes and new metric.

Release Date: 2020-10-21
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes and new metric.

Changelog

  • Fixed an issue where Humio might attempt to write a larger message to Kafka than what Kafka allows.
  • Fixed an issue where Humio could behave incompatibly with Kafka versions prior to 2.3.0 if KAFKA_MANAGED_BY_HUMIO was true.
  • Added new metric jvm-hiccup for measuring stalls/pauses in the JVM.

1.14.4

Bug fixes and stability enhancements.

Release Date: 2020-10-09
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes and stability enhancements.

Changelog

  • Avoid overloading Kafka with updates for the global database by collecting operations in bulk.
  • Fixed a problem where duplicated uploaded files would not be deleted from /tmp.
  • Log Humio cluster version in non-sensitive log.
  • Changed limits for what can be fetched via HTTP from inside Humio.
  • Fixed a problem where some deleted segments could show up as missing.
  • Fixed several cases where Humio might attempt to write a larger message to Kafka than Kafka allows.

1.14.3

Bug fixes and improved query scheduling.

Release Date: 2020-09-24
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes and improved query scheduling.

Changelog

  • Fix missing cache update when deleting a view.
  • Add logging to detect issues when truncating finished files.
  • Fixed an issue where a slow data stream could cause Humio to retain more data in Kafka than necessary, as well as cause a restarted Humio node to reprocess too much data.
  • Improve handling of sub-queries polling state from the main query when using join().
  • Change priorities when fetching segments to a node which have been offline for a longer period. This avoids waiting too long before the cluster becomes fully synced.
  • Changed the query scheduling to account for the work of the overall query, rather than per job started. This allows fairer scheduling of queries hitting many dataspaces e.g. when using search-all.
  • Improve naming of threads to get more usable thread dumps.

1.14.2

Bug fixes, HEC endpoint validation and new metrics

Release Date: 2020-09-17
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes, HEC endpoint validation and new metrics

Changelog

  • Fixed a race condition when cleaning up datasources.
  • Fixed a problem where segments could be downloaded to stateless frontend nodes from Bucket storage.
  • Fixed a problem where too many segments could be generated when restarting nodes.
  • HEC endpoint is now strictly validated as documented for top-level fields, which means non-valid input will be rejected. See docs.
  • Added log rotation for humio-non-sensitive logs.
  • The job for updating the IP location database now uses the configured HTTP proxy, if present. See docs.
  • Improved handling of data replication when nodes are offline.
  • Include user email in metrics when queries end.
  • New metrics for scheduling of queries:
    • local-query-jobs-wait: Histogram of time in milliseconds that each query waited between getting any work done including exports
    • local-query-jobs-queue: Count queries currently queued or active on node including exports
    • local-query-segments-queue-exports-part: Count of elements in queue as number of segments currently queued for query for exports
    • local-query-jobs-queue-exports-part: Count queries currently queued or active on node for exports

1.14.1

Bug fixes

Release Date: 2020-09-08
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes

Changelog

  • Improve performance when processing streaming queries.
  • Remove restriction on length of group names from LDAP.
  • Remove restriction on expire time when creating emergency user through the emergency user API. See Emergency Access.

1.14.0

Free text search, Load balancing of queries and TLS support.

Release Date: 2020-08-26
Minimum previous Humio version: 1.12.0
Requires data migrations: true
Has changes to configuration: true
Type: stable

This release promotes the latest 1.13 release from preview to stable.

Free text search now searches all fields rather than only the @rawstring field.

Load balancing of queries

Humio can now balance and reuse existing queries internally in the cluster. Load balancer configuration to achieve this is no longer needed. See Reverse proxy configuration and Humio Configuration.

TLS support

TLS Encrypt communication using TLS to/from Zookeeper, Kafka, and other Humio nodes.

Iplocation database management changed

The database used as data source for the ipLocation() query function must be updated within 30 days when a new version of the database is made public by MaxMind. To comply with this, the database is no longer shipped as part of the Humio artifacts but will either:

  • Be fetched automatically by Humio provided that Humio is allowed to connect to the db update service hosted by Humio. This is the default behaviour.
  • Have to be updated manually (See ipLocation())

If the database cannot be automatically updated and no database is provided manually, the ipLocation() query function will no longer work.

Configuration change: Controlling what nodes to use as query coordinators

Due to the load balancing in Humio, customers that previously relied on load balancing to control which nodes are query coordinators now need to set QUERY_COORDINATOR to false on nodes they do not want to become query coordinators. See Reverse proxy configuration and Humio Configuration.

To see more details, go through the individual 1.13.x release notes (links in the changelog).

Changelog

  • Major changes: 1.13.0
  • Other changes: 1.13.1
  • Other changes: 1.13.2
  • Other changes: 1.13.3
  • Other changes: 1.13.4
  • Other changes: 1.13.5
  • Improved handling of query restarts to avoid unnecessary restarts in some scenarios.
  • Handling of digest in the case where a node has been offline for a long time has been improved. As an example, running a Humio cluster with a replication factor of 2 and having one node go offline for a long time would leave some ingested data to only reside on one Humio node (and on the ingest queue in Kafka). But this data would not be regarded as properly replicated until the second node returned. If the only node that was left handling a digest partition did a failover, Humio would end up going far back on the Kafka ingest queue to reread data. This has been changed. Now another node from the set of digest nodes will take over if a node goes offline, to keep the replication factor as desired. This means that other hosts, than those specified for a given digest partition on the cluster management page, can actually be handling the digest data for that partition. Only digest nodes will be selected as hosts.

1.13.5

Security and bugfixes

Release Date: 2020-08-12
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: true
Type: preview

Security and bugfixes

Changelog

  • This release fixes a security issue. More information will follow when Humio customers have had time to upgrade. See: Humio Security Disclosures.
  • Bugfix: export to file now allows for fieldnames with special characters.
  • Bugfix: export to file can now include query parameters
  • Bugfix: missing migration of non-default groups would result in alerts failing until the user backing the alert logs in again.

1.13.4

Security and bugfixes

Release Date: 2020-08-05
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: true
Type: preview

Security and bugfixes

Changelog

  • This release fixes a security issue. For more information see: Humio Security Disclosures.
  • Fix issue where a query could fail to search all segments if digest reassignment was occurring at the same time as the query.
  • Fix issue where a node with no digest assignment could fail to delete local segment copies in some cases.

1.13.3

Security and bugfix

Release Date: 2020-08-04
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: true
Type: preview

Security and bugfix

Changelog

  • This release fixes a security issue. For more information see: Humio Security Disclosures.
  • Bugfix: avoid forbidden access error on shared dashboard links by ensuring correct use of time stamps

1.13.2

Bug fixes

Release Date: 2020-08-03
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: true
Type: preview

Bug fixes

Changelog

  • Bugfix: all ingest methods now support the ALLOW_CHANGE_REPO_ON_EVENTS configuration parameter
  • Bugfix: avoid saving invalid bucket storage configurations
  • Bugfix: export to file no longer fails/timeouts on heavy sub queries
  • Bugfix: joins will now propagate limit warnings from sub queries to the main query
  • Bugfix: make sure join-subqueries gets canceled when the main query is canceled
  • Default groups added

1.13.1

Bug fixes and improved search speeds for many-core systems

Release Date: 2020-07-03
Minimum previous Humio version: 1.12.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Bug fixes and improved search speeds for many-core systems

Changelog

  • Improved query scheduling on machines with many cores. This can improve search speeds significantly.
  • Support for a new storage format for segment files that will be introduced in a later release (to support rollback)
  • Bugfix: S3Archiving could write events twice in a special case (When a merge happens where all inputs have been archived, write in global that the merge-result was archived too).
  • Bugfix: Bucket storage in GCP could did not clean up all tmp files

1.13.0

Release Date: 2020-06-24
Minimum previous Humio version: 1.12.0
Requires data migrations: true
Has changes to configuration: true
Type: preview

Free text search now searches all fields rather than only @rawstring.

Load balancing of queries

Humio can now balance and reuse existing queries internally in the cluster. Load balancer configuration to achieve this is no longer needed. See Humio Configuration and Reverse proxy configuration.

TLS support

TLS Encrypt communication using TLS to/from Zookeeper, Kafka, and other Humio nodes.

Iplocation database management changed

The database used as data source for the ipLocation() query function must be updated within 30 days when a new version of the database is made public by MaxMind. To comply with this, the databased is no longer shipped as part of the humio artifacts but will either:

  • Be fetched automatically by Humio provided that Humio is allowed to connect to the db updata service hosted by Humio. This is the default behaviour.
  • Have to be updated manually (See IP location)

If the database cannot be automatically updated and no database is provided manually, the ipLocation() query function will no longer work.

Configuration change: Controlling what nodes to use as query coordinators

Due to the load balancing in Humio, customers that previously relied on load balancing to control which nodes are query coordinators now need to set QUERY_COORDINATOR to false on nodes they do not want to become query coordinators. See Humio Configuration and Reverse proxy configuration.

Changelog

  • Free text search now searches all fields rather than only @rawstring.
  • Humio can now balance and reuse existing queries internally in the cluster. See Humio Configuration
  • Internal communication in a Humio installation can now be encrypted using TLS. See TLS Configuration
  • Added support for WebIdentityTokenCredentialsProvider on AWS.
  • The data source for the ipLocation() query function is no longer shipped with humio but installed/updated separately.
  • Introduced a new ChangeViewOrRepositoryDescription permission for editing the description of a view or repository. This was previously tied to ConnectView and any user with that permission will now have the new permission as well.

1.12.7

Bug fix and additional metrics

Release Date: 2020-09-17
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fix and additional metrics

Changelog

  • New metrics for scheduling of queries:
    • local-query-jobs-wait: Histogram of time in milliseconds that each query waited between getting any work done including exports
    • local-query-jobs-queue: Count queries currently queued or active on node including exports
    • local-query-segments-queue-exports-part: Count of elements in queue as number of segments currently queued for query for exports
    • local-query-jobs-queue-exports-part: Count queries currently queued or active on node for exports
  • Fixed a race condition when cleaning up datasources

1.12.6

Bug fixes

Release Date: 2020-09-03
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes

Changelog

  • Improved handling of query restarts to avoid unnecessary restarts in some scenarios.
  • Remove restriction on length of group names from LDAP.

1.12.5

Security and bug fixes

Release Date: 2020-08-12
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Security and bug fixes

Changelog

  • This release fixes a security issue. More information will follow when Humio customers have had time to upgrade. See: Humio Security Disclosures.
  • Bugfix: missing migration of non-default groups would result in alerts failing until the user backing the alert logs in again.
  • Bugfix: avoid forbidden access error on shared dashboard links by ensuring correct use of time stamps.
  • Fix issue where a node with no digest assignment could fail to delete local segment copies in some cases.

1.12.4

Security fix

Release Date: 2020-08-05
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Security fix

Changelog

1.12.3

Security fix

Release Date: 2020-08-04
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Security fix

Changelog

1.12.2

Bug fixes and improved search speeds for many-core systems

Release Date: 2020-07-03
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes and improved search speeds for many-core systems

Changelog

  • Improved query scheduling on machines with many cores. This can improve search speeds significantly.
  • Support for a new storage format for segment files that will be introduced in a later release (to support rollback)
  • Bugfix: S3Archiving could write events twice in a special case (When a merge happens where all inputs have been archived, write in global that the merge-result was archived too).
  • Bugfix: Bucket storage in GCP could did not clean up all tmp files

1.12.1

Bug fixes - Safari freeze, SAML, bucket storage cleanup, regex and field-aliasing

Release Date: 2020-06-24
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes - Safari freeze, SAML, bucket storage cleanup, regex and field-aliasing

Changelog

  • Fixed an issue with CSP that could cause the Humio UI to freeze on Safari browsers
  • Fixed an issue that prevented deletion of unused objects in bucket storage, if the bucket contained 100 millions of objects or more
  • Fixed an issue with SAML IDPs requiring query parameters to be passed via the configuration SAML_IDP_SIGN_ON_URL
  • Fixed an issue where queries using lookahead in regex would fail to parse - “invalid or unsupported Perl syntax”
  • Fixed an issue where events could be skipped even though they should not, for queries containing field-aliasing (e.g., a:=b) and using subsequent checks on the aliasing field.

1.12.0

Export to bucket, findTimestamp, selfjoin, Emergency user subsystem

Release Date: 2020-06-09
Minimum previous Humio version: 1.10.0
Requires data migrations: true
Has changes to configuration: true
Type: stable

This release promotes the 1.11 releases from preview to stable.

SelfJoin

selfJoin query function allows selecting log lines that share an identifier; for which there exists (separate) log lines that match a certain filtering criteria; such as “all log lines with a given userid for which there exists a successful and an unsuccessful login”.

findTimestamp

findTimestamp query function will try to find and parse timestamps in incoming data. The function should be used in parsers and support automatic detection of timestamps. It can be used instead of making regular expressions specifying where to find the timestamp and parsing it with parseTimestamp. Checkout the documentation for details.

Export to bucket storage/S3

As an alternative to downloading streaming queries directly, Humio can now upload them to an S3 or GCS bucket from which the user can download the data. See docs

Emergency user subsystem

If there are issues with the identity provider that Humio is configured to use, it might not be possible to log in to Humio. To mitigate this, Humio now provides emergency users that can be created locally within the Humio cluster. See docs

Elastic Bulk API change - Fluent Bit users might need to change the Fluent Bit configuration

To ensure compatability with the newest Beats clients, the Elastic Bulk API has been changed to always return the full set of status information for all operations, as it is done in the official Elastic API.

This can however cause problems when using Fluent Bit to ingest data into Humio.

Fluent Bit in default configuration uses a small buffer (4KB) for responses from the Elastic Bulk API, which causes problems when enough operations are bulked together. The response will then be larger than the response buffer as it contains the status for each individual operation. Make sure the response buffer is large enough, otherwise Fluent Bit will stop shipping data. See: https://github.com/fluent/fluent-bit/issues/2156 and https://docs.fluentbit.io/manual/pipeline/outputs/elasticsearch

To see more details go through the individual 1.11.x release notes (links in the changelog).

Changelog

1.11.1

Bug fixes and memory optimizations

Release Date: 2020-05-28
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: preview

Bug fixes and memory optimizations

Changelog

Elastic Bulk API change - Fluent Bit users might need to change the Fluent Bit configuration To ensure compatability with the newest Beats clients, the Elastic Bulk API has been changed to always return the full set of status information for all operations, as it is done in the official Elastic API

This can however cause problems when using Fluent Bit to ingest data into Humio.

Fluent Bit in default configuration uses a small buffer (4KB) for responses from the Elastic Bulk API, which causes problems when enough operations are bulked together. The response will then be larger than the response buffer as it contains the status for each individual operation. Make sure the response buffer is large enough, otherwise Fluent Bit will stop shipping data. See: https://github.com/fluent/fluent-bit/issues/2156 and https://docs.fluentbit.io/manual/pipeline/outputs/elasticsearch

Other changes

  • Several improvements to memory handling
  • Several improvements to query error handling
  • Dashboard widgets now display an error if data is not compatible with the widget

1.11.0

Export to bucket, findTimestamp, selfjoin, Emergency user subsystem

Release Date: 2020-05-19
Minimum previous Humio version: 1.10.0
Requires data migrations: true
Has changes to configuration: true
Type: preview

SelfJoin

selfJoin query function allows selecting log lines that share an identifier; for which there exists (separate) log lines that match a certain filtering criteria; such as “all log lines with a given userid for which there exists a successful and an unsuccessful login”.

findTimestamp

findTimestamp query function will try to find and parse timestamps in incoming data. The function should be used in parsers and support automatic detection of timestamps. It can be used instead of making regular expressions specifying where to find the timestamp and parsing it with parseTimestamp. Checkout the documentation for details.

Export to bucket storage/S3

As an alternative to downloading streaming queries directly, Humio can now upload them to an S3 or GCS bucket from which the user can download the data. See docs

Emergency user subsystem

If there are issues with the identity provider that Humio is configured to use, it might not be possible to log in to Humio. To mitigate this, Humio now provides emergency users that can be created locally within the Humio cluster. See docs

Changelog

1.10.9

Security fix

Release Date: 2020-08-05
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Security fix

Changelog

1.10.8

Security fix

Release Date: 2020-08-04
Minimum previous Humio version: 1.10.0
Requires data migrations: false
Has changes to configuration: false
Type: stable

Security fix

Changelog

1.10.7

Bug fixes and improved search speeds for many-core systems

Release Date: 2020-07-03
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes and improved search speeds for many-core systems

Changelog

  • Improved query scheduling on machines with many cores. This can improve search speeds significantly.
  • Support for a new storage format for segment files that will be introduced in a later release (to support rollback)
  • Bugfix: S3Archiving could write events twice in a special case (When a merge happens where all inputs have been archived, write in global that the merge-result was archived too).
  • Bugfix: Bucket storage in GCP could did not clean up all tmp files

1.10.6

Bug fixes - Safari freeze, SAML and bucket storage cleanup

Release Date: 2020-06-24
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes - Safari freeze, SAML and bucket storage cleanup

Changelog

  • Fixed an issue with CSP that could cause the Humio UI to freeze on Safari browsers
  • Fixed an issue that prevented deletion of unused objects in bucket storage, if the bucket contained 100 millions of objects or more
  • Fixed an issue with SAML IDPs requiring query parameters to be passed via the configuration SAML_IDP_SIGN_ON_URL

1.10.5

Bug fixes - humio-search-all and query timeouts

Release Date: 2020-06-09
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes - humio-search-all and query timeouts

Changelog

  • Fixed a number of issues with export and alerts in the humio-search-all repository
  • Fixed an issue where long running queries started as part of an export, or by calls to the /query API would time out
  • Fixed an issue where a query could get a “Result is partial” warning when the query took more then 15 minutes to complete while a merge of segments addressed by the query happened in the background

1.10.4

Bug fixes for long-running queries

Release Date: 2020-05-29
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes for long-running queries

Changelog

  • Fixed a number of bugs that would cause long-running queries using join, selfJoin or selfJoinFilter to timeout or fail

1.10.3

Bug fixes.

Release Date: 2020-05-20
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes.

Changelog

  • Bugfix: An issue could result in malformed messages being put into the ingest queue. This version is able to read and skip such messages. The issue causing such malformed messages has been fixed.

1.10.2

Optimizations, improved Humio health insights and bug fixes.

Release Date: 2020-05-19
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: stable

Optimizations, improved Humio health insights and bug fixes.

Changelog

  • Bugfix: A couple of memory leaks have been found and fixed.
  • Bugfix: Autocreate users on login when synchronizing groups with external provider.
  • Bugfix: Humio search all repo interaction with alerts and notifiers.
  • Improvements made to speed of frontpage loading. Noticeable for customers with many repositories and groups.
  • Paging in UI. administration/Users & Permissions.
  • Better sorting when computing query prefixes in order to reuse queries.

1.10.1

Optimizations, improved Humio health insights and bug fixes.

Release Date: 2020-05-04
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: stable

Optimizations, improved Humio health insights and bug fixes.

Changelog

  • This release fixes a security issue. For more information see: Humio Security Disclosures.
  • New metric: “query-delta-cost”: 30s delta cost on queries per repo, for the entire cluster.
  • New internal jobs logging system stats: Search for #type=humio | NonSensitive | groupby(kind) to see them.
  • Thread pools have been reorganized to require fewer threads and threads have been given new names.
  • Memory requirements set using -XX:MaxDirectMemorySize is much lower now. Suggested value is ((#vCpu+3)/4) GB.
  • Improved protocol within cluster for submitting queries to allow faster start of queries on huge repositories.

1.10.0

UI for Role Based Access Control (RBAC), Health Check API, Kafka version update, Vega charts

Release Date: 2020-04-27
Minimum previous Humio version: 1.8.5
Requires data migrations: true
Has changes to configuration: true
Type: stable

RBAC, Health Check API, Kafka, Vega

This release promotes the 1.9 releases from preview to stable. The main new additions are:

Security fixes

Kafka version update

  • Updated Humio to use Kafka 2.4. Humio can still use versions of Kafka down through 1.1.
  • Be aware that updating Kafka also requires you to update Zookeeper to 3.5.6. There is a migration involved in updating Zookeeper. See Zookeeper’s migration FAQ here. Use the migration approach using an empty snapshot. The other proposed solution can loose data.
  • Updated Kafka and Zookeeper Docker images to use Kafka 2.4. Updating to Kafka 2.4 should be straightforward using Humio’s Kafka/Zookeeper Docker images. Zookeper image will handle migration. Stop all Kafka nodes. Stop all Zookeeper nodes. Start all Zookeeper nodes on the new version. Start all Kafka nodes on the new version. Before updating Kafka/Zookeeper, we recommend backing up the Zookeeper data directory. Then, add the Zookeeper properties described below. If you are deploying Kafka/Zookeeper using other tools, for example Ansible scripts, be aware there is a migration involved in updating Zookeeper.
  • When updating Kafka/Zookeeper we recommend setting these Zookeeper properties
    # Do not start the new admin server. Default port 8080 conflicts with Humio port.
    admin.enableServer=false
    # purge old snapshot files
    autopurge.purgeInterval=1
    # Allow 4 letter commands. Used by Humio to get info about the Zookeeper cluster
    4lw.commands.whitelist=*
    

New features

  • Several improvements to Query Functions
  • NetFlow support extended to also support IPFIX.
  • Added humio Health Check APIs
  • Chart styling support (Pie, Bar)
  • Time Chart series roll-up
  • Replaces chart library with Vega, can be disabled using the ENABLE_VEGA_CHARTS=false flag.
  • Linear interpolation now default. New interpolation type: Basis
  • Control widget stylying directly from dashboards
  • Support for controlling color and title in widgets
  • Add Role Based Access Control (RBAC) to the Humio UI
  • New line interpolation options
  • Dealing with missing data points in timecharts

To see more details go through the individual 1.9.x release notes (links in the changelog).

Note: This release is identical to 1.9.3 apart from the version string.

Changelog

1.9.3

Security fixes, bug fixes, and timechart improvements

Release Date: 2020-04-22
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: preview

Security Fixes

A few security vulnerabilities have been discovered as part of a proactive penetration test. None are known to have been exploited. More information will be forthcoming.

New Time Charts Features

Dealing with missing data points in timecharts

This release improves the handling of missing data points in time charts. Previously you could either interpolate missing data points based on the surrounding data, or leave gaps in the charts. With the introduction of the new charts in 1.9.0 the gaps became more apparent than previously, and we have added new options to deal with missing data points. These replace the previous option “Allow Gaps”, with four new options:

  • Do Nothing - This will leave gaps in your data
  • Linear Interpolation - Impute values using linear interpolation based on the nearest known data points.
  • Replace by Mean Value - Replace missing values with the mean value of the series.
  • Replace by Zero - Replace missing values with zeros.

New line interpolation options

The release also introduces new options for line interpolation.

  • Monotone
  • Natural
  • Cardinal
  • Catmull-Rom
  • Bundle

The latter three are impacted by the ‘tension’ setting in the timechart Style editor.

Changelog

  • Security: [critical] Fixed more security vulnerabilities discovered through proactive penetration testing (more information will be forthcoming).
  • New query function fieldstats.
  • More efficient “collect” function implementation.
  • Allow more concurrent processing to take place in “export” query processing.
  • Styling improvements in the “Style” panel for widgets.
  • New Time Chart interpolation options.
  • New options for dealing with missing data in Time Charts.
  • Improves responsiveness of the recent queries dropdown, and limits the number of stored recent queries to 100 per user per repository.
  • Allow dots in tagged field names.
  • If at startup the global-snapshot.json file is missing, then try loading the “.1” backup copy.
  • Bug fix: The segment queue length metric was not correct when segments got fetched from bucket storage by a query.
  • Bug fix: the query metric only measured time for streaming queries, now it includes non-streaming as well.
  • Bug fix: api-explorer not working due to CSP inline script.
  • Improve disk space monitoring when using bucket storage.

1.9.2

Security fix and bug fixes

Release Date: 2020-03-25
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: preview

Security fix and bug fixes

Changelog

  • Added API to the list and deleted missing segments from global. See reference here.
  • Security: [critical] Fixed a security vulnerability discovered through proactive penetration testing (more information will be forthcoming).

1.9.1

Security fix and bug fixes

Release Date: 2020-03-23
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false
Type: preview

Security fix and bug fixes

Changelog

  • This is a critical update. Self-hosted systems with access for non-trusted users should upgrade immediately. We will follow up with more details when this update has been rolled out.
  • Bug fix: the health-check failed-http-status-check would get stuff in warn state, this has now been fixed

1.9.0

UI for Role Based Access Control (RBAC), Health Check API, Kafka version update, Vega charts

Release Date: 2020-03-12
Minimum previous Humio version: 1.8.5
Requires data migrations: true
Has changes to configuration: true
Type: preview

RBAC, Health Check API, Kafka, Vega

Changelog

Role Based Access Control

Role Based Access Control (RBAC) through the UI is now the only permission model in Humio. Please see the Authorization documentation for more information.

Kafka version update

  • Updated Humio to use Kafka 2.4. Humio can still use versions of Kafka down through 1.1.
  • Be aware that updating Kafka also requires you to update Zookeeper to 3.5.6. There is a migration involved in updating Zookeeper. See Zookeeper’s migration FAQ here. Use the migration approach using an empty snapshot. The other proposed solution can loose data.
  • Updated Kafka and Zookeeper Docker images to use Kafka 2.4. Updating to Kafka 2.4 should be straightforward using Humio’s Kafka/Zookeeper Docker images. Zookeper image will handle migration. Stop all Kafka nodes. Stop all Zookeeper nodes. Start all Zookeeper nodes on the new version. Start all Kafka nodes on the new version. Before updating Kafka/Zookeeper, we recommend backing up the Zookeeper data directory. Then, add the Zookeeper properties described below. If you are deploying Kafka/Zookeeper using other tools, for example Ansible scripts, be aware there is a migration involved in updating Zookeeper.
  • When updating Kafka/Zookeeper we recommend setting these Zookeeper properties
    # Do not start the new admin server. Default port 8080 conflicts with Humio port.admin.enableServer=false
    # purge old snapshot files autopurge.purgeInterval=1
    # Allow 4 letter commands. Used by Humio to get info about the Zookeeper cluster 4lw.commands.whitelist=*
    

Query Function updates

  • New caseSensitive option added to the parseTimestamp query function.
  • Queries involving join can now be with ‘used export to file’ and the /query HTTP endpoint.
  • New selectLast function, which is like select but aggregate.
  • Improved (reduced) memory consumption for live groupby, and for groupby’s involving many distinct keys.

Health Check APIs

The overall health of a Humio system is determined by a set of individual health checks. For more information about individual checks see the Health Check page and the Health Check API page.

IPFIX

Humio’s NetFlow support has been extended to also support IPFIX. See Humio’s docs for IPFIX.

Vega + chart series colors

This version replaces our chart library with Vega. The goal is to create a better, customizable, and more interactive charting experience in Humio. This first iteration is largely just a feature replacement for the existing functionality, with a few exceptions

Support for controlling color and title in widgets

Each chart type now supports assigning colors to specific series. This will allow you to, for instance, assign red to errors and green to non-errors.

You can find the series configuration controls in the Style tab of the Search page.

Control widget styling directly from dashboards

Now, you can click Edit Styling in the widget’s menu and modify styling directly from the dashboard view.

Time Chart series roll-up

To prevent the charts from getting cluttered, you can adjust the maximum number of series that should be shown in the chart. Any series that are not part of the top-most series will be summed together and added to a new series called Other.

Interpolation types

Linear interpolation is now the default, and we have added a new type of interpolation: Basis.

Bar Chart styling support

You can now style your bar charts to control things like label position and colors.

Pie Chart styling support

You can now style your pie charts, and they will default to having a center radius (actually making them donuts!).

Disabling Vega

Since charts are such a central feature, we allow disabling the new implementation of widgets if you are experiencing issues with them. You can disable Vega charts globally using the ENABLE_VEGA_CHARTS=false flag.

1.8.9

Security fixes

Release Date: 2020-03-25
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: stable

Security fixes.

Changelog

  • Security: [critical] Fixed a security vulnerability discovered through proactive penetration testing (more information will be forthcoming).

1.8.8

Security fixes

Release Date: 2020-03-23
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: stable

Security fixes.

Changelog

  • Fix security problem. This is a critical update. On-prem system with access for non-trusted users should upgrade. We follow up with more details when this update has been rolled out.

1.8.7

Bug fixes

Release Date: 2020-03-12
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes.

Changelog

  • Bug fix: Alerts and exports now work on the special view “humio-search-all”.
  • Bug fix: When a merge of segment files fails, delete the tmp-file that was created.
  • Bug fix: The Kafka and Zookeeper images tagged with “1.8.6” were partially upgraded to Kafka 2.4.0.

1.8.6

Bug fixes

Release Date: 2020-03-09
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: stable

Note! Do not install the Kafka, Zookeeper or “single” Docker images of this build. Install 1.8.7 or later.

Changelog

  • Note! Do not install the Kafka, Zookeeper or “single” Docker images of this build. Install 1.8.7 or later.
  • Bug fix: Assigning ingest tokens to parsers in sandbox repos.

1.8.5

Bug fixes

Release Date: 2020-02-28
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: stable

Bug fixes.

Changelog

  • Bug fix: “Export” queries could hit an internal limit and fail for large datasets.
  • Lower ingest queue timeout threshold from 90 to 30 seconds.
  • Bug fix: TCP socket ingest listener would spend a lot of CPU when connected but not receiving any data.
  • Bug fix: Fixed a race in upload of segment files for systems set up using ephemeral disks.

1.8.4

UI Scroll bugfix for Chrome 80 (again)

Release Date: 2020-02-19
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: stable

This release is purely a fix for the Humio UI. After upgrading to Chrome 80, people have been experiencing issues with scrolling in some of Humio’s widgets. We did not find all the problems in the previous release.

Changelog

  • Bug fix: Fix more scrolling issues in Chrome 80 and above.

1.8.3

UI Scroll bugfix for Chrome 80

Release Date: 2020-02-13
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: stable

This release is purely a fix for the Humio UI. After upgrading to Chrome 80 people have been experiencing issues with scrolling on the Search page - specifically when the “Field” panel is visible.

Changelog

  • Bug fix: Fix scrolling issue in Chrome 80 on the Search Page.

1.8.2

Bug fixes

Release Date: 2020-02-10
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: true
Type: stable

This is a bug fix release.

Changelog

  • Bug fix: The new feature for ephemeral servers using Zookeeper to UUID did not properly reconnect when the network failed.
  • Bug fix: Bucket storage download could report “download completed” also in case of problems fetching the file.
  • Bug fix: When a node was missing for an extended period of time the remaining nodes would create smaller segment files than they should.

1.8.1

Bug fixes

Release Date: 2020-02-03
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: true
Type: stable

This is a bug fix release.

Changelog

  • New feature for ephemeral servers: Let Zookeeper assign the UUID that in turn assigns the node ID in the cluster. This is turned on by setting the config option ZOOKEEPER_URL_FOR_NODE_UUID to the set of Zookeepers to use for this. The option ZOOKEEPER_PREFIX_FOR_NODE_UUID (default “/humio_autouuid_") sets the prefix to allow rack awareness. Note: Do not turn this on for an existing cluster. Do not turn on if running older 1.7.x or 1.8.x builds.
  • Bug fix: Fix edge case errors in the regex engine. Some case insensitive searches for some Unicode characters were not supported correctly.
  • Bug fix: Avoid calling fallocate on platforms that do not support this (for example, ZFS).

1.8.0

Joins, Bucket Storage Backend, Query Quotas, UI Improvements

Release Date: 2020-01-27
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: true
Type: stable

This release promotes the 1.7 releases from preview to stable. The main new additions are:

To see more details go through the individual 1.7.x release notes (links in the changelog).

Note: This release is identical to 1.7.4 apart from the version string.

Changelog

1.7.4

Bug fixes

Release Date: 2020-01-27
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: preview

Bug fixes

Changelog

  • Add Chromium to the list of compatible browsers
  • Allow webhook notifiers to optionally not validate certificates.
  • Bug fix: join now accepts absolute timestamps in millis in start and end parameters.
  • Bug fix: Stabilized sync of uploaded files within a cluster in combination with bucket storage.
  • Bug fix: Allows “Force remove” of a node from a cluster.

1.7.3

Bug fixes

Release Date: 2020-01-17
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: preview

Bug fixes

Changelog

  • New log output option for the LOG4J_CONFIGURATION configuration now allows the built-in: log4j2-stdout-json.xml to get the log in NDJSON format, one line for each event on stdout.
  • ERROR logs get output to stderr instead of stdout to avoid breaking the potential stdout format.
  • top() function allows limit up to 20,000 by default now. Used to be 1,000.

1.7.2

Bug fixes

Release Date: 2020-01-16
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false
Type: preview

Bug fixes

Changelog

  • Change: When the system starts with no users at all, the first user to log get root priviledges inside the system.
  • The “query monitor” and “query quota” new share the definition of “cost points”. The definition has changed in such a way that quotas saved by version up to 1.7.1 and earlier are disregarded by this (and later) versions.
  • New config: LIVEQUERY_STALE_CANCEL_TRIGGER_DELAY_MS and LIVEQUERY_STALE_CANCEL_COST_PERCENTAGE controls discard of live queries that have not been polled by a client for a while when the system experiences digest latency of more than the delay.
  • New config: LIVEQUERY_CANCEL_TRIGGER_DELAY_MS and LIVEQUERY_CANCEL_COST_PERCENTAGE controls cancelling of live queries that have been consuming the most cost for the previous 30s when the system experiences digest latency of more than the delay. New metrics: livequeries-canceled-due-to-digest-delay, livequeries-rate-canceled-due-to-digest-delay and livequeries-rate
  • New config: USING_EPHEMERAL_DISKS allows running a cluster on disks that may be lost when the system restarts by assuming that only copies in Bucket Storage and the events in Kafka are preserved across restarts. If the filesystem remains during restart this is also okay in this mode and more efficient then fetching the files from the bucket.
  • New config: LOG4J_CONFIGURATION allows a custom log4j file. Or set to one of the built-in: log4j2-stdout.xml to get the log in plain text dumped on stdout, or log4j2-stdout-json.xml to get the log in NDJSON format, one line for each event on stdout.
  • New Utility inside the jar. Usage java -cp humio.jar com.humio.main.DecryptAESBucketStorageFile <secret string> <encrypted file> <decrypted file>. Allows decrypting a file that was uploaded using bucket storage outside the system.
  • Bug fix: The Zookeeper status page now shows a warning when the commands it needs for the status page to work are not whitelisted on the ZK server.
  • Bug fix: Restart of queries using lookup/match/cidr when the uploaded file changes only worked for top-level functions, not when nested inside another function.
  • Bug fix: Query of segments only present in a bucket now works even if disabling further uploads to bucket storage.
  • Bug fix: Bucket storage, GCP variant: Remove temporary files after download from GCP. Previous versions left a copy in the tmp dir.
  • Bug fix: Top(x, sum=y) now also support non-integer values of y (even though the internal state is still an integer value)
  • Bug fix: #repo=* never matched but should always match.
  • Bug fix: Retention could in fail to delete obsolete files in certain cases.
  • Bucket storage: Support download after switching provider from S3 to GCP or vice versa.
  • Bucket storage: Continue cleaning the old buckets after switching provider from S3 to GCP or vice versa.
  • Bucket storage: Also keep copies of the “metadata files” that you use for lookup and match functions in the bucket and restore from there when needed.

1.7.1

Bug fixes

Release Date: 2020-01-06
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: true
Type: preview

Bug fixes and removal of limitations.

Changelog

  • Bug fix: Handle large global snapshot files (larger than 2 G).
  • Allow explicit auto as argument to the span parameter in bucket and timechart. This makes it easier to set span from a macro argument.
  • Remove 64 K restriction on individual fields to be parsed by parsers.
  • Bug fix: Reuse of live dashboard queries on the humio-search-all repository did not work correctly. As an effect the number of live queries could keep increasing.
  • Bug fix: Saved Queries/macros was not expanded when checking if a live dashboard query could reuse an existing query.
  • Bug fix: The Postmark integration was always assuming a humio.com from address. This has been fixed by introducing a new POSTMARK_FROM configuration parameter.

1.6.11

Bug fixes

Release Date: 2020-01-06
Minimum previous Humio version: 1.5.19
Requires data migrations: false
Has changes to configuration: false
Type: stable

Handle large global snapshot file

Changelog

  • Bug fix: Handle large global snapshot files (larger than 2 G).

1.7.0

Join, Bucket Storage Backend, Query Quotas, UI Improvements

Release Date: 2019-12-17
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: true
Type: preview

Joins

Humio now supports joins in the query language; the functionality is largely similar to what could previously be done by running a query, exporting it as a .csv, uploading said .csv file, and then using the match() function to filter/amend a query result. See docs.

Bucket Storage

Humio now supports storing segment files on Amazon S3 (and Google cloud storage) and compatible services to allow keeping more segment files than the local disks have room for and managing the local disk as a cache of these files. See docs.

New stable/preview release versioning

Stable release will have an even Minor version. If Minor is an odd number (like in this release), it is a preview release. Critical fixes will be back ported to the most recent stable release. More details can be found here.

Dashboard Improvements

To make it easier to integrate with external systems Humio dashboards, can now be passed URL parameters to set the dashboard’s global time interval. By passing query parameters ?time=<unix ms timestamp>&window=5m the dashboard will be opened with a 10m time window (5m before and after the the origin specified by time). The feature is not available for shared dashboards - since they do not support changing time intervals.

You can now also disable shared dashboards completely using the SHARED_DASHBOARDS_ENABLED=false configuration setting.

See the changelog for a more complete list of changes.

Changelog

  • Upgrading: After installling this version, it is not possible to roll back to a version lower than 1.6.10. Be on version 1.6.10 before upgrading to this version.
  • Top Feature: Bucket Storage with support for S3 and Google cloud storage, see description.
  • Top Feature: Joins allowing subqueries and joining data from multiple repositories, see description.
  • Top Feature: Query errors will now be highlighted as-you-type in on the search page.
  • Top Feature: The “Queries” page has been replaced with a dropdown on the Search page, that allows searching saved and recent queries.
  • Top Feature: Query quotas allowing limiting how many resources users can use when searching, see description
  • UI: Improved Query Monitor in the administration section, making it much easier to find expensive queries. See description
  • UI: Queries page removed, and delete and edit saved query functionality moved into “Queries” dropdown on search page.
  • UI: Add support for loading a specific time window when launching a dashboard, by setting time= and window= in the URL.
  • UI: Improve word-wrap and allow columns in the event list to be marked as ‘autosize’. Autosizing columns will adapt to the screen size when word-wrap is enabled.
  • UI: Word-wrap and event list orientation is now sticky in a session, meaning revisiting the search page will keep the previous selected options.
  • UI: Allow disabling automatically searching when entering a repository search page, on a per-repo basis.
  • UI: The time selector on dashboards now allow panning and zooming - like the one on the search page.
  • UI: Bugfix - Don’t show “unexpected error” screen when Auth Token expires.
  • UI: Bugfix - Ensure counts of fields and value occurrences on the event list are reliable.
  • Function: New function json:prettyPrint()
  • Function: New function xml:prettyPrint()
  • Function: New function callFunction, allows you to call a humio function by name. This is useful if you for instance want a dashboard where you can control what statistics your widgets show based on a parameter, e.g. timechart(function=callFunction(?statistic, field=response_time))
  • Function: The function top has a new max=field argument, that can be used to make it work as a more efficient alias a groupby/sort combination, like top(field, max=value, limit=5) is equivalent (and much faster than) groupby(field, function=max(value)) | sort(limit=5).
  • Function: The implementation of the percentile function has been updated to be more precise (and faster).
  • Config: COMPRESSION_TYPE=high is now the default compression type. Clusters running with default configuration, wil change to high compression unless the configuration COMPRESSION_TYPE=fast is set.
  • Config: Add SHARED_DASHBOARDS_ENABLED configuration setting which allows disabling access to the shared dashboards feature - if e.g. your organization has strict security policies.
  • Config: Autosharding can now bet set “sticky” which means fixed as set by user on a specific (input) datasource. The API also allows listing all autosharding rules, both system-manages and sticky.
  • New stable/preview release versioning scheme. See description.
  • Use case-insensitive comparison of usernames (historically an email address) when logging into Humio.
  • Java 13 is the recommended Java version. Docker images are now running Java 13.

1.6.10

Bug fixes

Release Date: 2019-12-12
Minimum previous Humio version: 1.5.19
Requires data migrations: false
Has changes to configuration: yes - see changes
Type: stable

Bug fixes and LDAP improvements.

Changelog

  • Username/email is treated case-insensitive in Humio. This is more expected behavior of usernames as emails addresses are often used. In some rare occasions duplicate accounts might have been created with difference in casing and this change can trigger the otherwise dormant account to be chosen when logging in the next time. If this happens, use the administrations page to delete the unwanted user account and let the user log in again.
  • LDAP: It is now possible to specify an attribute within the LDAP record to use for the username rather than the default (an email address). This is only the case when using ldap-search method by specifying the LDAP_USERNAME_ATTRIBUTE in the environment. Group names when using LDAP have historically been the distinguished name (DN) for that group, it is now possible to specify and attribute in the group record for the name by setting LDAP_GROUPNAME_ATTRIBUTE. These changes necessitated a breaking change in the ldap-search code path in cases where users of Humio authenticate with a username (e.g. user) rather than an email address (e.g. user@example.com). To elicit the same behavior as previous versions of Humio simply specify the LDAP_SEARCH_DOMAIN_NAME which in the past would default to the value of LDAP_DOMAIN_NAME but no longer does.
  • Add LDAP_USERNAME_ATTRIBUTE and LDAP_GROUPNAME_ATTRIBUTE configuration settings to enable more control over names carried from LDAP into Humio.
  • Require setting LDAP_SEARCH_DOMAIN_NAME explicitly when using ldap-search authentication method.
  • Bugfix: Query sessions were not properly cleaned up after becoming unused. This lead to a leak causing high amount of chatter between nodes.

1.6.9

Bug fixes

Release Date: 2019-11-25
Minimum previous Humio version: 1.5.19
Requires data migrations: false
Has changes to configuration: no - but see changes to backup in 1.6.6
Type: stable

Bug fixes and a new background job that reduces number of small files on disk.

Changelog

  • New background job: Find segments that are too small compared to the desired sizes (from current config) and merge them into larger files. For COMPRESSION_TYPE=high this will recompress the inputs while combining them. This job runs by default and may be turned off by MERGE_UNDERSIZED_SEGMENTS_ENABLED=false.
  • Detect when event ingested are more than MAX_HOURS_SEGMENT_OPEN (24h by default) old and add the tag humioBackfill to them in that case to keep “old” events from getting mixed with current “live” events.
  • Improved memory usage from having large global.

1.6.8

Bug fixes

Release Date: 2019-11-19
Minimum previous Humio version: 1.5.19
Requires data migrations: false
Has changes to configuration: no - but see changes to backup in 1.6.6
Type: archive

Bug fixes.

Changelog

  • Support for “sticky autosharding” and listing of current autosharding settings for all datasources in a repository.
  • Bugfix: Segment merge could leave out some parts when merging, leading to segments not on average becoming a large as is desired.

1.6.7

Bug fixes and performance improvements

Release Date: 2019-11-04
Minimum previous Humio version: 1.5.19
Requires data migrations: false
Has changes to configuration: no - but see changes to backup in 1.6.6
Type: archive

Bug fixes and performance improvements

Changelog

1.6.6

Bug fixes and performance improvements

Release Date: 2019-10-23
Minimum previous Humio version: 1.5.19
Requires data migrations: false
Has changes to configuration: yes - see changes to backup
Type: archive

Bug fixes and performance improvements

Changelog

  • Humio’s built-in backup has been changed to delay deleting segment data from backup. By default Humio will wait 7 days from a segment file is deleted in Humio until it is deleted from backup. This is controlled using the config DELETE_BACKUP_AFTER_MILLIS. Only relevant if you are using Humios built-in backup.
  • Improved error recovery in query language. This should make query error messages easier to read.
  • It’s now possible to change the description for a repository or view.
  • Bugfix: In Chrome, saving a query and marking it as the default query of the repo would previously not save the default status.
  • Bugfix: Looking at the events for e.g. a timechart was previously untenable, due to a scrolling bug.
  • Performance improvements in digest pipeline.

1.6.5

Bug fixes and performance improvements

Release Date: 2019-10-01
Minimum previous Humio version: 1.5.19
Requires data migrations: no (But see 1.6.3)
Has changes to configuration: false
Type: archive

Bug fixes and performance improvements

Changelog

  • Bugfix: Support reading events from the ingest queue in both the format written by 1.6.3 and older and 1.6.4.
  • Improved performance of internal jobs calculating the data for the cluster management pages.
  • Redefined the event-latency metric to start measuring after parsing the events, just before inserting them into the ingest queue in Kafka. This metric is the basis of autosharding decisions and other scheduling priority choices internally and thus needs to reflect the time spent on the parts influenced by those decisions.
  • The new metric event-latency-repo/<repo> includes time spent parsing too and is heavily influenced by the size of the bulks of events being posted to Humio.
  • The new metric ingest-queue-latency measures the latency of events through the ingest queue in Kafka from the “send” to kafka and until it has been received by the Digest node.
  • Bugfix: Apply the extra Kafka properties from config also on deleteRecordsBefore requests.

1.6.4

Retracted - did not properly support existing events in ingest queue.

Release Date: 2019-09-30
Minimum previous Humio version: 1.5.19
Requires data migrations: no (But see 1.6.3)
Has changes to configuration: false
Type: archive

Bug fixes and performance improvements

Changelog

  • Do not install this build. Do not roll back from this build to 1.6.3 - update to 1.6.5 instead.
  • Bugfix: Creating new labels while adding labels to a dashboard did not actually show the labels as available.
  • Improved performance of timecharts when there are many series and timechart need to select the “top n” ones to display.
  • Improved word wrap of events list.
  • /query endpoint and queryjobs endpoint now coordinate thread usage lowering the maximum total number of runnable threads from queries at any point in time.
  • New metrics tracking number of active datasources, internal target latency of digest, number of threads availabel for queries, latency of live query updating and segment building, and lateny of overall ingest/digest pipeline tracked for each repository.

1.6.3

Dashboard parameters improvements and Bug Fixes

Release Date: 2019-09-25
Minimum previous Humio version: 1.5.19
Requires data migrations: yes - hash filters are rebuild
Has changes to configuration: false
Type: archive

Bug Fixes. Hash filters need rebuilding. Dashboard parameters can depend on each other Fixed various small UI bugs in data table Improvements to event list column headers

Changelog

  • Bugfix: Latin-1 characters (those with code point 128 - 255) were not added correctly to hash filters. To fix this, Humio needs to rebuild the existing hash filters: The old hash files get deleted, and a new file prefix “hash5h3” is applied to the new files. This will be done in the background after updating to this version. For estimation of time to complete use a rate of 100GB/core/hour of original size. While rebuilding hash filter files the system will have a higher load from this and from searches that would benefit from the filters but need to run without them.
  • New Feature: File based parameters on dashboards can now filter parts of a file out, by specifying a subset of entries in the file that should be used. This filtering can also be based on other parameters, so entries pulled from the file can depend on e.g. a query based parameter.
  • When setting up Humio the server will refuse to start if Kafka is not ready in the sense that the number of live Kafka brokers is less than number of Kafka bootstrap hosts in the configuration for Humio.
  • Bugfix: The Event List widget no longer shows column menus on dashboards. Editing was not possible, but the menus would open anyway.
  • Bugfix: The “Show in context” window on event list would “jump” when used and a live query on dashboards.
  • Bugfix: Fix issue that made the timestamp column wrap on some platforms.
  • Bugfix: Make JSON word-wrapping work when a column is syntax highlighted.
  • Bugfix: Exporting a search (Or using /query endpoint in other contexts) would fail if any node was down even when the files needed to satisfy the search were available on other nodes. Note that a search in progress will still fail if a node goes missing while the search runs. (Searches in the UI restart in this case but that is not possible for an export.)
  • Bugfix: Fix issue where streaming queries failed when a node in the cluster was unavailable.
  • Improved names and states in thread dumps and added a group field to the traces. Run #type=humio class=threaddump state=RUNNABLE | timechart(group,limit=50,span=10s) in the Humio repo to get an idea of variations in what the CPU time is being spent on.
  • LDAP login code rewritten.
  • Bugfix: In Chrome, it was sometimes not possible to rename a dashboard, clone a dashboard, duplicate a widget, and other actions. This has been fixed.
  • Bugfix: Using dropEvent() in a parser did not work when using the “Run Tests” button.
  • Replication of segment files among nodes now runs in multiple threads to allow faster restore form peers for a failed node.
  • Bugfix: Fix issue with layout of pagination of table widgets in dashboards overflowing when it has a horizontal scroll bar
  • EventList column header menu opens on click now, instead of on mouse hover.
  • Bugfix: Previously, exporting data from queries with parameters would always fail. This now works as expected.
  • Regex matching gets rejected at runtime if it spends too many resources.
  • New config: MAX_JITREX_BACKTRACK default to 1,000,000: Limits CPU resources spent in a regex match, failing the search if exceeded.
  • New config: MAX_EVENT_SIZE defaults to 1 MB. Increasing this may have adverse affects for overall system performance.
  • New config: HASHFILTER_MAX_FILE_PERCENTAGE defaults to 50. Hash filter files that are larger than this relative to their segment file do not get created. This trades the work required to scan them on search for disk space for files that are not very large.

1.6.2

Event List Columns and Bug Fixes

Release Date: 2019-09-04
Minimum previous Humio version: 1.5.19
Requires data migrations: false
Has changes to configuration: false
Type: archive

The release replaces the event list on the search page with a table view where you can control which columns you would like to see.

Changelog

  • New Event List with customizable columns.
  • The fields panel is open by default. You can change this in “Your Account” preferences.
  • The default order of the events on the search page has been reversed. It is more natural to have newer events (lines) below older ones - just like logs appear in a log file. This can be changed in “Your Account”.
  • Saving a default query for you repository also saves the selected columns and will show them by default.
  • The special handling of @display has been removed. The field is now like any other. If you use it today, you can add it as a column in your default columns.
  • Use the keyboard arrows and Enter key to quickly add and remove columns while in the “Filter Fields” textbox.
  • You can now add favorite fields to your views. These fields will always be started to the top of the fields panel, and be visible even if they are not part of the currently visible events.
  • If a field that you would like a column for is not present in the list of fields. You can mannually add it from the toolbar of the fields panel.
  • New query function hashRewrite to hide values of selected fields
  • New query function hashMatch to be able to search (for exact value) on top of the hashed values.
  • The UI now only checks the version of the Humio installation when determining if it should reload dashboards.
  • Users are now notified about the dashboard reload 5s before reloading.
  • Browser minimum versions get checked in the UI to warn if using a version known to miss required features.
  • Improve scheduling of uploads in S3 archiving to achieve better throughput.
  • Bugfix: Fixed issue where some cluster nodes where configured differently than others, it would trigger a dashboard reload every 10s.
  • Bugfix: timechart with limit selecting top series was nondeterministic when live.

1.6.1

Bug Fixes

Release Date: 2019-08-26
Minimum previous Humio version: 1.5.19
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bug fixes

Changelog

  • Bugfix: Fixed issue preventing you from clicking links in Note Widgets.
  • Bugfix: Live queries could lock the HTTP pool, leading to a combination of high CPU and problems accessing the HTTP interface.

1.6.0

Improved compression. Note Widgets and YAML Template Files

Release Date: 2019-08-22
Minimum previous Humio version: 1.5.19
Requires data migrations: true
Has changes to configuration: true
Type: archive

Support for improved compression.

Dashboard Note Widgets can include descriptions and can contain template expresisons and links to external systems using the current parameter and time values

Read more about note widgets at https://docs.humio.com/ref/notes

We are also introducing a new YAML file format for dashboard templates. The new format is much human-readable. It is the first step to being able to persist all entities (parsers, queries, alerts) as files.

Support for the now deprecated dashboard file import API and JSON format will continue, but expect it to be removed in a later release.

Changelog

  • This update does not support rolling updates. Stop all Humio nodes. Then start them on the new version.
  • Note! Rolling back to v1.5.x is supported only for COMPRESSION_TYPE=fast which is the default in this release. The default is expected to change to “high” later on. The new compression types “high” and “extreme” are considered BETA release.
  • COMPRESSION_TYPE=fast (Default!) corresponds to versions before 1.6.x
  • COMPRESSION_TYPE=high turns on a stronger compression when segments get merged. This results in better compression, at the expense of having slightly lower compression for the very recent events. The improvement is typically 2-3 times better compression for the merged segments.
  • COMPRESSION_TYPE=extreme uses the stronger compression also in the digest part, even though it is not as effective there due to the gain from having a larger file after the merge.
  • COMPRESSION_LEVEL now supports the range 0 - 9. Default is now 3 for fast type, and 9 for the others. (Up to 17 was allowed previously: Check your config, as values above 9 will be rejected and Humio will refuse to start!)
  • COMPRESSION_LEVEL_MINI allows adjusting the compression level for high and extreme types of the compression inside the critical digest pipeline. Default is 0, max is 6. Keep low for optimal digest throughput.
  • The sizes of the compressed files and the associated hash-filter files are tracked separately for the merged part, allowing you to see in the UI how well the long-term compression works as part of the total set.
  • Introducing a new YAML dashboard file format.
  • Removed internal REST API for shared dashboards.
  • Added GraphQL fields for shared dashboards.
  • Changed GraphQL fields for dashboard widgets.
  • Added Note Widget support for dashboards.
  • The function sort query function now ignores case when sorting strings.
  • Pending parameter edits toggle, so that parameter changes are not immediately applied if the user desires not to.
  • Renaming a repository is now possible in settings.
  • New function copyEvent function allows duplicating an event into another datasource while ingesting. Use case to make the two events differ.
  • New function start and function end functions provides the time range being queried as fields.
  • New function urlEncode and function urlDecode functions allow for encoding or decoding the value of a field for use in urls.
  • The function parseJson now accepts an exclude and include parameter. Use this to specify which fields should not be included.
  • Added cluster information pages for the Zookeeper & Kafka Cluster used by Humio. Both are available under Administration.
  • Bugfix: Drawer heights were not being persisted between browser sessions.
  • Bugfix: Changing Dashboard labels will no longer trigger a “Dashboard was modified remotely” notification.
  • Bugfix: Styling of the dashboard “Labels” dropdown has been fixed.

1.5.23

Maintenance build

Release Date: 2019-07-31
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • New config property: CACHE_STORAGE_SOURCE defaults to both, and also allows secondary to only cache files from the secondary storage
  • function collect now requires the set of fields to collect.
  • Bugfix: case that assigned fields inside was not handled properly when pre-filtering using the hash filters.
  • Bugfix: Include size spent on hash filter files on disk in the cluster overview as Humio data rather than system data.

1.5.22

Maintenance build

Release Date: 2019-07-11
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • There is now a humio-query-id response header on responses to “/query” search requests.
  • Bugfix: Improved performance of “/query” endpoint.
  • Bugfix: Always close everything when Akka actorsystem is terminated.

1.5.21

Maintenance build

Release Date: 2019-07-04
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • If an events gets @error=true in the ingest pipeline (including in the parser) it will also get #error=true as a tag. This makes events with an error become a separate datasource in Humio allowing you to delete them independent from the others and makes problems from parsing timestamps not disrupt the pipeline when back filling old events.
  • New function: function dropEvent lets you discard an event in the parser pipeline. If a parser filters out events using e.g. a regex match that does not match the parser will just keep the incoming events. Use this new function (typically in a case) to explicitly drop an event while parsing it when it does not match the required format.

1.5.20

Maintenance build

Release Date: 2019-07-04
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Bugfix: “services” is no longer a reserved repo name.

1.5.19

File based parameters on dashboards

Release Date: 2019-07-03
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

This release makes it easier to configure load balancers by adding sticky session headers to most UI Http requests.

The existing header Humio-Query-Session is used. For non-search related HTTP requests it will contain a random sticky session ID. For search related HTTP requests it contains a hash of the query being executed - just like it has done previously.

New file based parameter type is added to dashboards

Changelog

  • The HTTP request header Humio-Query-Session is now added to most requests from the UI.
  • New type of parameter: Dashboards can now have file based parameters, which are populated with data from files uploaded to Humio
  • New shared files. Shared files can be used like the existing files, that are uploaded to repositories. A shared file is visible in all repositories and can be used by everyone. Only root users can create and manage them. For now, shared files can only be added using Humios API. Shared files are visible in the files tab in all repositories for all users. Root users can also edit and delete shared files there. Shared files can be used from query functions like function lookup and function match they are referenced using the path /shared/filename.
  • Make failover to the next node in digest when a node gets shut down gracefully faster by delaying the shutdown a few seconds while lettign the follower catch up.
  • Bugfix: Fixed Interval Queries on dashboards used the time of the dashboard being loaded as the definition of “now”. It will now use the time of the last change in the dashboard’s global time.
  • Improved performance on servers with many cores for functions (such as top) that may require large states internally.

1.5.18

Support ephemeral drives for caching.

Release Date: 2019-06-26
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

New function parseXml and support ephemeral drives for caching.

Changelog

  • Humio can now keep a cache of the latest files on when told the path of a cache-dir using CACHE_STORAGE_DIRECTORY. Humio will then write copies of some of the files from primary and secondary storage here, assuming it is faster to read from the cache. The cache does not need to remain after a restart of Humio. CACHE_STORAGE_PERCENTAGE (Default 90) controls how much of the available space on the drive Humio will try to use. This is useful on system such as AWS where the primary data storage is durable but slow due to being across a network (e.g. EBS) while the server also has fast NVME-drives that are ephemeral to the instance.
  • New function parseXml for use in parsers
  • New built in parser corelight-es to parse Corelight data send using the Elastic protocol.
  • MAX_EVENT_FIELD_COUNT (default 1000) controls the enforced maximum number of fields in an even in the ingest phase.
  • Bugfix: Certain regular expressions involving ^ and $ could fail to match.
  • Bugfix: Parameter input fields for query based parameters initially always showed “*” even when a default value was set. It now correctly shows the default value for the parameter.
  • Remove configuration flags: REPLICATE_REMOTE_GLOBAL_HOST and REPLICATE_REMOTE_GLOBAL_USER_TOKEN
  • Bugfix: Reduce size of global snapshots file.

1.5.17

Maintenance build.

Release Date: 2019-06-20
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build.

Changelog

  • Update BitBucket OAuth integration to version 2
  • Bugfix: Updates to repos with reserved names on legacy repos did not work.

1.5.16

Maintenance build.

Release Date: 2019-06-11
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build.

Changelog

  • Bugfix: Invalid parser no longer prevents ingest token page from loading.
  • On Windows, the Ctrl+O shortcut no longer opens the “jump” menu on the home page, but Ctrl+Y does instead, to avoid conflicts with browser shortcuts.
  • Bugfix: Ability to read global-snapshot.json when the file is larger than 1GB.

1.5.15

Dashboard improvements

Release Date: 2019-06-06
Minimum previous Humio version: 1.5.8
Requires data migrations: true
Has changes to configuration: false
Type: archive

Dashboard improvements and bugfixes.

Changelog

  • Dashboard parameters with fixed list of values now keep the order they were configured with
  • Dashboard parameters with fixed list of values can now have labels for each of the values
  • New function eventFieldCount() that returns the number of fields that this event uses internally for the values, use along with eventSize() to get statistics on how your events are stored.
  • New config: VALUE_DEDUP_LEVEL default to the compression level. Range is [0 ; 63]. Higher values may trade extra digest time to get lower storage of events with many fields.
  • Humio metrics have now been documented.
  • Bugfix: Regex with [^\W] did not execute [\w] as it should.

1.5.14

Improved pre-filters.

Release Date: 2019-05-29
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Improved pre-filters.

Changelog

  • Improved pre-filters to support more searches while adding less overhead in disk space.
  • The disk space occupied by the pre-filter files now get included when enforcing retention by compressed size.
  • The format of the new hash5h2. files is different from the previous bloom5h1 and the system will generate new files from scratch for all existing segment files and delete any existing bloom5h1. file.
  • New config: HASHFILTER_FILL defaults to 30. Sets the target number of percent bits to be set in the pre-filters. (Range 10-100).
  • New config: BLOCK_SIZE_MIN_KB defaults to 384. Select minimum target block size for data files, in KB.
  • New config: BLOCK_SIZE_MAX_KB defaults to 1024. Select maximum target block size for data files, in KB.
  • cidr(): When file and column parameters are used together, load subnet list from given CSV.
  • Bugfix: When an alert fails to send the notification, don’t restart the query, just retry the notification later.

1.5.13

Bugfix release.

Release Date: 2019-05-27
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Metrics are now send to a seperate file humio-metrics.log.

Changelog

  • Fix some cases where parameters would not be picked up by the UI because of regex or string literals in the query.
  • New log file humio-metrics.log. Metrics data has been removed from the humio-debug.log and moved to humio-metrics.log. Metrics will still also be in the default Humio repository. If you are collecting the Humio log files, with for example Filebeat, you need to add humio-metrics.log to the collector.

1.5.12

Parameters in Dashboards

Release Date: 2019-05-20
Minimum previous Humio version: 1.5.8
Requires data migrations: true
Has changes to configuration: false
Type: archive

We are happy to announce that you can now use parameters to make your dashboards and queries dynamic.

Changelog

  • You can now use the syntax ?param in queries. This will add input boxes to the search and dashboard pages. Read more in the dashboard parameter docs.
  • URLs now contain parameter values making it easy to share specific dashboard configurations.
  • Parallel upload of segment files to S3. Degree of parallelism can be controlled with e.g. S3_ARCHIVING_WORKERCOUNT=4. Default is 1 if nothing is specified.

1.5.11

Bugfix release.

Release Date: 2019-05-16
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release.

Changelog

  • Bloom filters are now always on.
  • Named groups in regular expressions supports having . [ ] in their names.
  • Moving segments to secondary storage can no longer be blocked by merging of segment files / s3 archiving.

1.5.10

New bloom filters, but please upgrade to 1.5.11 to avoid known problems in this build.

Release Date: 2019-05-13
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: true
Type: archive

New bloom filters, but please upgrade to 1.5.11 to avoid known problems in this build.

Changelog

  • New experimental bloom filters that speed up searching for constant strings such as UUIDs and IP-addresses; the longer the search string, the bigger the speedup. The bloom filters also help regular expression searching, including case insensitive ones.
  • MUST be enabled with BLOOMFILTER_ENABLED=true (Note! defaults to false in this release, which makes searches skip events they should not).
  • When enabled, this will write files along with the segment files with prefix bloom5h1., which add approximately 5% storage overhead.
  • The bloom filter files will be generated as part of digest work, and also generated for “old” segment files when Humio is otherwise idle. Thus, when the feature is initially enabled, it will be visible that the CPU load is higher for a period of time.
  • It is safe to just delete any bloom5h1. files while the system is running, or in case the feature needs to be disabled.

1.5.9

Bugfix release.

Release Date: 2019-05-06
Minimum previous Humio version: 1.5.8
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release.

Changelog

  • Add information on query prefixes to the Query Monitor. When inspecting a running query in the Query Monitor the query prefix can now be found in the details pane.
  • Bugfix: Alerts with multiple notifiers could result in notifications not adhering to the configured notification frequency resulting in notification spam.
  • Bugfix: Enable sourcetype field in the HEC endpoint to choose parser (unless another parser is attached to the parser token).
  • Bugfix: Default filters in dashboards could cause search to not find anything.

1.5.8

New dashboard editing code

Release Date: 2019-04-25
Minimum previous Humio version: 1.4.x
Requires data migrations: false
Has changes to configuration: true
Type: archive

New dashboard editing code and many other improvements

Changelog

  • config property KAFKA_DELETES_ALLOWED has been removed and instead DELETE_ON_INGEST_QUEUE is introduced. DELETE_ON_INGEST_QUEUE is set to true by default. When this flag is set, Humio will delete data on the Kafka ingest queue, when data has been written in Humio. If the flag is not set, Humio will not delete from the ingest queue. No matter how this flag is set, it is important to configure retention for the queue in Kafka. If Kafka is managed by Humio, Humio will set a 48hour retention when creating the queue. This defines how long data can be kept on the ingest queue and thus how much time Humio has to read the data and store it internally.
  • Dashboard queries that are not live and uses a timeinterval relative to now, are migrated to be live queries. Going forward, queries with timeintervals relative to now will be live queries when added to dashboards.
  • Humio’s own Jitrex regular expression engine is again the default one.
  • S3 archiving now supports forward proxies.
  • Validation of bucket and region when configuring S3 archiving.
  • Bugfix: Built-in audit-log parser now handles a variable number of fractions of seconds.
  • Bugfix: parseTimestamp() now handles dates, e.g. 31-08-2019.
  • @source and @host is now supported for Filebeat v7.
  • The Auth0 integration now supports importing Auth0-defined roles. New config AUTH0_ROLES_KEY identifies the name of the role attribute coming in the AWT token from Auth0. See new auth0 config options here.
  • In tableview, if column data is of the form \[Label](URL) it is displayed as Label with a link to URL.
  • Bugfix: Alerts notifiers with standard template did not produce valid JSON.

1.5.7

Bugfix release.

Release Date: 2019-04-10
Minimum previous Humio version: 1.4.x
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release.

Changelog

  • Bugfix: Revert default Regex engine from jitrex to RE2J. jitrex has a case where it may loop infinitely and this will break the digest pipeline if this happens in a live query.
  • Temporarily disable deletes of events from the ingest queue to allow recoverign events skipped in the queue due to the above infinite loop problem.

1.5.6

Bugfix release.

Release Date: 2019-04-04
Minimum previous Humio version: 1.4.x
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release.

Changelog

  • Bugfix: LDAP integration.

1.5.5

Event Context.

Release Date: 2019-04-03
Minimum previous Humio version: 1.4.x
Requires data migrations: false
Has changes to configuration: false
Type: archive

Event Context.

Changelog

  • New event context searches let users select and search around one specific event.
  • Display information on disk space usage of primary / secondary storage location in cluster management UI.
  • A GET on /api/v1/users that lists all known users on the system no longer includes information on the repositories for the user, as that made it too slow.
  • New configuration keys: MAX_SERIES_LIMIT and MAX_BUCKET_POINTS.
  • Restart all relevant queries when an uploaded file gets changed. This allows live queries and alerts to refresh using the latest version of the file.
  • Bugfix: Live timecharts could accumulate data for 2 buckets instead of 1 into the bucket that was right-most when the charts starts.
  • Bugfix: Segment merging could reuse a tmp file when the system was restarted, which would block the mering process on that host from making progress.
  • Bugfix: Fix bug in regex not recoginizing [0-9] as part of \w
  • Uploaded files cannot be bigger than specified in the config MAX_FILEUPLOAD_SIZE. Default value is 100 megabytes. The default value is used in our cloud.
  • The size of the Drawer, showing event details on the search page, is remembered (by being saved to local storage)

1.5.4

Bugfix release.

Release Date: 2019-03-26
Minimum previous Humio version: 1.4.x
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release.

Changelog

  • Bugfix: Query scheduler could get into a state of doing no work when overloaded during startup. Workaround while workign on proper solution: Raise the queue size internally.

1.5.3

Bugfix release.

Release Date: 2019-03-26
Minimum previous Humio version: 1.4.x
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release.

Changelog

  • new Config flag WARN_ON_INGEST_DELAY_MILLIS. How much should the ingest delay fall behind before a warning is shown in the search UI. Default is 30 seconds.
  • Bugfix: Webhook request could end up with malformed requests.

1.5.2

New functions for "Math" and "Time" operations.

Release Date: 2019-03-25
Minimum previous Humio version: 1.4.x
Requires data migrations: false
Has changes to configuration: false
Type: archive

New functions for “Math” and “Time” operations.

Changelog

  • New functions for “Math” and “Time” operations.
  • Java version check: Allow JDK-11 and 12.
  • Bugfix: Query prefixes for users were not properly applied to the “export” api.
  • Bugfix: Date picker marked the wrong day as current.
  • Bugfix: Repositories with names starting wirh “api” were inaccessible.

1.5.1

New regex implementation

Release Date: 2019-03-22
Minimum previous Humio version: 1.4.x
Requires data migrations: false
Has changes to configuration: false
Type: archive

The defalt regex engine has been replaced.

Changelog

  • New regex engine (Humio jitrex) is now the default; configure using DEFAULT_USER_INPUT_REGEX_ENGINE=HUMIO|RE2J. If you experience issues with regular expressions try setting configuration back to the previous default RE2J. You can also pass the special flags /.../G (for Google re2j) or /.../H (for Humio jitrex) to compare.
  • New implementation backing match(...) for exact matching (glob=false) allows using .cvs files up to 1 million lines. The limit for exact match state size can be set using EXACT_MATCH_LIMIT=1000000
  • Timechart more efficient in the backend, better supporting more than 1 series.
  • No owls were hurt in the production of this release.
  • Bugfix: Kill query or blacklist query was not always killed on all nodes.

1.5.0

Parsers migration and deletes.

Release Date: 2019-03-15
Minimum previous Humio version: 1.4.x
Requires data migrations: true
Has changes to configuration: false
Type: archive

All parsers are now written in Humios query language.

Changelog

  • New BETA feature: Delete Events allows deleting a set of events from the internal store using a filter query and a time range. At this point there is only API (Graphql and REST) for this but no UI.
  • All parsers created before the introduction of parsers written in Humios query language are migrated.
  • The option ‘PARSE NESTED JSON’ on the old json parser creation page is no longer available/supported. Instead use parseJson on specific fields, e.g. ‘parseJson() | parseJson(field=foo)'. This has to be done manually for migrated json parsers!
  • Migrated regex parsers with the option ‘PARSE KEY VALUES’ enabled has different parse semantics. If the regex fails key values will no longer be extracted.
  • Bugfix: permission for editing retention when running with ENFORCE_AUDITABLE=true.
  • Bugfix: Non root users could not see sandbox data when using RBAC.

1.4.9

Bugfix release

Release Date: 2019-03-13
Minimum previous Humio version: 1.3.2
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix of retention not working.

Changelog

  • Bugfix: Retention was not applied to all segment files in a clustered setup. The bug was introduced in 1.4.4.
  • Bugfix: Prevent labels in gauge widgets from being clipped.
  • Bugfix: white space in field templates in alerts.
  • Increasing AUTOSHARDING_MAX default from 8 to 16 and start autosharding at 4 instead of 2,

1.4.8

Bugfix release

Release Date: 2019-03-11
Minimum previous Humio version: 1.3.2
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release

Changelog

  • Bugfix introduced in last release for handling error messages
  • Bugfix create default directories in the Zookeeper Docker Image

1.4.7

Minor enhancement

Release Date: 2019-03-07
Minimum previous Humio version: 1.3.2
Requires data migrations: false
Has changes to configuration: true
Type: archive

Saved queries allowed in case and match

Changelog

  • Humio now requires Java version 11. The docker images for Humio now include Java 11. If you run the “plain jar” you must upgrade your Java to 11.
  • Saved queries now supported in case and `match.
  • Upgraded to Kafka to 2.1.1 in our Docker images and the Java client in Humio. Humio is still be compatible with older versions of Kafka. Lowest supported Kafka version is 1.1.0.
  • Improved handling of the “Kafka reset” aka “Start from fresh Kafka” aka “Set a new topic prefix”. Humio detects and properly handles starting after the user has wiped the Kafka installation, or pointed to a fresh install of Kafka.

1.4.6

Bugfix release

Release Date: 2019-03-04
Minimum previous Humio version: 1.3.2
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release

Changelog

  • New config: ENABLE_PERSONAL_API_TOKENS defaults to true. When set to false the API tokens are no longer valid as auth-tokens.
  • When @timestamp is in the filter part of the search then let that limit the timeinterval as if selected in the time selector.
  • Bugfix: Prevent ‘http response splitting’ attack in the “export as” function.
  • Bugfix: The personal sandbox was missing in list of visible repos for non-root users when READ_GROUP_PERMISSIONS_FROM_FILE was enabled.

1.4.5

Bugfix release

Release Date: 2019-02-27
Minimum previous Humio version: 1.3.2
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release

Changelog

  • NODE_ROLES being applied in more background tasks.
  • Many background tasks now get executed only on hosts with segment storage partitions assigned, and the hosts use the storage partition assignments as the key to decide which hosts must execute the tasks, thus freeing up resources on the other hosts.
  • Bugfix: Timechart in “steps mode” now displays the the the right of the label instead of to the left, which matches the fact that the labels are the start time.
  • Bugfix: Shutdown of digest had a timeout of 10 seconds internally, which could lead to being dropped too soon while shutting down or restarting. This could result in ingest lag rising to over 1000 seconds, where the expected lag is the time from the shutdown is initiated until a fe wseconds after the new instance is started. There is a new config SHUTDOWN_ABORT_FLUSH_TIMEOUT_MILLIS which defaults to 300000 millis (5 minutes) to allow proper shutdown also on systems with many datasources or slow filesystems / disks.

1.4.4

Bugfix release

Release Date: 2019-02-26
Minimum previous Humio version: 1.3.2
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix release

Changelog

  • Detect if a host in the cluster is being set to have the same vHost index as this host, and exit in this case.
  • Bugfix: Repository statistics displayed on frontpage were out of date on servers without any digest partitions. This also made the search page display the warning “You don’t have any data yet, consider the following options…” when searching until a result of the search was returned.
  • Bugfix: Making a repository or view a favorite failed on recently created items.
  • Bugfix: On a cluster with many segments and a node with no segments, the cluster administration page could time out.
  • Bugfix: Having timezone offset larger than the span in a timechart could result in errors.

1.4.3

Improved restart of live queries.

Release Date: 2019-02-21
Minimum previous Humio version: 1.3.2
Requires data migrations: false
Has changes to configuration: false
Type: archive

Improved restart of live queries.

Changelog

  • Restart live queries if their query prefixes change when using Role based authentication and access control (RBAC).
  • Remove migration from internal data formats older than what v1.3.x writes. Do not start this version without having upgraded to 1.3.2 or 1.4.x first.
  • Humio’s UI is programmed in Elm and we upgraded to use Elm 0.19.
  • New config option: NODE_ROLES with current options being “all” or “httponly”. The latter allows the node to avoid spending cpu time on tasks that are irrelevant to a nodes that has never had any local segments files and that will never be any assigned segments either.
  • Improved restart performance to better support restarting (or upgrading) the servers in a large cluster with large amounts of data.

1.4.2

Bugfix release

Release Date: 2019-02-19
Minimum previous Humio version: 1.3.2
Requires data migrations: false
Has changes to configuration: false
Type: archive

Minor release. Improve restarting of queries and Ingest listener performance

Changelog

  • Bugfix ldap authentication code.

1.4.1

Minor release. Improve restarting of queries and Ingest listener performance

Release Date: 2019-02-18
Minimum previous Humio version: 1.3.2
Requires data migrations: false
Has changes to configuration: false
Type: archive

Minor release. Improve restarting of queries and Ingest listener performance

Changelog

  • Improved restarting searches when a node go away.
  • Improved Ingest listener performance. One socket can more throughput than before.

1.4.0

High availability for ingest and digest

Release Date: 2019-02-14
Minimum previous Humio version: 1.3.2
Requires data migrations: true
Has changes to configuration: true
Type: archive

High availability for ingest and digest

Changelog

  • If rolling back, make sure to roll back to version 1.3.2+
  • Digest partitions can now be assigned to more than one host. Doing so enables the cluster to continue digesting incoming events if a single host is lost from the cluster.
  • Emphasis is on efficiency during normal operation over being efficient in the failure cases: After failure the cluster will need some time to recover during which ingested events will get delayed. The cluster needs to have ample cpu to catch up after such a fail-over. There are both new and reinterpreted configuration options in the config environment for crontrolling how the segments get build for this.
  • Segments are flushed after 30 minutes. This makes S3 archiving likely to be less than 40 minutes after the incoming stream.
  • Limit match/lookup functions to 20.000 rows or whatever “MAX_STATE_LIMIT” is set to.
  • Bugfix: Clone existing dashboard when creating from the frontpage was broken.

1.3.2

Multiple alert notifiers

Release Date: 2019-02-12
Minimum previous Humio version: 1.3.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Allow an alert to have multiple notifiers, e.g. both Slack and PagerDuty

Changelog

  • Allow an alert to have multiple notifiers, e.g. both Slack and PagerDuty.
  • Bugfix: Sandbox permissions for the owner of the sandbox.
  • Bugfix: Bar charts got incorrect height.
  • Bugfix: HEC ingest of array of numbers fixed.

1.3.1

Bugfixes on top of new permission model

Release Date: 2019-02-08
Minimum previous Humio version: 1.3.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfixes on top of new permission model

Changelog

  • Bugfix: LDAP changes being rolled back to allow users to login usng just their username again.

1.3.0

New permission model

Release Date: 2019-02-07
Minimum previous Humio version: 1.2.0
Requires data migrations: true
Has changes to configuration: true
Type: archive

New permission model

Changelog

  • New permission model used for Role Based Access Control is now in use all the time. Default setup includes the roles member, admin, and eliminator as usual.
  • The config for RBAC has changed (config file has a new name, environment variable names have changed), see docs.
  • Bugfix: LDAP fix; may require users to login with full user@domain user name, not just user.
  • Bugfix: Metric of type=HISTOGRAM in the internal “humio-metrics” repo had all values a factor of 10^6 too low.
  • Bugfix: worldmap function forgot about normalize option.

1.2.12

Optimizations and bugfixes

Release Date: 2019-02-05
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Optimizations and bugfixes

Changelog

  • Optimizing for many datasources in a repo by removing a bottleneck related for “tag grouping” auto-detection.
  • Improvements to Query monitor
  • Added a timechart of bulk size to built-in dashboard “Humio stats”.
  • Running queries now show only top-1000 queries to avoid overloading the browser in caseof many queries.
  • Bugfix: lowercase function now preserves unmodified fields in the “include=both” case, and no longer modifies “@timezone”.

1.2.11

Support for non-loadbalanced queries, optimizations and bugfixes

Release Date: 2019-01-31
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Support for non-loadbalanced queries, optimizations and bugfixes

Changelog

  • New function for parsing fixed width fields.
  • When your query matches more than 200 events, you can now scroll further back in time than those 200, “paging” through the older events. This works for any “non-aggregate query”.
  • New “Zoom and pan” buttons to quickly change the search interval: Double the time-span or move the search interval 1/8th of the span to either side.
  • When your load-balancer does not act as “sticky” as described here, Humio now internally proxies requests to the proper internal node for search requests.
  • Write Humio metrics into the new repo humio-metrics. Any user can query metrics but only for the repos they can search. Looking at metrics that are not repo-specific requires being a member of the humio-metrics repo.
  • Allow any user to query the humio-audit log, but only for the actions of the user. Looking at the actions of others requires being a member of the humio-audit repo.
  • Bugfix: Changes to desired digest partition to node assignments did not get reflected in other nodes until a restart of the other nodes.

1.2.10

Loadbalancing queries. Optimizations and bugfixes

Release Date: 2019-01-28
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Loadbalancing queries. Optimizations and bugfixes

Changelog

  • Bugfix: parseCsv did not handle broken input gracefully.
  • New built-in parser for the populuar .NET Serilog logging library.
  • Added HTTP header to support loadbalancing queries. The header Humio-Query-Session is described here.
  • Improved HEC performance.

1.2.9

Maintenance build

Release Date: 2019-01-18
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Bugfix: RetentionJob would not delete remaining segments marked for deletion if one delete failed.
  • Delete of queries on the http endpoint now lets the query live for 5 seconds internally, to allow reusing the same query if resubmitted.

1.2.8

Maintenance build

Release Date: 2019-01-17
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • New function, mostly for use in parsers scope: parseCsv parses comma-separated fields into columns by name.
  • Better names for the metrics exposed on JMX. They are all in the “com.humio.metrics” package.
  • Support for applying a custom parser to input events from any “beat” ingester by assigning the parser to the ingest token.
  • Bugfix: Handle HTTP 413 errors when uploading too large files on the files page
  • Bugfix: Live queries in a cluster where not all servers had digest partitions could lead to events being stuck in the result when they should have been outside the query range at that point int time.
  • Bugfix: Cloning built-in parsers made them read-only which was not intentional.
  • Config “KAFKA_DELETES_ALLOWED” can be set to “true” to turn on deletes on the ingest queue even when KAFKA_MANAGED_BY_HUMIO=false

1.2.7

Maintenance build

Release Date: 2019-01-15
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Export as CSV allows selecting the fields in the download dialog when the query does no set the fields through table or select.
  • New function eventSize that provides an estimate of the number of bytes being used to represent the event, uncompressed.
  • A new built-in parser for “syslog” in the format of both the old and new RFC, that uses case to auto-detect the format.
  • S3 archiving has completed testing with customers and is no longer considered BETA, but ready for use now.
  • Humio metrics on the Prometheus endpoint now have help texts and use labels where appropriate.
  • Bugfix: Short time zone names such as “EST” did not work properly in function that accept a time zone name.
  • Bugfix: enable escape to clear sticky events in all scenarios
  • Bugfix: A race condition could lead to memory being leaked.

1.2.6

Maintenance build

Release Date: 2019-01-11
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Improved detection of alerts that are canceled to get them restarted.
  • Allow both Basic-auth and OAuth on all ingest endpoints. We recommend putting tokens in the password field of the authentication.
  • Bugfix: Calendar in query interval selector had time zone problems.
  • World map function now accepts the “precision” parameter for the geohash function embedded inside worldmap().
  • Bugfix: extracting a field from within a tag-field could make the query optimizer fail.
  • Bugfix: “stats” function (The [] operator for functions) did not pass on the data used to select default widget.
  • S3 archiving: Include all tag keys in generated file names, also those listed in the configuration.
  • Allow GET/HEAD on elastic _bulk emulation API without auth. Some client poll that API before posting event.
  • HEC endpoints now accepts input from Docker Splunk logging driver. You can thus get your docker container logs into Humio using this logging driver. All you need to do is add --log-driver=splunk --log-opt splunk-token=$TOKEN --log-opt splunk-url=https://humioserver to your docker run.
  • Expose Humio metrics as JMX.
  • Expose Humio metrics to Prometheus. The port needs to be configured using the configuration parameter PROMETHEUS_METRICS_PORT.
  • Bugfix: When using select() and not including @timestamp, that field got included in exported files anyway. Now it gets included when specfied as a selected field.

1.2.5

Maintenance build

Release Date: 2019-01-09
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Query performance improved by fixing a bottleneck that was noticeable on CPUs with more than 16 cores.
  • Humio will by default write threaddumps to the file humio-threaddumps.log every 10 seconds. This is configurable using the configuration parameter DUMP_THREADS_SECONDS. Before this was disabled by default.
  • Allow * as fields for lowercase function to allow lowercasing all field names and values. Recommended use case is in the ingest pipeline as this is an expensive operation.
  • Added new query functions lower and upper.
  • If the parser ends up setting a timestamp before 1971, or does not set a timestamp, use now as timestamp for the ingested event. Same for timestamps more than 10 seconds into the future.
  • When running with PREFIX_AUTHORIZATION_ENABLED=true Alerts and Shared dashboards now run as the user who saved them, restricted to those prefixes that the users has at the time the query starts.
  • Bugfix: Audit-logging did not happen for queries using the “/query” endpoint i.e. using the export button in the UI.
  • Timeouts on the http endpoint have been changed from 60s to infinite. This allows exporting from queries that hit very little data, e.g. a live query that receives one event every hour.
  • Basic auth (used mostly on ingest endpoints) now allows putting the token into the password field instead of the username field. Use of the password field is recommended as some software treats the password as secret and the username as public.
  • HEC protocol now accepts data at “/services/collector” url too. And accepts authorization in the form of a “Authorization” header with any realm name, as long as the token is a valid Humio token. This allows using e.g fluentd and other software to ship to Humio using HEC.
  • Bugfix: Segments with blocks where all timestamps are zero were reported as broken when trying to read them.

1.2.4

Secondary storage of segment files

Release Date: 2019-01-02
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: true
Type: archive

Secondary storage of segment files

Changelog

  • Secondary storage of segment files. This allows using a “fast” disk primarily, and a “slow” one for older files.
  • HTTP Event Collector out of beta. Endpoint lives at /api/v1/ingest/hec.
  • Bugfix: When a segment file was deleted while being scheduled in a query, the query would end up being “99%” done and never complete.
  • Performance fix: Running live queries for weeks with a small time span for the bucket size was expensive.
  • Bugfix: Deleting an ingest listener did not stop the listener.
  • Extended the internal latency measurement to include the time spent in the custom parsers as well.

1.2.3

Maintenance build

Release Date: 2018-12-18
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Default to running queries on only vcores/2 threads.
  • Performance improvement: queries with NOT NotMatching were much slower than the plainfilter NotMatching.
  • Bugfix: Display of query speed in clustered version was multiplied by (n+1)/n in a n-node cluster.
  • Bugfix: Widget auto-selection improved.
  • New ingest endpoints without the repo in the path, as the repo is specified by the token for authentication, repo and and parser selection.

1.2.2

Maintenance build

Release Date: 2018-12-14
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: true
Type: archive

Maintenance build

Changelog

  • Bugfix: “sandbox” did not work properly with PREFIX_AUTHORIZATION_ENABLED=true
  • Configuration change. ALLOW_UNLIMITED_STATE_SIZE has been replaced by MAX_STATE_LIMIT. MAX_STATE_LIMIT limits state size in Humio searches and now allows specifying a number. For example the number of groups in the groupBy function is limited by MAX_STATE_LIMIT.

1.2.1

Maintenance build

Release Date: 2018-12-13
Minimum previous Humio version: 1.2.0
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Improve maximum throughput of a TCP-listener ingest up to 4 times the previous level for a single socket. Maximum throughput can reach 100.000 events/s when testing with 500 bytes/event on localhost. Use more sockets in parallel to achieve higher throughput.
  • Bugfix: When pushing the query sub-system to the limit with many simultaneous long-running live queries for more than 10 seconds, a query could end up triggering a restart of itself.
  • Bugfix: Editing a parser with syntax errors did not work.

1.2.0

Create parsers using Humios search language

Release Date: 2018-12-11
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: true
Type: archive

Create parsers using Humios search language. Changes to “Backup” layout.

Changelog

  • New parsers. It is now possible to create parsers using Humio’s search syntax. Check out the documentation. Existing parsers has not been migrated and it is still possible to use the old parsers. We encourage using the new parsers and will automatically migrate old parsers in a future release.
  • parseTimestamp function has changed signature. The parameter nowIfNone has been removed and a new addErrors introduced. This can break existing searches/alerts/dashboards (but the parameter has not been widely used). See docs here.
  • Blacklist queries. In the administration section of Humio it is now possible to blacklist queries. This can also be done from the Query Monitor page, by clicking a query and then block it in the details section, or using the Query Blacklist page directly.
  • kvParse function no longer overrides existing fields by default. To override existing fields based on input use: kvParse(override=true). See docs here.
  • The parser overview page now shows parser errors. This is a quick way to detect if parsers are working as expected.
  • The backup feature now stores the copies of the segment files in separate folders for each Humio node. This allows the Humio ndoes to delete files that are no longer owned by that node also in the case where all Humio nodes share a shared network drive. This change has the effect that existing backups are no longer valid and cannot be read by this version. Delete any existing backups when upgrading, or reconfigure Humio to use a fresh location for the backups.
  • Bugfix: In a cluster where any node did not have any digest roles, queries could get polled much too frequently.

1.1.37

Maintenance build

Release Date: 2018-12-03
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Bugfix: Field-extracting using regex did not work in live queries in an implicit AND.
  • Add debug logs for LDAP login.
  • Fix bug in UI when uploading file.

1.1.36

Role-based auth support for SAML & LDAP

Release Date: 2018-11-28
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: true
Type: archive

Role-based auth support for SAML & LDAP

Changelog

  • Role-based access control is now supported for on-prem when using SAML or LDAP for authentication. See more details here.
  • Config variable AUTO_CREATE_USER_ON_SUCCESSFULL_LOGIN renamed to (the correctly spelled) AUTO_CREATE_USER_ON_SUCCESSFUL_LOGIN.
  • Set thread priorities on internal threads.
  • Extended session function to accept an array of function instead of only one.
  • GELF over HTTP support. Note that this format is a good fit for uncommon events, but due to lack of bulk support not efficient for streams with high amounts of traffic. Authentication is required using basic auth with an ingest token (or personal API token, but using that is not recommended).

1.1.35

Graylog compatible ingest support

Release Date: 2018-11-27
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Graylog compatible ingest support

Changelog

  • Allow ingest in “GELF” v1.1 format. See GELF Payload Specification. Humio supports ingest on using the UDP and UDP chunked encodings, and both may optionally be compressed using ZLIB. (Gzip not supported yet.) TCP is supported as zero-byte-delimited uncompressed.
  • Bugfix: Alerts did not properly encode all parts of the query in the URL that is sent in the notification.

1.1.34

Improved LDAP support

Release Date: 2018-11-22
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: true
Type: archive

Improved LDAP support

Changelog

  • By default users must be added inside Humio before they can log in using external authentication methods like LDAP and SAML. This can be controlled using the configuration flag AUTO_CREATE_USER_ON_SUCCESSFUL_LOGIN=false. If users are auto created in Humio when they successfully login for the first time, the user will not have access to any repositories unless explicitly granted. A new user will only be able to access the users personal sandbox.
  • Bugfix for match function. In some cases it did not match quoted strings.

1.1.33

Bugfix and digest performance

Release Date: 2018-11-15
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix and digest performance

Changelog

  • Fixed: Parsers did not show the build-in parsers
  • Digest throughput improvements

1.1.32

stripAnsiCodes function

Release Date: 2018-11-15
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: true
Type: archive

stripAnsiCodes function, top on multiple fields and bugfixes, default repository query

Changelog

  • top function now support more than one field to group on combination of fields.
  • New stripAnsiCodes function: strips ANSI color codes from a field.
  • New range function: Finds numeric range between the smallest and largest numbers for the specified field over a set of events.
  • Repositories’ default search interval has been replaced with the possibility to choose a default repository query. All default search intervals will be migrated to default queries. A default query can be set by saving a query and checking the “Use as default” checkbox.
  • Added support for Java 11. Humio can now be run with Java 9 or Java 11. Humio’s Docker images are updated to use Java 11 and we encourage people to update to Java 11 and use Azul’s OpenJDK Zulu builds.
  • Bugfix connecting to Kafka when using the property EXTRA_KAFKA_CONFIGS_FILE.

1.1.31

Bugfixes

Release Date: 2018-11-09
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Reduce latency of incoming events

Changelog

  • The latency measured from an event arrive at Humio until live queries have been updated with that event has been reduced by approximately 1 second to now be in the 0 - 500 millisecond range.
  • It is now possible to block ingestion in a repository. It can be done from the repository’s settings page.
  • Improved build-in dashboards, allowing them to be shared using share links like any other dashboard.

1.1.30

Bugfixes

Release Date: 2018-11-04
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bugfix - ‘Create Parser’ button opened a beta page for creating parsers

Changelog

  • Bugfix: ‘Create Parser’ button opened a beta page for creating parsers.
  • Bugfix: Handle clients posting empty bulks of events.

1.1.29

Bugfixes

Release Date: 2018-11-02
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Added config option: QUERY_EXECUTOR_CORES:Int allows setting cores for query engine individually.
  • Bugfix: Allow ‘.’ in S3 paths.
  • Bugfix: Live queries could get false sharing of “Eval” results.

1.1.28

Improved SAML authentication

Release Date: 2018-10-31
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: true
Type: archive

Improved SAML authentication and digest performance

Changelog

  • Dashboard searches are kept running for 3 days, when they are not polled. After that they are not kept alive on the server. This is configurable using the config IDLE_POLL_TIME_BEFORE_DASHBOARD_QUERY_IS_CANCELLED_MINUTES. This replaces IDLE_POLL_TIME_BEFORE_LIVE_QUERY_IS_CANCELLED_MINUTES.
  • When zooming to a wider time range on a timechart with a fixed “span” parameter, widen the span and a dd a warning to allow the chart to work instead of failing with “too many bucket”.
  • Performance improvements for digest on systems with many sparse datasources.
  • Bugfix: Back-prssure on ingest should not be applied to internal log lines, such as the internal debug and audit log entries.
  • Bugfix: The first search to hit a repository in a cluster with millions of segments would fail while listing those files.

1.1.27

Back-pressure on ingest overload

Release Date: 2018-10-24
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Back-pressure on ingest overload and bugfixes

Changelog

  • When too much data flows into Humio for Humio to keep up, apply back-pressure by responding statuscode 503 and header Retry-After: 300.
  • Many changes internally to prepare for having more than one node in the “Digest rules” for fail-over handling of ingest traffic.
  • Bugfix: The event list on the search page now correctly resets the widget when a new search is started
  • Bugfix: The max value of the y-axis of timecharts is now correctly updated on new results
  • Bugfix: Pagination now works for tables on dashboards

1.1.26

Minor release

Release Date: 2018-10-15
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Performance improvement in table, sort and tail especially when using a large limit.
  • Bugfix: select function did not render results if they did not have @timestamp and @id. (Select is like table but unsorted and allows exporting an unbounded set of events)
  • Bugfix: session function could miss events in some situations.
  • Bugfix: Using the field message instead of log (as described in v1.1.25) did not work properly.

1.1.25

Minor release

Release Date: 2018-10-12
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Adds Worldmap and Sankey visualizations and SAML authentication support

Changelog

  • New visualizations: Worldmap and Sankey.
  • New visualization helper functions geohash, worldmap, sankey.
  • The new visualizations require a change to the CSP. If you have your own CSP, you need to add 'unsafe-eval' to the script-src key.
  • New query syntax: match on a field that eases matching for several cases on a single field.
  • Support using filebat to ship logs from Helm chart for ingest logs from a Kubernetes cluster. The message can be in the field log or message.
  • The update services widget that “phones home” to update.humio.com can now only be disabled if you have a license installed.
  • Bugfix: Performance regression in functions table, sort, tail and head that slowed them down a lot when the limit was larger than 100.
  • Bugfix: S3 archiving now handles grouped tags properly, generating one file for each tag combination also for grouped tags.
  • Bugfix: Split function could use the timestamp of one event in more of the following events than those that originated in that event.
  • Bugfix: Importing repositories from another Humio instance has repository ID where repository name was required.
  • Bugfix: Searching using ... | *foo*** | ... is identical to ... | foo | ... since plain text searches are alway substring matches. But the former got turned into a full-string regex match for ^.*foo.*$ which is 10-30 times slower compared to the fast substring search in Humio.

1.1.24

Minor release

Release Date: 2018-10-05
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Maintenance build

Changelog

  • Reorder query prefixes to execute queries more efficiently. Moves tags to the front of query string to allow better start-of-query datasource filtering.
  • Bugfix: segments deleted by retention-by-size would sometimes get left behind in global, adding warnings to users searching at intervals including deleted segments.

1.1.23

Minor release

Release Date: 2018-10-01
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: false
Type: archive

Update Kafka server version to 2.0.0

Changelog

  • Humio’s Kafka and Zookeeper Docker images have been upgraded to use Kafka 2.0.0. We recommended to keep the update procedure simple and not do a rolling upgrade. Instead shutdown Humio Kafka and Zookeeper. Then fetch the new images and start Zookeeper, Kafka and Humio. For details see Kafkas documentation for upgrading. (Note: This change was listed in release notes for v1.1.20 even though it was applied only to the kafka client there, and not to the server).
  • The query planner has been improved, so it can more precisely limit which data to search based on tags.
  • Bugfix: Do not reassign partitions in Kafka when there is already sufficient replicas (Only applied when KAFKA_MANAGED_BY_HUMIO=true, the default).
  • Bugfix: Do not remove other topic configs in Kafka when setting those needed by humio (Only applied when KAFKA_MANAGED_BY_HUMIO=true, the default).
  • Bugfix: Handle empty uploaded files.
  • Improved performance of parsers that have (?<@timestamp>\S+) as their timestamp extractor regex.

1.1.22

Minor release

Release Date: 2018-09-27
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Fix Kafka prefix configuration problem. Faster percentiles. Allow globbing when using match().

Changelog

  • Add flag match(..., glob=true|false) allowing the key column of a CSV file to include globbing with *.
  • The key/value parser now (also) considers characters below 0x20 to be separators. Good for e.g. FIX-format messages.
  • Percentile function changed to use 32bit precision floating point making it ~3x faster.
  • Bugfix: The UI for setting node ID on an ingest listener did not work.
  • Bugfix: If using Kafka prefix configuration, the server would always assume Kafka has been reset. Releases 1.1.20 introduced this problem.

1.1.21

Minor release

Release Date: 2018-09-25
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Bug fix release.

Changelog

  • “Query Monitor” now also shows cpu time spent in the last 5 seconds.
  • Bugfix: Timechart on views broke in previous version 1.1.20
  • Bugfix: The implicit tail(200) that is applied when no aggregate function is in the query input did not sort properly in certain cases.

1.1.20

Minor release

Release Date: 2018-09-24
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: false
Type: archive

Use Kafka version 2.0.0

Changelog

  • Added the possibility to add extra Kafka configuration properties to Kafka consumers and producers by pointing to a properties file using EXTRA_KAFKA_CONFIGS_FILE. This makes it possible to connect to a Kafka cluster using SSL and SASL.
  • Humio is upgraded to use the Kafka 2.0 client. It is still possible to connect to a Kafka running version 1.X
  • Humio’s Kafka and Zookeeper Docker images have been upgraded to use Kafka 2.0.0. (Update: See 1.1.23)

1.1.19

Minor release

Release Date: 2018-09-21
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Cluster administration, dashboard clone/export/import and faster startup on large datasets

Changelog

  • Dashboards can now be copied to other repos and exported and imported as templates.
  • New cluster management actions for reassigning partitions to hosts and moving existing data to other hosts.
  • Auto-nice long running queries, making them take on lower priority compared to younger queries, measured by cputime spent.
  • Generate pretty @display value in split() function.
  • Fix #2263, support for !match().
  • Bugfix: HUMIO_KAFKA_TOPIC_PREFIX was not applied to all topics used by Humio, only where the name matched global-*".
  • Startup of the server is now much faster on large datasets.
  • Faster response on cluster management and entering the search page.
  • Upgrading to this version requires running at least v1.1.0. If you run an older version, upgrade to v1.1.18, then v1.1.19.
  • Setting INGEST_QUEUE_INITIAL_PARTITIONS in config decides the initial number of partition in the ingest queue. This only has effect when starting a fresh Humio cluster with no existing data.
  • Allow negative index in splitString, which then selects from the end instead of from the start. -1 is the last element.

1.1.18

Minor release

Release Date: 2018-09-13
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Ease using your own Kafka including older versions of Kafka

Changelog

  • Ease using your own Kafka including older versions of Kafka
  • Set KAFKA_MANAGED_BY_HUMIO=false to stop Humio from increasing the replication of the topics in Kafka.
  • Added MAX_HOURS_SEGMENT_OPEN to the number of hours after which you want a segment closed and a new one started even if it has not filled up. Note that you may want to disable segment merging in this case to preserve these smaller segment files by also setting ENABLE_SEGMENT_MERGING=false

1.1.17

Minor release

Release Date: 2018-09-10
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Show Events Per Second (EPS) when searching

Changelog

  • Show Events Per Second (EPS) when searching.
  • Improve search performance when adding fields to events.
  • Dashboards can now be copied to other views.

1.1.16

Minor release

Release Date: 2018-09-06
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: false
Type: archive

Add CRC to data files. Migrates data to support upcoming features to later serve as a potential roll back point.

Changelog

  • Note! v1.1.15 is able to read the files generated by v1.1.16. Rolling back to version 1.1.14 or earlier is not possible, as those versions cannot read the files that have CRC.
  • Adds CRC32c to the segment file contents.
  • Support CSV downloads. End the query with | table([...]) or | select([...]) to choose columns.
  • New ‘cluster overview’ tab in admin page (this is work in progress, feedback appreciated).
  • Regular expression matching with a ‘plain’ prefix is now faster.
  • Bugfix. Regular expressions using /.../ syntax sometimes matched incorrectly.
  • Scheduling of queries now take cpu time spent in each into account, allowing new queries to get more execution time than long-running queries.

1.1.15

Minor release

Release Date: 2018-09-03
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Support for setting parsers in our Kubernetes integration and a new parseHexString function.

Changelog

  • Our Helm chart for ingest logs from a Kubernetes cluster now support setting a parser using the pod label humio-parser. More information can be found in our docs.
  • Updated instructions for configuring the PagerDuty notifier.
  • New function: parseHexString.
  • Bugfix. Tables now sort globally instead per page.

1.1.14

Minor release

Release Date: 2018-08-21
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Starring alerts and Introduce a displaystring for formating log strings.

Changelog

  • Starring alerts. Get your favorite alerts to the top of the list.
  • Introduced @displaystring.
  • Improve Netflow parser to handle packets coming out of order.
  • Bugfix. Slack notifier had the message twice in the request.

1.1.13

Minor release

Release Date: 2018-08-16
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: false
Type: archive

Improve LDAP support

Changelog

  • Enable logging in with LDAP without providing domain name. Domain name can be set as a config using LDAP_DOMAIN_NAME. Updated documentation.
  • Enforce an upper bound of the number of fields allowed for one event. The limit is 1000. If an event has too many fields, 1000 are included.

1.1.12

Major release

Release Date: 2018-08-15
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: false
Type: archive

SMTP support for sending emails, new Files UI and support for self-signed certs for ldap

Changelog

  • SMTP support for sending emails
  • New Files UI. Possible to manage files for use in the lookup function
  • Add new functions now(), transpose() and drop() to the query language.
  • LDAPS can use a self-signed certificate through config.
  • Bugfix: Segment file replication did not (re-)fetch a segment file if the file was missing on disk while the “global” state claimed it was present.
  • Fix bug with tail() inside groupby(), bucket(), [...] or stats() expressions.
  • Add operators >, <, >=, <=, and % to eval expressions.
  • Eliminate the backtics syntax from eval, the same effect can be obtained with transpose().
  • LDAP users must now be added with their domain. For example add user@myorganisation.com (instead of just user). Existing users are migrated by the system, so no actions are required.

1.1.11

Minor release.

Release Date: 2018-08-03
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Bugfix: “Export to file” did not work in the UI.
  • Performance improvement in the internal logging to the Humio dataspace.
  • Eliminated a race condition in the ingest pipeline that could drop data in overload conditions.

1.1.10

Minor release.

Release Date: 2018-08-02
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Now using Google’s RE2/j as the default, not the JDK’s. Can be configured using USE_JAVA_REGEX=true|false.
  • Autosharding now happens after tag grouping. Improves performance in case where some datasources are slow and others very fast when those are grouped.

1.1.9

Minor release.

Release Date: 2018-07-30
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Bugfix. When encountering a broken segment file, let the server start and ignore the broken file.

1.1.8

Minor release.

Release Date: 2018-07-26
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Improve handling color codes in Humios built in key-value parser
  • Bugfix. Autosharded tags should not get tag-grouped.

1.1.7

Minor release.

Release Date: 2018-07-05
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: false
Type: archive

Changelog

  • Datasource autosharding is now able to reduce the number of shards.
  • New function match() is like lookup() but better suited for filtering.
  • Bugfix. sort() with multiple fields was not stable for missing values.
  • Bugfix. Fix split() to allow splitting JSON arrays of simple values.
  • Bugfix. Remove race condition that could create duplicate events on restart.
  • Verify Java version requirement on startup.
  • Update embedded GeoLite2 database to 20180703 version.

1.1.6

Minor release.

Release Date: 2018-07-04
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Improved datasource autosharding to be less eager.
  • Restructured documentation.
  • Bugfix. Log rotation of Humios own log files. Files was not deleted, but now they are.
  • Bugfix. Viewing details of a logline while doing a live query did not pause the stream. This resulted in the details view being closed when the logline went out of scope.

1.1.5

Minor release.

Release Date: 2018-06-28
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Remove supervisord from the Docker image humio/humio-core

1.1.4

Minor release.

Release Date: 2018-06-28
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Bugfix. Repo admins that are allowed to delete data can now delete datasources.

1.1.3

Minor release.

Release Date: 2018-06-27
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Rename a widget on dashboard directly from the dashboard itself.
  • Supporting links in tables.
  • Fix memory problem when streaming events using the query endpoint.

1.1.2

Minor release.

Release Date: 2018-06-25
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Fix clock on dashboards page.
  • Fix creating the sandbox dataspace in the signup flow.
  • Allow fields in alert webhooks.

1.1.1

Minor release.

Release Date: 2018-06-21
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • fix fullscreen mode for readonly dashboards

1.1.0

Major release.

Release Date: 2018-06-21
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: false
Type: archive

Changelog

  • Dataspaces has been split into views and repositories. This allows searching across multiple repositories and adds support for fine grained access permissions. Read the introduction in this blogpost and check out the docs.
  • It is not possible to rollback to previous versions when upgrading. Backup Global data by copying the file /data/humio-data/global-data-snapshot.json. Then it will be possible to rollback (with the possibility of loosing new datasources, users, dashboards etc that was created while running this version).
  • Amazon AMI available in the Amazon marketplace.
  • Added docs for Kafka Connect integration.
  • Improved Fluentbit integration to better support ingesting logs from Kubernetes.
  • Added query function parseUrl.
  • Moved some of the edit options from the dashboard list to the dashboard itself.

1.0.69

Hotfix release.

Release Date: 2018-06-12
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Bugfix: Cancelling a query in 1.0.68 would consume ressources, blocking worker threads for a long time. Please upgrade.

1.0.68

Regular update release.

Release Date: 2018-06-11
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: true
Type: archive

Changelog

  • Bugfix: deeplinking did not work in combination with having to log in.
  • Ingest queue replication factor in Kafka is now by default set to 2 (was 1). If it is currently set to 1 Humio will increase it to 2. The configuration parameter INGEST_QUEUE_REPLICATION_FACTOR can be used to cotnrol the replication factor.
  • Changes to Humios logging. Humio now logs to 2 files /data/logs/humio-debug.log and /data/logs/humio_std_out.log. Std out has become less noisy and is mostly error logging. This is only relevant for onprem installations.

1.0.67

Regular update release.

Release Date: 2018-06-01
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Support for GDPR: Hardened audit logging
  • Improved search performance when reading data from spinning disk

1.0.66

Minor update release.

Release Date: 2018-05-23
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Added “prune replicas” method on on-premises HTTP API to remove extra copies when reuducing replica count in cluster.
  • Increased default thread pool sizes a bit, but still only 1/4 of what the were before 1.0.65

1.0.65

Minor update release.

Release Date: 2018-05-22
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Fixed bug: Importing a dataspace from another Humio instance did not handle multi-node cluster properly
  • Search performance improvement: Reduce GC-pressure from reading files.
  • Reduced default thread pool sizes.

1.0.64

Minor update release.

Release Date: 2018-05-15
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Search scheduling is more fair in cases with multiple heavy searches.

1.0.63

Regular update release.

Release Date: 2018-05-15
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Bugfix. Alerts could end up not being run after restarting a query.
  • Read segment files using read instead of mmap.

1.0.62

Minor update release.

Release Date: 2018-05-09
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Increase timeout for http query requests.

1.0.61

Minor update release.

Release Date: 2018-05-08
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Improved “connect points” option in timecharts.
  • Worked on http request handling - do not starve requests under load.

1.0.60

Minor update release.

Release Date: 2018-05-04
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Increase maximum allowed http connections to 250000.
  • Timeout idle http connections after 60 seconds.
  • Fix dashboard links on frontpage.
  • Remmoved error logging when tokens has expired.
  • Removed logging of verbose datastructure when querying.
  • Possible to expose Elastic compatible endpoint on port 9200, which is the Elastic default. Use the configuration paraemter `ELASTIC_PORT

1.0.59

Regular update release.

Release Date: 2018-04-26
Minimum previous Humio version:
Requires data migrations: true
Has changes to configuration: Yes (Auth0 changes)
Type: archive

Changelog

Added

  • Humio now support authenticating with Google, GitHub and Atlassian/Bitbucket directly, without the need to go through Auth0. This is part of our GDPR efforts for our customers on cloud.humio.com, so as to avoid more third partes involved with your data than necessary.
  • Existing users on cloud.humio.com will need to re-authenticate the application ‘humio’ to use their account information.
  • The search language has several new functions: formatTime, ipLocation, rename, splitString, parseInt (updated version of to_radix_10 function), stats, head. See query functions documentation for details of each one.
  • The head() function allows you to do deduplication by using groupby([ field1, field2, ... ], function=head(1)).
  • New syntax for computing multiple aggregates for example, to compute both min and max... | [min(foo), max(foo)] | ... . This syntax is shorthand for the stats function.
  • New convenience syntax for passing the as= parameter using assignment syntax. minx := min(x) is equivalent to min(x, as=minx). This can be used at top-level | between bars |, or within [ array blocks ].
  • New convenience syntax for passing the field= parameter to a function using curly assignment syntax. ip_addr =~ cidr("127.0.0.1/24") is equivalent to cidr("127.0.0.1/24", field=ip_addr). This can also be used for regex i.e., name =~ regex("foo.*").
  • The parser handles left and right double quotes which can easily occur if you edit your queries in a word processor, i.e., Protocol := “UDP - 17”
  • New naming convention for function names is camelCase() which is now reflected in documentation and examples. Functions are matched case-insensitively, so the change is backwards compatible.
  • Renamed the alt keyword to case. alt will still work for a few releases but is now deprecated.

Configuration Changes

If you are using Auth0 in your on-prem installation of Humio you must update your Auth0 Application configuration and re-configure Humio(or start using your OAuth identity provider directly). We at Humio will be happy to help. Below configuration changes are only relevant if Auth0 is used for authentication:

  • Users that are authenticated through Auth0 will need to configure the PUBLIC_URL configuration option, you MUST add add $PUBLIC_URL/auth/auth0 to the list of callback URLs in your Auth0 Application.
  • The Auth0 configuration properties AUTH0_WEB_CLIENT_ID and AUTH0_WEB_CLIENT_SECRET have been removed. You can safely delete the associated Auth0, as Humio only requires on Auth0 Application in the future.
  • The configuration options AUTH0_API_CLIENT_ID and AUTH0_API_CLIENT_SECRET have been deprecated in favor of AUTH0_CLIENT_ID and AUTH0_CLIENT_SECRET respectively - the old names will continue to work as aliases.
  • The configuration option AUTH0_WEB_CLIENT_ID_BASE64ENC has been remove.
  • Depending on how you set up your Auth0 application, you may need to update your Auth0 Application Type to “Regular Web Application” in the your Auth0 account, more details can be found in our docs.
  • Humio Auth0 no longer requires the grant read:users, you can safely disable that on your Auth0 Application - or just leave it.

1.0.58

Regular update release.

Release Date: 2018-04-19
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Humio is available as a downloadable Docker image. It can be used in trial mode for a month. After that a license is required.
  • New onboarding flow supporting downloading and running Humio.
  • Documentation has moved into its own project online at https://docs.humio.com. The project can be found on GitHub.
  • Small improvements to Grafana plugin.
  • JSON parsers can be configured to parse nested JSON. That means it will look at all strings inside the JSON and check if they are actually JSON.
  • Improved versioning. The version now starts with an actual version number. This version matches the version in Docker Hub.

1.0.57

Cloud-only release.

Release Date: 2018-04-16
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • New Query coordinator for handling distributed queries. This should improve the error messages on communication problems.
  • Updated Humio and Kafka Docker images to use Java 9.
  • Added an update service widget to the menu bar that will announce new updates and give access to release notes directly in Humio. The service contacts a remote service: update.humio.com. If you do not want to allow this communication you can disable it from the Root Administration interface.

2018-03-26T20-11-14--build-2310--sha-c2b27b32ec01c9f2613a47684267a05ba62dd00d

Bugfix release.

Release Date: 2018-03-26
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Fixed bug: Race condition in segment merging code. Could lead to loss of data when changing size of segment files. The problem was introduced in the previous release as a case of the out-of-order processing fix.
  • Fixed bug: Auto suggestions selection using mouse.

2018-03-23T13-20-14--build-2297--sha-2dde0149735d4a41f367fa72837ec888418248a7

Regular update release.

Release Date: 2018-03-22
Minimum previous Humio version:
Requires data migrations: false
Has changes to configuration: false
Type: archive

Changelog

  • Improved ingest performance by tuning LZ4 compression.
  • Added a JSON tab when showing event details. The tab pretty prints the event and is only visible for JSON data.
  • JSON is not pretty printed when showing the details for an event in the message tab.
  • Fixed bug: When system got overloaded - events could get lost if processed out of order in a datasource.
  • Improved Grafana integration.

??

Regular update release.

Release Date: 2018-03-15
Minimum previous Humio version:
Requires data migrations: Yes, but compatible both ways: Users on dataspace can now have multiple roles.
Has changes to configuration: false
Type: archive

Changelog

  • Audit logging BETA feature. There is now a humio-audit dataspace with audit log of user actions on Humio.
  • License keys in UI now ignore whitespace for ease of inserting keys with line breaks.
  • Fixed bug: In uncommon cases when ingesting a large bulk of events that were not compressible at all, the non-compression could fail.
  • Fixed bug: “Export to file” failed on Sandbox dataspaces.

2018-03-13T07-55-33--build-2206--sha-582948b69f04dc9201ecefbeaa10c19aac1633cd

Regular update release.

Release Date: 2018-03-13
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Introduced licensing. Humio requires a license to run. It can run in trial mode with all features enabled for a month.
  • Fixed bug: In some scenarios the browsers back button had to be clicked twice or more to go back.
  • Fixed bug: Enter does not start search after navigating using the browsers back button

2018-03-07T08-10-28--build-2154--sha-a65e39f79ad7b4d38c18e9b9090648abb7da17c2

Cloud-only release.

Release Date: 2018-03-06
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Starring dashboards. They will go to the top of the dashboard list and there is a section with starred dashboards on the frontpage.
  • Labeling dashboards. Put labels on dashboards to organise them.
  • Disconnect points on timecharts if there are empty buckets between them.
  • Fixed bug: Make /regex/ work with AND and OR combinators.
  • Fixed bug: gzipping of http responses could hit an infinite loop, burning cpu until the process was restarted.

2018-02-23T05-52-15--build-2075--sha-83b8f03c2f4dea9acfbc95ba47a475343d956d2b

Minor update release.

Release Date: 2018-02-23
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fix bug: Retention was not deleting anything.

2018-02-22T14-01-13--build-2069--sha-b303c8b5330ac05a53d7f5b82e748cf11b7c3014.

Minor update release.

Release Date: 2018-02-22
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fixed bug: Clustered on-premises installs could stall in the copying of completed segment files inside the cluster.
  • Allow saving dashboards with queries that do not parse. Allows editing dashboards where another widget is failing.
  • Allow | before and after query.
  • Fix issue with : occurring in certain query expressions, introduced with the new := syntax. A query such as foo:bar | ... using an unquoted string would fail to parse.

2018-02-21T12-11-11--build-2054--sha-e65bbe26954feb1acbf45310ded5268e017c93a6

Regular update release.

Release Date: 2018-02-21
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • New alt language construct. This allows alternatives similar to case or cond in other languages. With ... | alt { <query>; <query>; ...; * } | ... every event passing through will be tried to the alternatives in order until one emits an event. If you add ; * in the end, events will pass through unchanged even if no other queries match. Aggregate operators are not allowed in the alternative branches.
  • New eval syntax. As a shorthand for ... | eval(foo=expr) | ... you can now write ... | foo :=expr | .... Also, on the left hand side in an eval, you can write `att` := expr which assigns the field that is the current value of att.
  • Improvements to the query optimizer. Data source selection (choosing which data files to scan from disk) can now deal with more complex tag expressions. For instance, now queries involving OR such as #tag1=foo OR #tag2=bar are now processed more efficiently. The query analyzer is also able to identify #tag=value elements everywhere in the query, not only in the beginning of the query.
  • New Feature: Dashboard Filters. Dashboard Filters allow you to filter the data set across all widgets in a dashboard. This effectively means that you can use dashboards for drill-down and reuse dashboards with several configurations. Currently filters support writing filter expressions that are applied as prefixes to all your widgets’ queries. We plan to extend this to support more complex parameterized set-ups soon - but for now, prefixing is a powerful tool that is adequate for most scenarios. Filters can be named and saved so you can quickly jump from e.g. Production Data to Data from your Staging Environment. You can also mark a filter as “Default”. This means that the filter will automatically be applied when opening a dashboard.
  • Improvement: Better URL handling in dashboards. The URL of a dashboard now includes more information about the current state or the UI. This means you can copy the URL and share it with others to link directly to what you are looking at. This includes dashboard time, active dashboard filter, and fullscreen parameters. This will make it easy to have wall monitors show the same dashboard but with different filters applied, and allow you to send links when you have changed the dashboard search interval.
  • New Feature: Show Widget Queries on Dashboards. You can toggle displaying the queries that drive the widgets by clicking the “Code” button on dashboards. This makes it easier to write filters because you can peek at what fields are being used in your widgets.
  • Improvement: Better handling of reconnecting dashboards when updating a Humio instance.
  • Improvement: Better and faster query input field. We are using a new query input field where you should experience less “input lag” when writing queries. At the same time, syntax highlight has been tweaked, and while still not supporting some things like array notation, it is better than previous versions.
  • New Feature: Clock on Dashboards. Making it easier to know what time/timezone Humio is displaying result for.
  • Configure when Humio stops updating live queries (queries on dashboards) that are not viewed (not polled). This is now possible with the config option IDLE_POLL_TIME_BEFORE_LIVE_QUERY_IS_CANCELLED_MINUTES. Default is 1 hour.

2018-02-19T10-09-13--build-2028--sha-f0923d76ad977c500927372b6be627b7b0e1e160

Regular update release.

Release Date: 2018-02-19
Minimum previous Humio version:
Requires data migrations: **Yes: The backups are incompatible.**
Has changes to configuration: false
Type: archive

Changelog

  • Backup feature (using BACKUP_NAME in env) now stores files in a new format. If using this, you MUST either move the old files out of the way, or set BACKUP_NAME to a new value, thus pointing to an new backup directory. The new backup system will proceeed to write a fresh backup in the designated folder. The new backup system no longer require use of “JCE policy files”. Instead, it needs to run on java “1.8.0_161” or later. The current Humio docker images includes “1.8.0_162”.
  • Export to file. It is now possible to export the results of a query to a file. When exporting, the result set is not limited for filter queries, making it possible to export large amounts of data. Plain text, JSON and ND-JSON (Newline Delimited JSON) formats are supported in this version.
  • format() function. Format a string using printf-style.
  • top() function. Find the most common values of a field.
  • Performance improvement for searches using in particular “expensive” aggregates functions such as groupby and percentile.
  • global-snapshots topic in Kafka: Humio now deletes the oldest snapshot after writing a new, keeping the latest 10 only.

2018-02-07T13-26-11--build-1962--sha-2559a567039ce7399da48dbb2aed9fdfe2fddc3e

Regular update release.

Release Date: 2018-02-07
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Reduced query state size for live queries decreasing memory usage.
  • Added concat() function.
  • Log4j2 updated from 2.9.1 to 2.10.0. If you are using a custom logging configuration, you may need to update your configuration accordingly.
  • Removed GC pauses caused by java.util.zip.* native calls from compressed http-traffic triggering “GCLocker initiated GC”, which could block the entire JVM for many seconds.
  • To eliminate GC pauses caused by compression in the Kafka-client in Humio, Humio now disables compression on all topics used by Humio. Humio compresses internally before writing to Kafka on messages where compression is required (Ingest is compressed). This release of Humio enforces this setting onto the topics used by humio. This is the list of topics used by Humio. (Assuming you have not configured a prefix, which is in then used on all of them)
          global-events
          global-snapshots
          humio-ingest
          transientChatter-events
    

    You can check the current non-default settings using this command: (Replace the topic name)

    cd SOME_KAFKA_INSTALL_DIR
    ./bin/kafka-configs.sh --zookeeper localhost:2181 --entity-type topics --entity-name humio-ingest --describe
    

2018-02-01T09-22-15--build-1899--sha-541164ae0e9374edc0e9d8956588326bca3647ed

Minor update release.

Release Date: 2018-02-02
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • RDNS function now runs asynchronously, looking up names in the background and caching the responses. Fast static queries may complete before the lookup completes. Push rdns as far right as possible in your queries, and avoid filtering events based on the result, as rdns is non-deterministic.

???

Minor update release.

Release Date: 2018-02-01
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Improved performance on live queries with large internal states

2018-01-31T12-36-23--build-1884--sha-09768f142d1eb8097a5d08c1001df61a202b5d4a

Regular update release.

Release Date: 2018-01-30
Minimum previous Humio version:
Requires data migrations: Yes. Rollback to previous version is supported with no actions required.
Has changes to configuration: false
Type: archive

Changelog

  • Added PagerDuty notifier
  • Added VictorOps notifier
  • Fix bug in live queries after restarting a host.
  • If the “span” for a timechart is wider than the search interval, the default span is used and a warnign is added. This improves zooming in time on dashboards.
  • OnPrem: Configuration obsolete: No longer supports the KAFKA_HOST / KAFKA_PORT configuration parameters. Use the KAFKA_SERVERS configuration instead.
  • OnPrem: Size of query states are now bounded by the MAX_INTERNAL_STATESIZE, which defaults to MaxHeapSize/128.
  • On timechart, mouse-over now displays series sorted by magnitude, and pretty-prints the numbers.
  • Regular expression parsing limit is increased from 4K to 64K when ingesting events.

2018-01-25T08-09-46--build-1819--sha-6c470f489af78891b4608fbf21cd930a05a5411d

Minor update release.

Release Date: 2018-01-25
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Stop queries and warn if too big query states are detected
  • Warnings are less intrusive inn the UI.

2018-01-23T12-42-47--build-1788--sha-0c4e72ca7c36317ad8fc3687075e0c84be813569

Minor update release.

Release Date: 2018-01-23
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Support ANSI colors
  • Firefox is now supported.
  • Added OpsGenie notification template
  • Added documentation of the file formats that the lookup function is able to use
  • Added “tags” to “ingest-messages” endpoint to allow the source to add tags to the events. It’s still possible and recommended to add the tags using the parser.
  • Fixed bug: An alert could fire a notification on a partial query result, resulting in extra alerts being fired.
  • Fixed bug: Ingesting to a personal sandbox dataspace using ingest token was not working.

2018-01-19T07-37-48--build-1755--sha-9b1daf191d2625da9a557078cb0af2d6a8413b7f

Regular update release.

Release Date: 2018-01-19
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • New front page page. You can now jump directly to a dashboard from the front page using the dropdown on each list item. All dashboards can also be filtered and accessed from the “Dashboards Tab” on the front page.
  • Better Page Titles for Browser History.
  • Renewing your API token from your account settings page.
  • More guidance for new users in the form of help messages and tooltips.
  • Added suggestions on sizing of hardware to run Humio on.
  • Startup time reduced when running on large datasets.
  • Fix bug #35 Preventing you from doing e.g. groupby for fields containing spaces or quotes in their field name.
  • Fixed bug: If Kafka did not respond for 5 seconds, ingested events could get duplicated inside humio.
  • Fixed bug: Cancelled queries influenced performance after they were cancelled.
  • Fixed bug: Multiple problems on the Parsers page have been fixed.
  • Sort and table function now supports sorting on multiple fields. Sort also supports sorting using “type=hex” as numbers when the field value starts with “(-)0x”, or the type=hex argument is added.
  • Fixed bug: replace function on @rawstring now work also for live part of query.
  • For on-prems: You can now adjust BLOCKS_PER_SEGMENT from the default of 500 for influence on size of segment files.
  • New implementation of Query API for integration purposes.

2018-01-09T14-02-07--build-1632--sha-370b5cee6aa42d49ef419b454b94cafd9a0995ea

Minor update release.

Release Date: 2018-01-09
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fixed performance regression in latest release when querying, that hit in particular data sources with small events
  • Percentile function now accepts “as” parameter, allowing to plot multiple series as percentiles in a timechart.
  • Added option to do authentication in a http proxy in front of Humio, while letting Humio use the username provided by the proxy.

??

Regular update release.

Release Date: 2018-01-04
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Netflow support for on premises customers. It is now possible to send Netflow data directly to Humio. It is configured using Ingest listeners.
  • Tags can be defined in parsers.
  • Filebeat configuration now utilises tags in parsers. The Filebeat configuration is still backward compatible.
  • Better Bro integration.
  • Added stddev() function.
  • Root user management in the UI. A gear icon has been added next to the “Add Dataspace” button, if you are logged in as a root user. Press it and it is possible to manage users.
  • Fix bug #19 uploading files to be used with the lookup function.
  • Datasources are autosharded into multiple datasources if they have huge ingest loads. This is mostly an implementation detail.
  • Tag sharding. A tag with many different values would result in a lot of small datasources which will hurt performance. A Tag will be sharded if it has many different values. For example, having a field user as tag and having 100.000 Different users could result in 100.000 datasources. Instead the tag will be sharded and allowed to have 16 different values (by default). In general do not use a field with high cardinality as a tag in Humio.

2017-12-18T13-59-11--build-1480--sha-c3d4e89c0a646a940b7ef846257918f4baf6f987

Minor update release.

Release Date: 2017-12-18
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fixed a bug where the “parsers” page the fields found in parsing were hidden.
  • Fixed a bug that leaked Kafka-connections.
  • Turn off LZ4 on connection from Humio to kafka. Note: Storage of data in Kafka is controlled by broker settings, although having “producer” there will turn compression off now. The suggested Kafka broker (or topic) configuration is to have “compression.type=lz4”

??

Minor update release.

Release Date: 2017-12-15
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Set default timechart(limit=20). This can cause some dashboards to display warnings. But we decided that “for the greater good” and simplicity, it’s the best default behavior.

2017-12-14T14-28-14--build-1450--sha-f0ebc9b77e3bb1df225e1ea77b30da922443c812

Regular update release.

Release Date: 2017-12-14
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • New Search View functionality allows you to sort the event list to show newest events at the end of the list.
  • Scrolling the event list or selecting an event will pause the result stream while you inspect the events, this especially makes it easier to look at Live Query results. Resume a stream by hitting Esc or clicking the button.
  • Syntax highlighting in the event list for certain formats including Json.
  • Event List Results are now horizontally scrollable, though limited in length for performance reasons.
  • Different View Modes have been made more prominet in the Search View by the addition of tabs at the top of the result view. As we extend the visualization to be more specialized for different types of logs we expect to add more Context Aware tabs here, as well as in the inspection panel at the bottom of the screen.
  • Performance improvements in timecharts.
  • Styling improvement on several pages.
  • Typo Corrections in the Tutorial

2017-12-13T14-44-36--build-1438--sha-6d538a6adf08f5b808962144a4f6d6c093fb2d08

Regular update release.

Release Date: 2017-12-13
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Upgraded to kafka 1.0. This is IMPORTANT for on premises installations. It requires updating the kafka docker image before updating the humio docker image
  • Filter functions can now generically be negated !/foo/, !cidr(...), !in(...), etc.
  • New parameter timechart(limit=N) chooses the “top N charts” selected as the charts with the most area under them. When unspecified, limit value defaults to 100, and produces a warning if exceeded. When specified explicitly, no warning is issued.

2017-12-11T12-11-10--build-1415--sha-c2660c06199865e4e7e8cc53ab7190bb8d16a478

Minor update release.

Release Date: 2017-12-11
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Support datasources with large data volumes by splitting them into multiple internal datasources. (Only for root users, ask your admin.)
  • Tags can now be sharded, allowing to add e.g IP-adresses as tags. (Only for root users, ask your admin.)

??

Minor update release.

Release Date: 2017-12-07
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Kafka topic configuration defaults changed and documented. If running on-premises, please inspect and update the retention settings on the Kafka topics created by Humio to match your Kafka . See Configuration of Kafka.

??

Regular update release.

Release Date: 2017-12-06
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • When saving queries/alerts - the query currently in the search field is saved - not the last one that ran
  • New implementation of the timechart function with better performance
  • Improved ingest performance by batching requests more efficiently to the kafka ingest queue. Queue Serialization format changed as well
  • Fixed bug with some tables having narrow columns making text span many lines
  • Fixed bug in timechart graphs, The edge buckets made the graph go to much back in time and also into the future

??

Minor update release.

Release Date: 2017-11-26
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Humio now sets a CSP header by default. You can still replace this header in your proxy if needed
  • Fixed bug, where failure to compile regexp in query was reported as an internal server error
  • Bug fix: Make Kafka producer settings relative to Java max heap size

2017-11-24T13-11-13--build-1280--sha-1e30b2e8f36eaa9b6d20be8f7929a1c81d0d1c4f

Minor update release.

Release Date: 2017-11-24
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Improve support for running Humio behind a proxy with CSP
  • Fix links to documentation when running behind a proxy
  • Possible to specify tags for ingest listeners in the UI

2017-11-21T22-05-37--build-1245--sha-1dd64f3d2665b5923549e84b2a1bc34a9bd10130

Regular update release.

Release Date: 2017-11-21
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Ui for adding ingest listeners (Only for root users)
  • New sandbox dataspaces. Every user get their own sandbox dataspace. It is a personal dataspace, which can be handy for testing or quickly uploading some data
  • New interactive tutorial
  • Added pagination to tables
  • Fixed a couple of issues regarding syntax highlighting in the search field

2017-11-16T08-50-16--build-1204--sha-f15c4e367ee62e187f76788c12eb0feb3181be0e

Regular update release.

Release Date: 2017-11-15
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fix bug where Humio ignored the default search range specified for the dataspace
  • Fix bug with “save as” menu being hidden behind event distribution graph
  • Add documentation for new regular expression syntax

2017-11-14T11-02-13--build-1192--sha-4c326fd4ca7e79f581df6137be975bd6a87531c8

Regular update release.

Release Date: 2017-11-14
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Possible to specify tags when using ingest listeners
  • Alerts are out of beta.
  • Grafana integration. Check it out
  • New Humio agent for Mesos and DC/OS
  • Improved Error handling when a host is slow. Should decrease the number of warnings

2017-11-10T04-45-04--build-1166--sha-a823a7a3088c9ccddc9cd8707534d449f950aa50

Regular update release.

Release Date: 2017-11-09
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Improve syntax highlighting in search field
  • A bug has been fixed 🎉 where searching for unicode characters could cause false positives.
  • Performance has improved for most usages of regex (we have moved to use RE2/J rather than Java’s java.util.regex.)

Improvements to regular expression matching.

  • New syntax field = /regex/idmg syntax for matching. Optional flags i=ignore case, m=multiline (change semantics of $ and ^ to match each line, nut just start/end), d=dotall (. includes \n), and g=same as repeat=true for the regex() function. I.e. to case-insensitively find all log lines containing err (or ERR, or Err) you can now search /err/i
  • When such a regex-match expression appears at top-level e.g. | between two bars |, then named capturing groups also cause new fields to be added to the output event as for the regex() function.
  • When no field is named, i.e. as in /err/i, then @rawstring is being searched.

2017-11-06T11-27-28--build-1129--sha-8e24b956a8aee4bc039a0af8deaa7c07ae4b13bc

Regular update release.

Release Date: 2017-11-06
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

Improvements in the query language:

  • Saved queries can be invoked as a macro using the following syntax: $"name of saved query"() or $nameOfSavedQuery(). Saved queries can declare arguments using ?{arg=defaultValue} syntax. Such arguments can be used where ever a string, number or identifier is allowed in the language. When calling a saved query, you can specify values for the arguments with a syntax like: $savedQuery(arg=value, otherArg=otherValue).
  • Support for C-style allow comments // single line or /* multi line */
  • Anonymous composite functions can now make use of filter expressions:
      #type=accesslog | groupby(function={ uri=/foo* | count() })
    
  • New HTTP ingest API supporting parsers

2017-11-01T04-45-03--build-1080--sha-fd1f9174f599a0e7c08374b9327cd1a59795976a

Regular update release.

Release Date: 2017-11-01
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Event timestamps are set to Humios current time, at ingestion, if they have timestamps in the future. Theese events will also be annotate with the fields @error=true and @error_msg='timestamp was set to a value in the future. Setting it to now’. Events are allowed to be at most 10 seconds into the future, to take into account some clock skew between machines.
  • Timecharts are redrawn when series are toggled
  • Created a public github repository with scripts to support on-premises Humio installation and configuration.
  • Fix bug with headline texts animating forever
  • Improved handling of server deployments in dashboards

??

Minor release

Release Date: 2017-10-23
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fixed Session timeout bug when logging in with LDAP
  • Fixed Bug in search field when pasting formatted text
  • Better support for busting the browsers local cache on new releases

2017-10-17T11-17-11--build-992--sha-dca8e2536d68838456a1b29580a14c870db2c0e3

Regular update release.

Release Date: 2017-10-17
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fixed visual bug in the event distribution graph
  • Added time range parameterization to dashboards
  • The in() function now allow wildcards in it’s values parameter

??

Regular update release.

Release Date: 2017-10-17
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Added syntax highlighting of the query in the search field.
  • Allow resizing the search field.

??

Minor release

Release Date: 2017-10-13
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fixed bug showing basic authentication dialogue in browser when loging token expires
  • Add parameter cidr(negate=true|false) flag
  • Add ipv6 support to cidr
  • A system job will now periodically compacts and merges small segment files (caused by low volume data sources) improving performance and reducing storage requirements.

2017-10-11T10-50-10--build-949--sha-292ff6da98b7ad91687db5fc31eef6033bd6fa86

Regular update release.

Release Date: 2017-10-11
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Mouse over in timecharts now displays values for all series in hovered bucket

On-premises notes:

  • Since using the ingest queue is on by default, if running a clustered setup, make sure to update the ingest partition assignments. At the very least reset them to defaults.

??

Cloud-only release.

Release Date: 2017-10-10
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • New query functions: in, length, sample and lowercase.
  • Ingest queue is used by default (if not disabled)
  • Events are highlighted in the eventdistribution graph when they are hovered.
  • Possible to migrate dataspaces from one Humio to another.
  • Improved Auth0 on-prem support.
  • Heroku Integration.
  • Improved query scheduling for dashboards starting many queries at the same time.

2017-09-29T12-57-12--build-843--sha-bb28eadf1d792fd9e5da335638e75e4ef49a0847

Cloud-only release.

Release Date: 2017-09-29
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

??

Regular update release.

Release Date: 2017-09-06
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • UI improvements with auto suggest / pop up documentation.
  • new function: shannon_entropy()
  • Fix bug with Events list view for aggregate queries

On-premises Humio improvements:

  • New LDAP config options adding AUTHENTICATION_METHOD=ldap-search for using a bind user.
  • Fix bug with combination of add-cluster-member and real-time-backup-enabled.
  • Generic UDP/TCP ingest added (for e.g. syslog). Config with HTTP/JSON API only, no GUI yet.

??

Regular update release.

Release Date: 2017-08-30
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Copy dashboard feature
  • Syslog ingestion (Line ingestion) in Beta for on premises installations
  • Improve Auth0 dependencies. (Better handling of communication problems)
  • Change styling of list widgets

2017-08-17T19-02-13--build-456--sha-0c37ad1f46977a203dc601f38e845f56b98b22ef

Regular update release.

Release Date: 2017-08-17
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fix scrolling in safari for tables (1308)
  • Show warning when there are too many points to plot in a timechart and some are discarded (1444)
  • Make it possible to show event details, when looking at raw events inside a timechart (1438)

2017-08-15T21-45-13--build-433--sha-81737edb48fb8c2b15c7e582a6bbbbfb9322b2f2

Regular update release.

Release Date: 2017-08-16
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Dataspace type ahead filter on frontpage
  • Widget options now use radio buttons for many options
  • Remember which tab to show in event details drawer (Same as the last one)
  • Documentation for cluster management operations
  • Ingest request waits for 1 Kafka server to ack the request by default (improves data loss scenarios with machines failing)

2017-08-04T10-48-49--build-384--sha-86bff41c0f76d24b0338956d8e74b6214a54798f

Regular update release.

Release Date: 2017-08-04
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • New ‘server connection indicator’ shows that the server is currently reachable from the browser.
  • Background tabs are only updated minimally, resulting in much less CPU usage.
  • Fixed a bug that would prevent wiping the kafka used to run Humio. (1347, 1408)
  • Fix an issue with scrollbars appearing in dashboards. (1403)
  • Various minor UI changes.

??

Cloud-only release.

Release Date: 2017-07-09
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • When running an aggregate query (such as a groupby) the UI now shows a Events list ‘tab’ to see the events that were selected as input to the aggregate.
  • Fix an issue where login fails and the UI hangs w/auth0. (#1368)
  • Improved the update logic for read-only dashboards (#1341)
  • Improved rendering performance for dashboards (#1360)

2017-06-21T13-43-14--build-251--sha-cb92c034d6f10dbf9eb2f2e7bb9082b24fc26cef

Regular update release.

Release Date: 2017-06-22
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Support for LDAP authentication for on-premises installations. (#1222)
  • For calculations on events containing numbers, the query engine now maintains a higher precision in intermediate results. Previously, numbers were limited to two decimal places, so now smaller numbers can show up in the UI. (#603)
  • The limit parameter on table and sort functions now only issues a warning if the system limit is reached, not when the explicitly specified limit is reached. (#1323)
  • Ingest requests are not rejected with an error, when incomming events contain fields reserved for humio (like @timestamp). Instead an @ is prepended to the field name and extra fields are added to the event describing the problem(@error=true). (#1320)
  • The event distribution graph is not aligned better with graphs shown below.
  • Certain long queries could crash the system. (#781)
  • Various improvements in the scale-out implementation. Contact us for more detail if relevant.

2017-06-15T11-47-10--build-195--sha-44c2e1d988f54a6d79fa488a4c56241a0af92977

Regular update release.

Release Date: 2017-06-15
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • While running a query, the UI will now indicate progress 0-100%. (#1262)
  • For UI queries (and those using the queryjob API) the limit on the result set is lowered to 1500 rows/events. This avoids the UI freezing in cases where a very large result set is generated. To get more than 1500 results the query HTTP endpoint has to be used. (#1281, #960)
  • Add parameters unit and buckets to timechart(). The parameter buckets allows users to specify a specific number of buckets (maximum 1500) to split the query interval into, as an alternative to the span parameter which has issues when resizing the query interval. The unit parameter lets you convert rates by e.g. passing unit="bytes/bucket to Mibytes/hour". As the bucket (or span) value changes, the output is converted to the given output unit. (#1295)
  • Fixed a bug where read-only dashboards allowed dragging/resizing widgets. (#1274)
  • In certain cases, live queries producing a warning would add the same warning repeatedly for every poll. (#1255)
  • The event details view has been improved in various ways: remember height, new buttons for ‘groupby attribute’ and ‘filter without’. (#1277)
  • Humio can optionally use re2j (google’s regex implementation), which is slightly slower than the default Java version, but avoids some strange corner cases that can sometimes cause stackoverflow. Controlled with USE_JAVA_REGEX=true|false. Defaults to true.
  • Timecharts with span=1d now uses the browser’s timezone to determine day boundary. (#1250)

Distributed

  • The scale-out implementation is improved in several ways. Most significantly, functionality adding a node to a cluster has been added. Contact us for more detail if relevant.

2017-05-22T09-12-55--build-44--sha-ea8550e4bfa58f261d26671527af02ba90835586

Major release includes early access for new multi-host scale-out functionality. See seperate documentation for how to install and configure these functions.

Release Date: 2017-05-22
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Dashboards can now be reconfigured by dragging and resizing widgets (#1205)
  • Fixed a bugs with live aggregate queries which could cause results to inflate over time. (#1213)
  • Fixed minor bug in parser selection (only used in undocumented tags selection mechanism)
  • Fixed a bug with time charts that did not always include the Plotline Y. (#1111)
  • For +2 seconds aggregate queries, shuffle order logs are processed. This lets the user get an rough estimate of the nature of the data, which works well for such queries using e.g. avg or percentiles aggregates. (#1227)
  • Fixed a bug which made docs not redirect properly for on-prem installations (#1112)
  • Dashboards now indicate errors in the underlying queries with an transparent overlay (#775)

2017-05-04T13-25-16--build-173--sha-7d189458ba7c9fe5f52a3955a92fac22589a350e

Regular update release.

Release Date: 2017-05-04
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • New flag to groupby(limit=N) allows specifying the maximum number of groups (0 up to ∞). If more than N entries are present, elements not matching one of the existing are ignored and a warning is issued. The system has a hard limit of 20000, which can be removed by the operator by setting the property ALLOW_UNLIMITED_GROUPS=true in Humio’s configuration file (env file for Docker). (#1199)
  • Added UI to allow root users to set the retention on data spaces (#502)
  • Improve scroll behavior in tables on dashboards (#1190)

2017-04-27T09-55-28--build-159--sha-77ab43ca32047e23076afb22c1b1f0e110f4c8d5

Regular update release.

Release Date: 2017-04-27
Minimum previous Humio version:
Requires data migrations: No.
Has changes to configuration: false
Type: archive

Changelog

  • Fixes for logarithmic scale graphs (#1111)
  • Allow configuration for standard search interval other than 24h (#1149)
  • Save metadata locally to the file global-data-snapshot.json rather than to the Kafka topic global-snapshots. This file should only be edited while the server is down, and even then with care. (#1156)
  • Dashboard settings have been moved to the dataspace’s own page, rather than on the front page (#1125)
  • In the event-list view, a toggle has been added to enable line wrapping. (#1121)