Preview Releases


Security fix and bug fixes

Release Date: 2020-03-25
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false

Security fix and bug fixes


  • Added API to the list and deleted missing segments from global. See reference here.
  • Security: [critical] Fixed a security vulnerability discovered through proactive penetration testing (more information will be forthcoming).


Security fix and bug fixes

Release Date: 2020-03-23
Minimum previous Humio version: 1.8.5
Requires data migrations: false
Has changes to configuration: false

Security fix and bug fixes


  • This is a critical update. Self-hosted systems with access for non-trusted users should upgrade immediately. We will follow up with more details when this update has been rolled out.
  • Bug fix: the health-check failed-http-status-check would get stuff in warn state, this has now been fixed


UI for Role Based Access Control (RBAC), Health Check API, Kafka version update, Vega charts

Release Date: 2020-03-12
Minimum previous Humio version: 1.8.5
Requires data migrations: true
Has changes to configuration: true

RBAC, Health Check API, Kafka, Vega


Role Based Access Control

Role Based Access Control (RBAC) through the UI is now the only permission model in Humio. Please see the Authorization documentation for more information.

Kafka version update

  • Updated Humio to use Kafka 2.4. Humio can still use versions of Kafka down through 1.1.
  • Be aware that updating Kafka also requires you to update Zookeeper to 3.5.6. There is a migration involved in updating Zookeeper. See Zookeeper’s migration FAQ here. Use the migration approach using an empty snapshot. The other proposed solution can loose data.
  • Updated Kafka and Zookeeper Docker images to use Kafka 2.4. Updating to Kafka 2.4 should be straightforward using Humio’s Kafka/Zookeeper Docker images. Zookeper image will handle migration. Stop all Kafka nodes. Stop all Zookeeper nodes. Start all Zookeeper nodes on the new version. Start all Kafka nodes on the new version. Before updating Kafka/Zookeeper, we recommend backing up the Zookeeper data directory. Then, add the Zookeeper properties described below. If you are deploying Kafka/Zookeeper using other tools, for example Ansible scripts, be aware there is a migration involved in updating Zookeeper.
  • When updating Kafka/Zookeeper we recommend setting these Zookeeper properties admin.enableServer=false # do not start the new admin server. It start on port 8080 by default, which is the same port as Humio uses ´autopurge.purgeInterval=1´ # purge old snapshot files 4lw.commands.whitelist=* # allow 4 letter commands. Humios admin pages uses these to get info about the Zookeeper cluster

Query Function updates

  • New caseSensitive option added to the parseTimestamp query function.
  • Queries involving join can now be with ‘used export to file’ and the /query HTTP endpoint.
  • New selectLast function, which is like select but aggregate.
  • Improved (reduced) memory consumption for live groupby, and for groupby’s involving many distinct keys.

Health Check APIs

The overall health of a Humio system is determined by a set of individual health checks. For more information about individual checks see the Health Check page and the Health Check API page.


Humio’s NetFlow support has been extended to also support IPFIX. See Humio’s docs for IPFIX.

Vega + chart series colors

This version replaces our chart library with Vega. The goal is to create a better, customizable, and more interactive charting experience in Humio. This first iteration is largely just a feature replacement for the existing functionality, with a few exceptions

Support for controlling color and title in widgets

Each chart type now supports assigning colors to specific series. This will allow you to, for instance, assign red to errors and green to non-errors.

You can find the series configuration controls in the Style tab of the Search page.

Control widget styling directly from dashboards

Now, you can click Edit Styling in the widget’s menu and modify styling directly from the dashboard view.

Time Chart series roll-up

To prevent the charts from getting cluttered, you can adjust the maximum number of series that should be shown in the chart. Any series that are not part of the top-most series will be summed together and added to a new series called Other.

Interpolation types

Linear interpolation is now the default, and we have added a new type of interpolation: Basis.

Bar Chart styling support

You can now style your bar charts to control things like label position and colors.

Pie Chart styling support

You can now style your pie charts, and they will default to having a center radius (actually making them donuts!).

Disabling Vega

Since charts are such a central feature, we allow disabling the new implementation of widgets if you are experiencing issues with them. You can disable Vega charts globally using the ENABLE_VEGA_CHARTS=false flag.


Bug fixes

Release Date: 2020-01-27
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false

Bug fixes


  • Add Chromium to the list of compatible browsers
  • Allow webhook notifiers to optionally not validate certificates.
  • Bug fix: join now accepts absolute timestamps in millis in start and end parameters.
  • Bug fix: Stabilized sync of uploaded files within a cluster in combination with bucket storage.
  • Bug fix: Allows “Force remove” of a node from a cluster.


Bug fixes

Release Date: 2020-01-17
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false

Bug fixes


  • New log output option for the LOG4J_CONFIGURATION configuration now allows the built-in: log4j2-stdout-json.xml to get the log in NDJSON format, one line for each event on stdout.
  • ERROR logs get output to stderr instead of stdout to avoid breaking the potential stdout format.
  • top() function allows limit up to 20,000 by default now. Used to be 1,000.


Bug fixes

Release Date: 2020-01-16
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: false

Bug fixes


  • Change: When the system starts with no users at all, the first user to log get root priviledges inside the system.
  • The “query monitor” and “query quota” new share the definition of “cost points”. The definition has changed in such a way that quotas saved by version up to 1.7.1 and earlier are disregarded by this (and later) versions.
  • New config: LIVEQUERY_STALE_CANCEL_TRIGGER_DELAY_MS and LIVEQUERY_STALE_CANCEL_COST_PERCENTAGE controls discard of live queries that have not been polled by a client for a while when the system experiences digest latency of more than the delay.
  • New config: LIVEQUERY_CANCEL_TRIGGER_DELAY_MS and LIVEQUERY_CANCEL_COST_PERCENTAGE controls cancelling of live queries that have been consuming the most cost for the previous 30s when the system experiences digest latency of more than the delay. New metrics: livequeries-canceled-due-to-digest-delay, livequeries-rate-canceled-due-to-digest-delay and livequeries-rate
  • New config: USING_EPHEMERAL_DISKS allows running a cluster on disks that may be lost when the system restarts by assuming that only copies in Bucket Storage and the events in Kafka are preserved across restarts. If the filesystem remains during restart this is also okay in this mode and more efficient then fetching the files from the bucket.
  • New config: LOG4J_CONFIGURATION allows a custom log4j file. Or set to one of the built-in: log4j2-stdout.xml to get the log in plain text dumped on stdout, or log4j2-stdout-json.xml to get the log in NDJSON format, one line for each event on stdout.
  • New Utility inside the jar. Usage java -cp humio.jar com.humio.main.DecryptAESBucketStorageFile <secret string> <encrypted file> <decrypted file>. Allows decrypting a file that was uploaded using bucket storage outside the system.
  • Bug fix: The Zookeeper status page now shows a warning when the commands it needs for the status page to work are not whitelisted on the ZK server.
  • Bug fix: Restart of queries using lookup/match/cidr when the uploaded file changes only worked for top-level functions, not when nested inside another function.
  • Bug fix: Query of segments only present in a bucket now works even if disabling further uploads to bucket storage.
  • Bug fix: Bucket storage, GCP variant: Remove temporary files after download from GCP. Previous versions left a copy in the tmp dir.
  • Bug fix: Top(x, sum=y) now also support non-integer values of y (even though the internal state is still an integer value)
  • Bug fix: #repo=* never matched but should always match.
  • Bug fix: Retention could in fail to delete obsolete files in certain cases.
  • Bucket storage: Support download after switching provider from S3 to GCP or vice versa.
  • Bucket storage: Continue cleaning the old buckets after switching provider from S3 to GCP or vice versa.
  • Bucket storage: Also keep copies of the “metadata files” that you use for lookup and match functions in the bucket and restore from there when needed.


Bug fixes

Release Date: 2020-01-06
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: true

Bug fixes and removal of limitations.


  • Bug fix: Handle large global snapshot files (larger than 2 G).
  • Allow explicit auto as argument to the span parameter in bucket and timechart. This makes it easier to set span from a macro argument.
  • Remove 64 K restriction on individual fields to be parsed by parsers.
  • Bug fix: Reuse of live dashboard queries on the humio-search-all repository did not work correctly. As an effect the number of live queries could keep increasing.
  • Bug fix: Saved Queries/macros was not expanded when checking if a live dashboard query could reuse an existing query.
  • Bug fix: The Postmark integration was always assuming a from address. This has been fixed by introducing a new POSTMARK_FROM configuration parameter.


Join, Bucket Storage Backend, Query Quotas, UI Improvements

Release Date: 2019-12-17
Minimum previous Humio version: 1.6.10
Requires data migrations: false
Has changes to configuration: true


Humio now supports joins in the query language; the functionality is largely similar to what could previously be done by running a query, exporting it as a .csv, uploading said .csv file, and then using the match() function to filter/amend a query result. See docs.

Bucket Storage

Humio now supports storing segment files on Amazon S3 (and Google cloud storage) and compatible services to allow keeping more segment files than the local disks have room for and managing the local disk as a cache of these files. See docs.

New stable/preview release versioning

Stable release will have an even Minor version. If Minor is an odd number (like in this release), it is a preview release. Critical fixes will be back ported to the most recent stable release. More details can be found here.

Dashboard Improvements

To make it easier to integrate with external systems Humio dashboards, can now be passed URL parameters to set the dashboard’s global time interval. By passing query parameters ?time=<unix ms timestamp>&window=5m the dashboard will be opened with a 10m time window (5m before and after the the origin specified by time). The feature is not available for shared dashboards - since they do not support changing time intervals.

You can now also disable shared dashboards completely using the SHARED_DASHBOARDS_ENABLED=false configuration setting.

See the changelog for a more complete list of changes.


  • Upgrading: After installling this version, it is not possible to roll back to a version lower than 1.6.10. Be on version 1.6.10 before upgrading to this version.
  • Top Feature: Bucket Storage with support for S3 and Google cloud storage, see description.
  • Top Feature: Joins allowing subqueries and joining data from multiple repositories, see description.
  • Top Feature: Query errors will now be highlighted as-you-type in on the search page.
  • Top Feature: The “Queries” page has been replaced with a dropdown on the Search page, that allows searching saved and recent queries.
  • Top Feature: Query quotas allowing limiting how many resources users can use when searching, see description
  • UI: Improved Query Monitor in the administration section, making it much easier to find expensive queries. See description
  • UI: Queries page removed, and delete and edit saved query functionality moved into “Queries” dropdown on search page.
  • UI: Add support for loading a specific time window when launching a dashboard, by setting time= and window= in the URL.
  • UI: Improve word-wrap and allow columns in the event list to be marked as ‘autosize’. Autosizing columns will adapt to the screen size when word-wrap is enabled.
  • UI: Word-wrap and event list orientation is now sticky in a session, meaning revisiting the search page will keep the previous selected options.
  • UI: Allow disabling automatically searching when entering a repository search page, on a per-repo basis.
  • UI: The time selector on dashboards now allow panning and zooming - like the one on the search page.
  • UI: Bugfix - Don’t show “unexpected error” screen when Auth Token expires.
  • UI: Bugfix - Ensure counts of fields and value occurrences on the event list are reliable.
  • Function: New function json:prettyPrint()
  • Function: New function xml:prettyPrint()
  • Function: New function callFunction, allows you to call a humio function by name. This is useful if you for instance want a dashboard where you can control what statistics your widgets show based on a parameter, e.g. timechart(function=callFunction(?statistic, field=response_time))
  • Function: The function top has a new max=field argument, that can be used to make it work as a more efficient alias a groupby/sort combination, like top(field, max=value, limit=5) is equivalent (and much faster than) groupby(field, function=max(value)) | sort(limit=5).
  • Function: The implementation of the percentile function has been updated to be more precise (and faster).
  • Config: COMPRESSION_TYPE=high is now the default compression type. Clusters running with default configuration, wil change to high compression unless the configuration COMPRESSION_TYPE=fast is set.
  • Config: Add SHARED_DASHBOARDS_ENABLED configuration setting which allows disabling access to the shared dashboards feature - if e.g. your organization has strict security policies.
  • Config: Autosharding can now bet set “sticky” which means fixed as set by user on a specific (input) datasource. The API also allows listing all autosharding rules, both system-manages and sticky.
  • New stable/preview release versioning scheme. See description.
  • Use case-insensitive comparison of usernames (historically an email address) when logging into Humio.
  • Java 13 is the recommended Java version. Docker images are now running Java 13.