What’s New in Version 1.23

Several new features were introduced in the latest version of Humio, version 1.23. Below are the highlights of the more significant ones.

New humio-activity Repository

Humio will make some internal logs available in a new repository called, humio-activity. This is meant for logs that are relevant to users of Humio, as compared to logs that are only relevant for operators. The latter logs are still put into the humio repository. For this release, only new log events will be put into humio-activity. However, in later releases, some existing log events that are relevant for users, will be put in the humio-activity repository instead of the humio repository.

For cloud users, the logs for your organization can be accessed through the humio-organization-activity view.

For on-premise users, the logs can be accessed directly through the humio-activity repository. They are also output to a new log file named, humio-activity.log. It can be ingested into the humio repository, if you also want it there. If so and you’re using the Humio Insights Application, you should upgrade that to version 0.0.4.

For more information, see the Internal Logging documentation page.

GraphQL API Policy

Humio has decided to adopt an evolutionary approach to its GraphQL API. We will strive to do only backwards compatible changes. Instead of making non-backwards compatible changes to existing fields, we will instead add new fields alongside the existing fields. The existing fields will be deprecated and might be removed in a later release. We reserve the right, though, to still do non-backwards compatible changes (e.g., to fix security issues).

For new experimental features, we will mark the corresponding GraphQL fields as PREVIEW. There will be no guarantees on backwards compatibility on fields marked as PREVIEW.

Deprecations and Preview

Deprecated and preview fields and enum values will be marked as such in the GraphQL schema and will be shown as deprecated or preview in the API Explorer. Apart from that, the result of running a GraphQL query using a deprecated or preview field will contain a new field, extensions — which will contain a field, deprecated with a list of all deprecated fields used in the query and a field, preview with a list of all preview fields used in the query.

Example:

{
  "data": ...
  "extensions": {
    "deprecated": [
      {
        "name": "alert",
        "reason": "[DEPRECATED: Since 2020-11-26. Deprecated since 1.19.0. Will be removed March 2021. Use 'searchDomain.alert' instead]"
      }
    ]
  }
}

Deprecated fields and enum values will also be noted in the release note, when they are first deprecated. All use of deprecated fields and enum values will also be logged in the Humio repository humio-activity. They will have #category=GraphQL, subCategory=Deprecation and #severity=Warning. If you are using the API, consider creating an alert for such logs.

Removed Support for CIDR Shorthand

Previous versions of Humio supported a shorthand for IPv4 CIDR expressions.

For example 127.1/16 would be equivalent to 127.1.0.0/16. This was contrary to other implementations like the Linux function inet_aton, where 127.1 expands to 127.0.0.1. Support for this shorthand has been removed and the complete address must now be written instead.