github.com/VictoriaMetrics/VictoriaLogs

Released at 2025-11-29

• FEATURE: syslog data ingestion: add support for automatic parsing of @cee messages. Thanks to @exherb for the pull request #842.

• FEATURE: HTTP querying APIs: return AccountID and ProjectID response headers, which match the corresponding request headers when executing queries for the particular tenant. These response headers can be used by client such as built-in web UI for VictoriaLogs for the proper displaying of the queried tenant. See #656.

• FEATURE: Elasticsearch data ingestion: return the first parse error to the client, so the error could be quickly fixed. Previously, the parse error was logged into VictoriaLogs internal logs and success response was returned to the client. This could complicate troubleshooting, since users need to have access to VictoriaLogs internal logs for the troubleshooting. See #817 and #60.

• FEATURE: hits API: consistently return zero hits on the selected [start .. end) time range. Previously, zero hits weren't returned, so this complicated the processing of the hits response by clients. See #700.

• FEATURE: web UI: add the help button with shortcuts reference and controls for charts and query input. See #77.

• FEATURE: web UI: auto-sync time picker with _time filter from the query (can be disabled). See #558.

• FEATURE: web UI: automatically load and display available tenants using /select/tenant_ids. See #821.

• BUGFIX: delete API: prevent from possible fatal error (panic) at block_stream_merger.go:237 during the deletion of the logs. See #825.

• BUGFIX: /select/logsql/query endpoint: properly return the last N logs with the biggest timestamps when the limit=N query arg is passed to this endpoint. Also, properly return logs from LogsQL queries ending with | sort by (_time desc) limit N pipe. Previously, some logs may be missing because of an off-by-one error. See #802.

Released at 2025-11-14

• SECURITY: upgrade Go builder from Go1.25.3 to Go1.25.4. See the list of issues addressed in Go1.25.4.

• FEATURE: add an ability to delete stored logs. See these docs and #43. Thanks to @func25 for the initial idea and implementation at #4.

• FEATURE: add an ability to hide the given log fields on a per-query basis. This may be useful for restricting access to log fields with sensitive information, by specifying the list of the fields to hide via hidden_fields_filters query arg. See these docs for details. See #668.

• FEATURE: querying: add slow query logging via -search.logSlowQueryDuration; increments vl_slow_queries_total. See #750.

• FEATURE: querying API: add support for /select/tenant_ids endpoint, which returns tenant IDs for the existing logs on the given [start .. end) time range. See these docs and #158 at victorialogs-datasource.

• FEATURE: web UI: simplify "Download logs" dialog - show only file name field and description with time range and tenant. See #789.

• FEATURE: web UI: update text for skipping warning modal and increase large load limit to 1000. See #808.

• BUGFIX: Loki data ingestion: fix handling of Content-Type HTTP header in /insert/loki/api/v1/push endpoint to allow support Clients that send charset or additional information in header. See #813.

• BUGFIX: web UI: fix /hits graph showing the first point outside the selected time range. See #737.

• BUGFIX: web UI: fix hits chart not updating when changing the group by field. See #788.

• BUGFIX: web UI: replace GET with POST for field_names and stream_field_names requests. See #818.

Released at 2025-11-01

• BUGFIX: fix panic BUG: bsm.bd must be empty, which can occur during data ingestion and background merging of already ingested logs. See #792. The panic has been introduced in v1.37.1.

Compare

Released at 2025-10-30

• SECURITY: upgrade Go builder from Go1.25.2 to Go1.25.3. See the list of issues addressed in Go1.25.3.

• SECURITY: upgrade base docker image (Alpine) from 3.22.1 to 3.22.2. See Alpine 3.22.2 release notes.

• FEATURE: add an ability to limit the age of the accepted logs via -maxBackfillAge command-line flag. See these docs.

• FEATURE: add an ability to temporarily enable logging of newly ingested log streams during the given number of seconds. See these docs.

• FEATURE: add -fs.maxConcurrency command-line flag for tuning the number of concurrent operations with files. See #774.

• FEATURE: add linux/s390x artifact to releases. See #646.

• FEATURE: web UI: add Overview page for quick log characteristic inspection. See #516.

• FEATURE: web UI: allows grouping hits graph by any field with configurable top-N. See #110.

• FEATURE: web UI: add an option to download all logs without limit in .jsonl format. See #627.

• FEATURE: web UI: allows opening time zone settings from the date/time picker.

• BUGFIX: pattern_match filter: fix non-progress loop in pattern_match(...) filter when the pattern starts with a literal separator that occurs multiple times in the target string and the rest of the pattern doesn't match. Previously, this could make queries spin indefinitely. Now the matcher advances correctly and returns no match as expected. See #759.

• BUGFIX: vlogscli: fix basic auth not being applied when using -username and -password. See #761

• BUGFIX: web UI: fix page not resetting after changing the query in the Group View tab. See #753.

• BUGFIX: web UI: fix log rendering with markdown enabled and collapse_nums pipe. See #647.

Released at 2025-10-08

• FEATURE: web UI: add support for zooming the Hits chart to millisecond precision. See #112.

• FEATURE: web UI: add warning modal for limit > 500 with session suppression; validate limit to [1, 10000]. See #500.

• BUGFIX: web UI: fix incorrect X-axis time labels after switching time zones; axis ticks now reflect the selected time zone correctly.

Released at 2025-10-08

• SECURITY: upgrade Go builder from Go1.25.1 to Go1.25.2. See the list of issues addressed in Go1.25.2.

• FEATURE: LogsQL: improve collapse_nums pipe by treating _ (underscore) as a separator for numeric tokens. This enables collapsing underscore‑delimited numbers (e.g. temp_23_175863242537_93_98_ → temp_<N>_<N>_<N>_<N>_) for better normalization and grouping. See #703.

• BUGFIX: HTTP querying APIs: treat end query arg as exclusive bound for time ranges, i.e. use [start, end) instead of [start, end], e.g. the first nanosecond at the end isn't included in the selected time range. This affects endpoints accepting start/end (e.g. /select/logsql/query, /select/logsql/hits, /select/logsql/stats_query_range, /select/logsql/streams, etc.). See VictoriaMetrics#9753 and #587 for more details.

• BUGFIX: all components: restore sorting order of summary and quantile metrics exposed by VictoriaLogs components on /metrics page. See metrics#105 for details.

Released at 2025-09-27

• SECURITY: upgrade Go builder from Go1.25.0 to Go1.25.1. See the list of issues addressed in Go1.25.1.

• FEATURE: LogsQL: add equals_common_case filter and contains_common_case filter. These filters can be used as faster alternatives to i(...) filter. For example, _msg:contains_common_case("VictoriaMetrics") matches logs with the _msg field containing at least one of the following words: VictoriaMetrics, victoriametrics, VICTORIAMETRICS, Victoriametrics or victoriaMetrics.

• FEATURE: /select/logsql/stats_query: allow placing other pipes in front of | stats ..., including pipes that modify or drop the _time field. This relaxes the previous guard for instant stats and allows using queries like * | field_names | stats count() in instant queries at Grafana plugin for VictoriaLogs and in recording and alerting rules at vmalert. See #681.

• FEATURE: Syslog data ingestion: automatically parse CEF messages embedded into Syslog messages. CEF messages (aka Common Event Format messages) are typically generated by SIEM systems. This simplifies using VictoriaLogs as a database for SIEM logs. See these docs for details.

• FEATURE: LogsQL: add set_stream_fields pipe, which allows constructing the _stream field from the given log fields. This pipe is going to be used by vlagent for logs' transformation before sending them to the remote storage.

• FEATURE: metrics: expose minimum and maximum timestamps across stored logs via vl_storage_log_min_timestamp_seconds and vl_storage_log_max_timestamp_seconds metrics. See #695.

• FEATURE: web UI: consistently display timestamps with nanosecond precision across all the views in the built-in web UI. See #675.

• BUGFIX: facets pipe: properly skip field names with more than max_values_per_field unique values. Previously, these fields could be returned with an incomplete number of hits.

• BUGFIX: rename pipe: keep fields starting with dst when rename src* dst* is used. Previously, all the dst* fields were incorrectly dropped. See #691 for more details.

• BUGFIX: copy pipe: keep fields starting with dst when copy src* dst* is used. Previously, all the dst* fields were incorrectly dropped. See #691 for more details.

• BUGFIX: format pipe: properly load the original field values for the dst_field when the if(...) part doesn't match the current log entry inside the | format if (...) ... as dst_field. Previously, the dst_field was incorrectly skipped in this case unless the keep_original_fields or skip_empty_results options were set.

• BUGFIX: /select/logsql/stats_query and /select/logsql/stats_query_range endpoints: allow using unroll pipe in LogsQL queries at Grafana plugin for VictoriaLogs and at alerting and recording rules at vmalert. See #697. The issue was introduced in this commit, which was then included in VictoriaLogs v1.29.0.

• BUGFIX: /select/logsql/query endpoint: properly handle queries with the rename and copy pipe, which modifies or removes the _time field, when these queries are issued by Grafana plugin for VictoriaLogs or by the built-in web UI for VictoriaLogs. See #702 for more details.