The Vector team is pleased to announce version 0.42.0!
This release contains a number of enhancements and fixes as listed below.
There are no breaking changes or deprecations with this release and so no upgrade guide.
VRL was updated to v0.19.0. This includes the following changes:
parse_groks VRL function is now enabled by default.
Use the (?-m) modifier to disable this behavior. (https://github.com/vectordotdev/vrl/pull/1022)keyvalue grok filter is extended to match the Datadog implementation. (https://github.com/vectordotdev/vrl/pull/1015)parse_xml function no longer adds an unnecessary text key when processing single nodes. (https://github.com/vectordotdev/vrl/pull/849)parse_grok and parse_groks no longer require field names containing a hyphen (for example, @a-b) to be quoted.match_datadog_query doesn’t panic if an invalid path is passed, instead it returns an error. (https://github.com/vectordotdev/vrl/pull/1031)parse_ruby_hash parser is extended to match the Datadog implementation. Previously it would parse the key in {:key => "value"} as :key, now it parses it as key. (https://github.com/vectordotdev/vrl/pull/1050)OPTIONS HTTP-method for http_server sourcegraph configuration on each component so that users can add arbitrary graphviz node attributes when generating a graph through vector graph.The axiom sink now uses the native HTTP API rather than the Elasticsearch-compatible API.
Notable changes:
@timestamp semantics that changed in v5.5 of ElasticSearch no
longer affect the axiom sink as the sink uses the Axiom native HTTP ingest
method._time field in data sent to Axiom now supports the same semantics as the
Axiom native API and SDK as
documented.
In previous versions of Vector, the Axiom sink rejected events with _time
fields as the sink was following Elasticsearch semantics. This was confusing and
suprising for seasoned Axiom users new to Vector and seasoned Vector users new
to Axiom alike.@timestamp field is sent to Axiom it is a normal user defined field._time field is sent to Axiom it now follows documented Axiom field semantics.scope information to logs received through the opentelemetry source.aggregate transform: count, diff, max, min, mean, sum, latest and stdev. The current aggregation is named auto and is made the default (acts like a combination of sum and latest).gcp_cloud_storage sink API endpoint.retain boolean config flag in the MQTT sink to tell the server to retain the messages.query_parameters setting in http_server and heroku_logs sources.new_naming the GreptimeDB sink to use greptime_value and
greptime_timestamp for value and timestamp fields, in order to keep consistency
with GreptimeDB’s convention.tls.server_name for components that support TLS.url config
option to have a comma-delimited list. This allows for greater fault tolerance as
compared to reading from a single server.logstash source decoder to remove a panic that could trigger in the event of certain protocol errors.new_relic sink that caused dotted attribute names to be encoded incorrectly with quotes.new_relic sink sent non-standard event fields to the logs
API, it would include those fields beside the standard event fields (for example,
message and timestamp). Now, any such fields are sent in an attributes
object, as specified by the New Relic Logs
API.subscriber_capacity default for the NATS source to the correct value
of 65536, which is the same value that the upstream async_nats library uses.all_metrics: true flag in log_to_metric transform, the
namespace field is now optional and no longer required. If the namespace field
is not provided, the produced metric does not have a namespace at all.socket or papertrail) now gracefully handle config
reloads under load rather than panicking. Previously, when a configuration reload
occurred and data was flowing through the topology, the Vector process crashed due
to the TCP-based sink attempting to access the stream when it had been terminated.adaptive_concurrency.decrease_ratio in a sink to a value less than 0.5.new_relic sink, when sending to the event API, would quote field names
containing periods or other meta-characters. This would produce broken field
names in the New Relic interface, and so that quoting has been removed.Sign up to receive emails on the latest Vector content and new releases
Thank you for joining our Updates Newsletter