VictoriaMetrics/VictoriaLogs v1.28.0

on GitHub

Released at 2025-08-13

• FEATURE: LogsQL: optimize queries ending with | first N by (_time desc) and | last N by (_time) in the same way as queried ending with | sort by (_time desc) limit N are optimized. This is a follow-up for #46.

• FEATURE: LogsQL: add support for applying a global time offset to the <q> query via options(time_offset=<duration>) <q> syntax. This is useful for comparing query results on some time range to query results on the same time range with the given offset (similar to the offset modifier in PromQL). See these docs and #78 for details.

• FEATURE: LogsQL: add | time_add <duration> pipe, which allows adding the given <duration> to _time field (and to any other field). See these docs. This is a part of #78.

• FEATURE: LogsQL: speed up queries, which select big number of logs and end with | sort by (_time) desc offset M limit N pipe. E.g. these queries allow building simple pagination over the selected logs. See #96.

• FEATURE: VictoriaLogs cluster: use HTTP POST instead of HTTP GET method for internal VictoriaLogs cluster communication to avoid hitting too long URI limits when too long queries are passed to VictoriaLogs. See #545.

• FEATURE: Syslog data ingestion: support rsyslog high-precision timestmaps. See #303.

• BUGFIX: sort pipe: properly sort logs for | sort by (_time desc) limit N. Previously they were incorrectly sorted in the ascending order of _time, while they must be sorted in the descending order of _time. The bug has been introduced in v1.27.0 when adding an optimized execution path for the | sort by (_time desc) limit N. See #46.

• BUGFIX: /select/logsql/query: properly return limit=N logs when they have identical _time value. Previously an empty result could be returned in this case.

• BUGFIX: Syslog data ingestion: properly parse FreeBSD dialect of Syslog messages, which may miss hostname. See #571.