VictoriaMetrics/VictoriaLogs v1.35.0

on GitHub

Released at 2025-09-27

• SECURITY: upgrade Go builder from Go1.25.0 to Go1.25.1. See the list of issues addressed in Go1.25.1.

• FEATURE: LogsQL: add equals_common_case filter and contains_common_case filter. These filters can be used as faster alternatives to i(...) filter. For example, _msg:contains_common_case("VictoriaMetrics") matches logs with the _msg field containing at least one of the following words: VictoriaMetrics, victoriametrics, VICTORIAMETRICS, Victoriametrics or victoriaMetrics.

• FEATURE: /select/logsql/stats_query: allow placing other pipes in front of | stats ..., including pipes that modify or drop the _time field. This relaxes the previous guard for instant stats and allows using queries like * | field_names | stats count() in instant queries at Grafana plugin for VictoriaLogs and in recording and alerting rules at vmalert. See #681.

• FEATURE: Syslog data ingestion: automatically parse CEF messages embedded into Syslog messages. CEF messages (aka Common Event Format messages) are typically generated by SIEM systems. This simplifies using VictoriaLogs as a database for SIEM logs. See these docs for details.

• FEATURE: LogsQL: add set_stream_fields pipe, which allows constricting the _stream field from the given log fields. This pipe is going to be used by vlagent for logs' transformation before sending them to the remote storage.

• FEATURE: metrics: expose minimum and maximum timestamps across stored logs via vl_storage_log_min_timestamp_seconds and vl_storage_log_max_timestamp_seconds metrics. See #695.

• FEATURE: web UI: consistently display timestamps with nanosecond precision across all the views in the built-in web UI. See #675.

• BUGFIX: facets pipe: properly skip field names with more than max_values_per_field unique values. Previously these fields could be returned with incomplete number of hits.

• BUGFIX: rename pipe: keep fields starting with dst when rename src* dst* is used. Previously, all the dst* fields were incorrectly dropped. See #691 for more details.

• BUGFIX: copy pipe: keep fields starting with dst when copy src* dst* is used. Previously, all the dst* fields were incorrectly dropped. See #691 for more details.

• BUGFIX: format pipe: properly load the original field values for the dst_field when the if(...) part doesn't match the current log entry inside the | format if (...) ... as dst_field. Previously the dst_field was incorrectly skipped in this case unless the keep_original_fields or skip_empty_results options were set.

• BUGFIX: /select/logsql/stats_query and /select/logsql/stats_query_range endpoints: allow using unroll pipe in LogsQL queries at Grafana plugin for VictoriaLogs and at alerting and recording rules at vmalert. See #697. The issue has been introduced in this commit, which had been included in VictoriaLogs v1.29.0.

• BUGFIX: /select/logsql/query endpoint: properly handle queries with the rename and copy pipe, which modifies or removes the _time field, when these queries are issued by Grafana plugin for VictoriaLogs or by the built-in web UI for VictoriaLogs. See #702 for more details.