VictoriaMetrics/VictoriaLogs v1.52.2

on GitHub

Released at 2026-11-13

v1.52.x is a line of LTS releases. It contains important up-to-date bugfixes for VictoriaLogs enterprise.
All these fixes are also included in the latest community release.
The v1.52.x line will be supported for at least 12 months since v1.52.0 release

Update note 1: the /internal/force_merge, /internal/force_flush, /internal/log_new_streams and /internal/partition/* HTTP endpoints now require the POST method for security reasons, in order to prevent GET-based SSRF attacks. Update any scripts or automation calling these endpoints via GET to use POST. See #1635.

Update note 2: requests to /select/vmalert/-/reload and other /select/vmalert/* paths ending with /config or /reload now require the -httpAuth.* credentials for security reasons. Previously, such requests were proxied to vmalert without checking the credentials. Add the credentials to any scripts calling these paths. See VictoriaMetrics#11548.

• SECURITY: upgrade Go builder from Go1.26.8 to Go1.27.4. See Go1.27 release notes and the list of issues addressed in Go1.27.1, Go1.27.2, Go1.27.3 and Go1.27.4.

• SECURITY: web UI: sanitize rendered HTML and Markdown in log messages and autocomplete descriptions to prevent cross-site scripting (XSS) attacks. See #1746.

• SECURITY: querying: hide the fields matching any of the hidden_fields_filters args passed in the request query string and in the request body. Previously, a client could see the hidden fields by passing hidden_fields_filters in the request body, since it overrode the hidden_fields_filters added to the query string by an auth proxy such as vmauth. See #1848.

• FEATURE: Enterprise version of VictoriaLogs: run with the -eula command-line flag to accept ESA. License keys are no longer verified. The -license, -licenseFile, -licenseFile.reloadInterval and -license.forceOffline flags are deprecated and are treated as -eula, so existing setups keep working. The vm_license_expires_at and vm_license_expires_in_seconds metrics are no longer exposed. See Running VictoriaMetrics Enterprise.

• FEATURE: deletion API: add the -deleteAuthKey command-line flag for protecting the /delete/* endpoints with a dedicated authKey. This allows restricting who can delete logs independently of -httpAuth.*. See #1749.

• BUGFIX: web UI: prevent long group-by values from overflowing group headers. See #1663.

• BUGFIX: web UI: prevent manually entered time ranges from shifting after Apply when using non-UTC time zones.

• BUGFIX: web UI: fix bar chart tap, pan, and pinch-to-zoom interactions on mobile devices.

• BUGFIX: web UI: fix the Table view to show all logs when All is selected for Rows per page. Previously, the table showed no rows in this case. See #1661.

• BUGFIX: web UI: display the systemd-compatible notice, crit, alert, and emerg log level labels instead of collapsing them into info and fatal. See #1543.

• BUGFIX: web UI: keep the query autocomplete details panel open when interacting with it, so documentation links open and description text remains selectable. See #1810.

• BUGFIX: web UI: stop rewriting the time range in the URL on every auto-refresh. Previously, each refresh of a relative time range changed the URL, so an idle tab with a short refresh interval could add thousands of entries per hour to the browser history. See #1676.

• BUGFIX: Datadog data ingestion: fix incorrect _time for logs without the timestamp field when they are sent after logs with the timestamp field in the same request. See #1845.

• BUGFIX: querying: properly return logs for queries with subqueries at live tailing and at queries, which select the N newest logs, such as /select/logsql/query with the limit query arg or queries ending with | sort by (_time desc) limit N. Previously, subqueries in such queries could match only the logs from a few last seconds or minutes instead of the time range set in the query. As a result, live tailing could return no logs, while queries with the limit could return older logs instead of the newest ones. See #1850.

• BUGFIX: File Collector: properly resolve relative symlink log paths when searching for a rotated file after restart. Previously, unread lines of a log file rotated while vlagent was stopped could be lost if the log path was a relative symlink. See #1875.

• BUGFIX: web UI: show the first logs in the Live tab in narrow browser windows. Previously, these logs were hidden behind the page header and the tabs. See #1842.

• BUGFIX: OpenTelemetry data ingestion: properly store the log message when VL-Msg-Field HTTP header is set. Now the field set via this header is used as the log message, while the log body is stored in the body field. Previously, the ingested logs took the message from either the log body or the field set via this header, and the other one was lost. See these docs and #1884.

• BUGFIX: Kubernetes Collector: use the log timestamp from the container runtime for logs in the Kubernetes Log format. This fixes wrong _time for such logs from pods with non-UTC timezone, which could be shifted by the timezone offset. See #1883.

• BUGFIX: data ingestion: do not drop logs, which go after a line exceeding -insert.maxLineSizeBytes near the end of the request. This affected the JSON stream, Elasticsearch bulk and Journald ingestion APIs. Elasticsearch bulk requests also failed with the missing log message after the "create" or "index" command error. See #1827.

• BUGFIX: web UI: use exact filters instead of phrase filters when selecting field values in LogsQL autocomplete. See #1860.

• BUGFIX: web UI: fix autocomplete suggestions for partially typed and completed LogsQL pipe commands, including commands with leading whitespace and different letter cases. See #1346.

• BUGFIX: web UI: fix autocomplete caret positioning and preserve surrounding text and whitespace in multiline queries. See #1879.

• BUGFIX: live tailing API: return an error if the query matches too many new logs per second, since such queries are not suitable for live tailing and could result in OOM crash of VictoriaLogs (or vlselect in cluster mode). See these docs and #1837.

• BUGFIX: /select/logsql/query endpoint: properly return logs when the limit=N query arg is passed to this endpoint. Also, properly return logs from LogsQL queries ending with | sort by (_time desc) limit N pipe. Previously, some logs could be missing or returned twice when many logs had the same timestamp. See #1882.

• BUGFIX: Syslog data ingestion: properly unescape the value of the last cef.extension.* field in CEF messages. Previously the last value kept escape sequences such as \=, while all the other values were unescaped. See #1730.

• BUGFIX: HTTP querying APIs: apply the -search.maxQueryLen limit to the extra_filters and extra_stream_filters query args. Previously, a deeply nested filter passed via these args could crash VictoriaLogs (or vlselect in cluster mode). See #1923.

• BUGFIX: VictoriaLogs cluster: properly return an error from vlselect when one of vlstorage nodes responds with an error (for example, because of misconfiguration), while partial responses are enabled via -search.allowPartialResponse. Previously, queries could return empty or incomplete results without any error in this case, depending on the order of nodes in -storageNode, so dashboards could silently show no logs. See #1935.

• BUGFIX: web UI: derive the log level in the Group view from the OpenTelemetry severity_number field when it is set. Previously, the level was detected only from the text fields such as severity_text, so logs with a severity_number could be shown with a wrong level or without any level. See #1899.

• BUGFIX: hide values passed to -pushmetrics.header in startup logs, /metrics and /flags, since they can contain sensitive HTTP headers such as Authorization. See VictoriaMetrics#11545.

• BUGFIX: security: make the -deleteAuthKey, -logNewStreamsAuthKey and -partitionManageAuthKey command-line flags override -httpAuth.* as documented. Previously, requests to /delete/*, /internal/log_new_streams and /internal/partition/* had to pass both the authKey and the -httpAuth.* credentials. See #1764.