VictoriaMetrics/VictoriaLogs v1.54.0 on GitHub

Released at 2026-11-13

SECURITY: upgrade Go builder from Go1.27.1 to Go1.27.4. See the list of issues addressed in Go1.27.2, Go1.27.3 and Go1.27.4.
SECURITY: web UI: sanitize rendered HTML and Markdown in log messages and autocomplete descriptions to prevent cross-site scripting (XSS) attacks. See #1746.
SECURITY: querying: hide the fields matching any of the hidden_fields_filters args passed in the request query string and in the request body. Previously, a client could see the hidden fields by passing hidden_fields_filters in the request body, since it overrode the hidden_fields_filters added to the query string by an auth proxy such as vmauth. See #1848.
FEATURE: Enterprise version of VictoriaLogs: run with the -eula command-line flag to accept ESA. License keys are no longer verified. The -license, -licenseFile, -licenseFile.reloadInterval and -license.forceOffline flags are deprecated and are treated as -eula, so existing setups keep working. The vm_license_expires_at and vm_license_expires_in_seconds metrics are no longer exposed. See Running VictoriaMetrics Enterprise.
FEATURE: File Collector and Kubernetes Collector: reduce the delay before reading new log lines from files that were idle for a while. Previously, such lines could be read up to ~10 seconds after they were written. Now the delay does not exceed ~2 seconds, while CPU usage stays roughly the same. See #1872.
FEATURE: File Collector: support nocreate rotation strategy for logrotate. vlagent keeps tracking the active file after it is renamed until a new file with the original path is created or the rotated file is completely removed. See #1846.
FEATURE: VictoriaLogs and vlagent: add -healthcheck command-line flag, which checks that the running process accepts connections at -httpListenAddr and exits with non-zero code if the check fails. This allows setting up Docker HEALTHCHECK in images without curl or wget. See these docs and #1565.
FEATURE: querying API: add sort_direction query arg to /select/logsql/query. Pass sort_direction=asc together with limit=N to return the N oldest matching log entries instead of the N most recent ones. See #924.
FEATURE: web UI: persist the large log load confirmation preference across browser tabs and add an option to manage it in Settings. See #911. Thanks to @rajcz for the pull request #1701.
FEATURE: web UI: allow expanding a row in Table view to inspect all fields of a single log entry, reusing the Group view field list. See #1630.
FEATURE: web UI: make the Group by selectors in the hits chart and Group view settings usable while the list of fields is loading. They now show recently used fields (up to 10 per tenant) and fields from the already loaded logs, and add the rest of the fields once they are loaded, so both selectors end up with the same list of fields. See #1808. Thanks to @talk2sohail for the pull request #1836.
FEATURE: web UI: display logs without waiting for hits to load. If logs exceed the configured timeout, load hits incrementally, then retry loading logs. See #1834.
FEATURE: web UI: add separate searches for stream field names and values, support searching large lists, and add sorting controls for values. See #1864.
BUGFIX: web UI: derive the log level in the Group view from the OpenTelemetry severity_number field when it is set. Previously, the level was detected only from the text fields such as severity_text, so logs with a severity_number could be shown with a wrong level or without any level. See #1899.
BUGFIX: File Collector: properly resolve relative symlink log paths when searching for a rotated file after restart. Previously, unread lines of a log file rotated while vlagent was stopped could be lost if the log path was a relative symlink. See #1875.
BUGFIX: OpenTelemetry data ingestion: properly store the log message when VL-Msg-Field HTTP header is set. Now the field set via this header is used as the log message, while the log body is stored in the body field. Previously, the ingested logs took the message from either the log body or the field set via this header, and the other one was lost. See these docs and #1884.
BUGFIX: dashboards/vlagent: fix the Drilldown links in the Persistent queue size, RSS memory % usage, CPU % usage and Disk writes/reads panels. Previously, these links opened the vmagent dashboard, and the opened panels showed no data because the selected datasource, job and instance were passed incorrectly. See #1826.
BUGFIX: dashboards/single: show the version change, restarts and gc annotations in the VictoriaLogs - single-node (VM) dashboard, which uses the VictoriaMetrics datasource. See #1825.
BUGFIX: web UI: stop rewriting the time range in the URL on every auto-refresh. Previously, each refresh of a relative time range changed the URL, so an idle tab with a short refresh interval could add thousands of entries per hour to the browser history. See #1676.
BUGFIX: web UI: show the first logs in the Live tab in narrow browser windows. Previously, these logs were hidden behind the page header and the tabs. See #1842.
BUGFIX: web UI: use exact filters instead of phrase filters when selecting field values in LogsQL autocomplete. See #1860.
BUGFIX: web UI: fix autocomplete suggestions for partially typed and completed LogsQL pipe commands, including commands with leading whitespace and different letter cases. See #1346.
BUGFIX: web UI: fix autocomplete caret positioning and preserve surrounding text and whitespace in multiline queries. See #1879.
BUGFIX: web UI: display all fields in Group view when _msg is the only selected display field and the log entry has no _msg field. See #1887.
BUGFIX: web UI: preserve expanded and collapsed log groups across query executions, auto-refreshes, and page reloads within each browser tab. See #707.
BUGFIX: Datadog data ingestion: fix incorrect _time for logs without the timestamp field when they are sent after logs with the timestamp field in the same request. See #1845.
BUGFIX: querying: properly return logs for queries with subqueries at live tailing and at queries, which select the N newest or oldest logs, such as /select/logsql/query with the limit query arg or queries ending with | sort by (_time desc) limit N. Previously, subqueries in such queries could match only the logs from a few last seconds or minutes instead of the time range set in the query. As a result, live tailing could return no logs, while queries with the limit could return older logs instead of the newest ones. See #1850.
BUGFIX: Kubernetes Collector: use the log timestamp from the container runtime for logs in the Kubernetes Log format. This fixes wrong _time for such logs from pods with non-UTC timezone, which could be shifted by the timezone offset. See #1883.
BUGFIX: data ingestion: do not drop logs, which go after a line exceeding -insert.maxLineSizeBytes near the end of the request. This affected the JSON stream, Elasticsearch bulk and Journald ingestion APIs. Elasticsearch bulk requests also failed with the missing log message after the "create" or "index" command error. See #1827.
BUGFIX: live tailing API: return an error if the query matches too many new logs per second, since such queries are not suitable for live tailing and could result in OOM crash of VictoriaLogs (or vlselect in cluster mode). See these docs and #1837.
BUGFIX: /select/logsql/query endpoint: properly return logs when the limit=N query arg is passed to this endpoint. Also, properly return logs from LogsQL queries ending with | sort by (_time desc) limit N pipe. Previously, some logs could be missing or returned twice when many logs had the same timestamp. See #1882.
BUGFIX: Syslog data ingestion: properly unescape the value of the last cef.extension.* field in CEF messages. Previously the last value kept escape sequences such as \=, while all the other values were unescaped. See #1730.
BUGFIX: HTTP querying APIs: apply the -search.maxQueryLen limit to the extra_filters and extra_stream_filters query args. Previously, a deeply nested filter passed via these args could crash VictoriaLogs (or vlselect in cluster mode). See #1923.
BUGFIX: VictoriaLogs cluster: properly return an error from vlselect when one of vlstorage nodes responds with an error (for example, because of misconfiguration), while partial responses are enabled via -search.allowPartialResponse. Previously, queries could return empty or incomplete results without any error in this case, depending on the order of nodes in -storageNode, so dashboards could silently show no logs. See #1935.