Overview of this release:
* New input plugins: zeromq, gelf
* New filter plugins: mutate, dns, json
* New output plugins: zeromq, file
* The logstash agent now runs also in MRI 1.9.2 and above
This is a large release due to the longevity of the 1.1.0 betas.
We don't like long releases and will try to avoid this in the future.
IMPORTANT CHANGES FOR UPGRADES FROM 1.0.x
- grok filter: named_captures_only now defaults to true
This means simple patterns %{NUMBER} without any other name will
now not be included in the field set. You can revert to the old
behavior by setting 'named_captures_only => false' in your grok
filter config.
- grok filter: now uses Ruby's regular expression engine
The previous engine was PCRE. It is now Oniguruma (Ruby). Their
syntaxes are quite similar, but it is something to be aware of.
- elasticsearch library upgraded to 0.18.7
This means you will need to upgrade your elasticsearch servers,
if any, to the this version: 0.18.7
- AMQP parameters and usage have changed for the better. You might
find that your old (1.0.x) AMQP logstash configs do not work.
If so, please consult the documentation for that plugin to find
the new names of the parameters.
general
- feature: [LOGSTASH-158] - MRI-1.9 compatible (except for some
plugins/functions which will throw a compatibility exception) This means
you can use most of the logstash agent under standard ruby.
- feature: [LOGSTASH-118] - logstash version output (--version or -V for
agent)
- feature: all plugins now have a 'plugin status' indicating the expectation
of stability, successful deployment, and rate of code change. If you
use an unstable plugin, you will now see a warning message on startup.
- bugfix: AMQP overhaul (input & output), please see docs for updated
config parameters.
- bugfix: [LOGSTASH-162,177,196] make sure plugin-contained global actions
happen serially across all plugins (with a mutex)
- bugfix: [LOGSTASH-286] - logstash agent should not truncate logfile on
startup
- misc: [LOGSTASH-160] - now use gnu make instead of rake.
- misc: now using cabin library for all internal logging
- test: use minitest
- upgrade: now using jruby in 1.9 mode
inputs
- feature: zeromq input. Requires you have libzmq installed on your system.
- feature, bugfix: [LOGSTASH-40,65,234,296]: much smarter file watching for
file inputs. now supports globs, keeps state between runs, can handle
truncate, log rotation, etc. no more inotify is required, either (file
input now works on all platforms)
- feature: [LOGSTASH-172,201] - syslog input accepts ISO8601 timestamps
- feature: [LOGSTASH-159] - TCP input lets you configure what identifies
an input stream to the multiline filter (unique per host, or connection)
- feature: [LOGSTASH-168] - add new GELF input plugin
- bugfix: [LOGSTASH-8,233] - fix stomp input
- bugfix: [LOGSTASH-136,142] - file input should behave better with log rotations
- bugfix: [LOGSTASH-249] - Input syslog force facility type to be an integer
- bugfix: [LOGSTASH-317] - fix file input not to crash when a file
is unreadable
filters
- feature: [LOGSTASH-66,150]: libgrok re-written in pure ruby (no more
FFI / external libgrok.so dependency!)
- feature: [LOGSTASH-292,316] - Filters should run on all events if no condition
is applied (type, etc).
- feature: [LOGSTASH-292,316] - Filters can now act on specific tags (or sets
of tags).
- bugfix: [LOGSTASH-285] - for grok, add 'keep_empty_captures' setting to
allow dropping of empty captures. This is true by default.
- feature: [LOGSTASH-219] - support parsing unix epoch times
- feature: [LOGSTASH-207] - new filter to parse a field as json merging it
into the event.
- feature: [LOGSTASH-267,254] - add DNS filter for doing forward or
reverse DNS on an event field
- feature: [LOGSTASH-57] - add mutate filter to help with manipulating
event field content and type
outputs
- feature: zeromq output. Requires you have libzmq installed on your system.
- feature: new file output plugin
- bugfix: [LOGSTASH-307] embedded elasticsearch now acts as a full ES server;
previously embedded was only accessible from within the logstash process.
- bugfix: [LOGSTASH-302] - logstash's log level (-v, -vv flags) now control
the log output from the elasticsearch client via log4j.
- bugfix: many gelf output enhancements and bugfixes
- feature: [LOGSTASH-281] - add https support to loggly output
- bugfix: [LOGSTASH-167] - limit number of in-flight requests to the
elasticsearch node to avoid creating too many threads (one thread per
pending write request)
- bugfix: [LOGSTASH-181] - output/statsd: set sender properly
- bugfix: [LOGSTASH-173] - GELF output can throw an exception during gelf notify
- bugfix: [LOGSTASH-182] - grep filter should act on all events if no type is
specified.
- bugfix: [LOGSTASH-309] - file output can now write to named pipes (fifo)