Tenzir Node v4.29.0

Download the release on GitHub.

Features

Implement sub-duration functions

New functions years, months, weeks, days, hours, minutes, seconds, milliseconds, microseconds and nanoseconds convert a numeric value to the equivalent duration. Their counterpart count_* functions calculate how many units can the duration be broken into, i.e. duration / unit.

The abs function calculates the absolute value for a number or a duration.

By @raxyte in #4985.

Implement base option for int() and uint()

The new base option for int and uint functions allows parsing hexadecimal numbers in strings.

By @raxyte in #5006.

Implement some print_* functions

The write_xsv family of operators now accepts multi-character separators, instead of being restricted to a single character.

We added the write_kv operator, allowing you to write events as Key-Value pairs.

We added the functions any.print_json() and any.print_yaml() to print any value as a JSON or YAML string.

We added the functions record.print_kv(), record.print_csv(), record.print_ssv(), record.print_tsv() and record.print_xsv() to print records as the respective format.

By @IyeOnline in #5001.

Changes

Compact NDJSON output

The output of write_ndjson is now more compact and no longer includes unnecessary whitespace. Additionally, write_json no longer prints a trailing whitespace after each comma.

By @dominiklohmann in #5015.

Allow values to be null when charting

The chart_area, chart_bar, and chart_pie operators no longer reject null-values. Previously, gaps in charts were only supported for chart_line.

By @raxyte in #5009.

Implement some print_* functions

The sep argument on the flatten and unflatten functions is now a positional argument, allowing you to simply write record.flatten("-").

The unflatten option found on many read_* operators and parse_* functions is now called unflatten_separator.

The field_sep, list_sep and null_value options on the XSV operators and functions (such as read_xsv, write_csv or parse_tsv) are now named arguments on all of them and are called field_separator, list_separator and null_value.

The field_split and list_split arguments for the read_kv operator and parse_kv function are now named arguments.

By @IyeOnline in #5001.

Bug Fixes

Add to_splunk to the ce binary packages

We now include the to_splunk operator in the Tenzir binary packages.

By @tobim in #5012.

Normalize pushed-up predicates in subscribe

We fixed an optimization bug that caused pipelines of the form subscribe <topic> | where <value> in <field> to evaluate the predicate <field> in <value> instead, returning incorrect results from the pipeline.

By @dominiklohmann in #5014.

Respect --color option in default implicit events sink

The implicit events sink of the tenzir binary now respects the --color=[always|never|auto] option and the NO_COLOR environment variable. Previously, color usage was only determined based on whether stdout had a TTY attached.

By @dominiklohmann in #5007.

Fix a crash in {parse,read}_grok for invalid patterns

The read_grok operator and parse_grok functions no longer crash when providing an invalid Grok expression.

By @dominiklohmann in #5018.

Fix compilation error handling inside if

A compilation error within an if statement no longer causes pipelines to crash.

By @jachris in #5011.

Remove type layering

We fixed a bug that caused type_id(this) to return inconsistent values for schemas with metadata attached, e.g., after assigning a schema name via @name = "new_name" or using operators like chart_line that add custom metadata to a schema for use of the Tenzir Platform. Unfortunately, this may cause charts or tables added to dashboards before Tenzir Platform v1.7 to break. To fix them, click on the action menu on the chart or table on the dashboard, click “Open in Explorer,” and re-add the chart or table to the dashboard. We are sorry about this inconvenience.

By @dominiklohmann in #5008.