🚀 Features
Section titled “🚀 Features”Implement multi-field lookups for context implementations
Section titled “Implement multi-field lookups for context implementations”Mar 11, 2024 · @Dakostu · #3968
The enrich and lookup operators now support type extractors, concepts, and
comma-separated lists of fields as arguments to --field.
Add configurable pipelines
Section titled “Add configurable pipelines”We made it possible to set pipelines declaratively in the tenzir.yaml
configuration file.
Fix partial specialization of S3 configuration in URL
Section titled “Fix partial specialization of S3 configuration in URL”Mar 11, 2024 · @dominiklohmann · #4001
S3 access and secret keys can now be specified in the S3 plugin’s configuration file.
Introduce multi-arch Docker images
Section titled “Introduce multi-arch Docker images”Mar 6, 2024 · @dominiklohmann · #3989
The tenzir/tenzir and tenzir/tenzir-node Docker images now run natively on
arm64 in addition to amd64.
Allow using and, or, and not in expressions
Section titled “Allow using and, or, and not in expressions”Mar 5, 2024 · @dominiklohmann · #3993
The where operator now supports using and, or, and not as alternatives
to &&, ||, and ! in expressions.
🔧 Changes
Section titled “🔧 Changes”Improve metrics collection
Section titled “Improve metrics collection”Feb 26, 2024 · @dominiklohmann · #3982
Nodes now collect CPU, disk, memory, and process metrics every second instead of
every ten seconds, improving the usability of metrics with the chart operator.
Memory metrics now work as expected on macOS.
Introduce the no-location-overrides option
Section titled “Introduce the no-location-overrides option”Feb 23, 2024 · @dominiklohmann · #3978
We’ve replaced the tenzir.allow-unsafe-pipelines option with the
tenzir.no-location-overrides option with an inverted default. The new option
is a less confusing default for new users and more accurately describes what the
option does, namely preventing operator locations to be overriden.
🐞 Bug Fixes
Section titled “🐞 Bug Fixes”Fix panic on parsing invalid syslog messages
Section titled “Fix panic on parsing invalid syslog messages”Mar 11, 2024 · @eliaskosunen · #4012
Parsing an invalid syslog message (using the schema syslog.unknown)
no longer causes a crash.
Fix crash in sigma operator for non-existent file
Section titled “Fix crash in sigma operator for non-existent file”Mar 11, 2024 · @dominiklohmann · #4010
The sigma operator sometimes crashed when pointed to a non-existent file or
directory. This no longer happens.
Fix partial specialization of S3 configuration in URL
Section titled “Fix partial specialization of S3 configuration in URL”Mar 11, 2024 · @dominiklohmann · #4001
The S3 connector no longer ignores the default credentials provider for the current user when any arguments are specified in the URI explicitly.
Prevent tcp socket inheritance to child processes
Section titled “Prevent tcp socket inheritance to child processes”We fixed a problem with the TCP connector that caused pipeline restarts on the
same port to fail if running shell or python operators were present.
Make remote python work
Section titled “Make remote python work”Mar 5, 2024 · @dominiklohmann · #3999
The python operator now works with when using the remote location override.
Fix a TOCTOU bug that caused the index to fail
Section titled “Fix a TOCTOU bug that caused the index to fail”Mar 4, 2024 · @dominiklohmann · #3994
Tenzir nodes sometimes failed when trying to canonicalize file system paths before opening them when the disk-monitor or compaction rotated them out. This is now handled gracefully.
Count nulls and absent values in top and rare
Section titled “Count nulls and absent values in top and rare”Feb 29, 2024 · @dominiklohmann · #3990
The top and rare operators now correctly count null and absent values.
Previously, they emitted a single event with a count of zero when any null or
absent values were included in the input.