v2.5.3

8th February 2021

Log Courier

• Fix lc-admin missing default configuration on RPM builds
• Fix lc-admin reporting unknown configuration options it should never be concerned with
• Fix lc-admin reporting log-courier-address as the address in errors

v2.5.2

7th February 2021

Log Courier / Log Carver

• Fix integer overflow preventing 32-bit compilation

v2.5.1

7th February 2021

Log Courier

• Restore backwards compatibility with v2.0.6 by removing ECS fields that were added in v2.5.0
• New configuration option to enable ECS fields: enable ecs
• ECS fields now also obey the corresponding add xxx configuration options

Log Courier / Log Carver

• Fix vendoring issue of a dependency that was blocking package builds
• No binary changes to Log Courier / Log Carver

v2.5.0

2.5.0

Log Courier

• Fix a few issues that could cause Log Courier to hang unnecessarily during shutdown
• Improvements to configuration parsing
• Optimised registrar to only write periodically and not constantly
• Buffers and compression streams are reused during event transmission to further reduce memory and garbage collection
• Rebuilt the transport layer to use less routines per connection and negotiate a new method of event transmission that uses less memory
• Rebuilt application initialisation to allow creation of separate binaries for different tasks running under the same pipelining principle and using similar transports (e.g. Log Carver)
• Add option to enable ECS (Elastic Common Schema) for the builtin fields such as host and file path
• Many more under-the-hood changes to make code more straight forward and to allow code sharing with Log Carver

Log Carver

• Initial beta release
• Can be used as a low memory/CPU substitute to Logstash for basic events
• Supported processor actions include: date, geoip, user_agent, kv, add_tag, remove_tag, set_field, unset_field
• The set_field action supports the Common Expression Language (CEL) for code-like expression support when setting fields
• If/ElseIf/Else support in the pipeline using Common Expression Language (CEL) for code-like conditional expressions
• Receives events over the Log Courier protocol from Log Courier clients
• New ES transport to allow events to be sent directly to Elasticsearch
• Templates embedded for ES6+ that will automatically be inserted as "logstash"
• It is recommended to use new indices and remove the "logstash" template from ES as fields are different and now follow ECS (Elastic Common Schema)
• Configuration documentation is minimal but a minimal example can be found in the docs/examples folder, more will be added in time

v2.0.6

9th May 2020

• Fix several issues when shutting down with outstanding payloads, to prevent hanging forever

v2.0.5

18th February 2017

• Fix -stdin run mode not being able to exit cleanly (#353)
• Fix address pool rotation so that the same connection address is used on every
  connection attempt
• Fix certificate problem notices showing invalid year values
• Fix end-to-end tests

View the full Change Log.

v2.0.4

11th June 2016

Log Courier

• Fix random recovery failure when Logstash is unavailable (#324)
• Fix systemd unit files User= declaration that does not support variables. In
  order to change the user that Log Courier runs as, edit the unit file directly
  after updating to 2.0.4 (#322)
• Fix max pending payloads exceeded when configuration is reloaded or when there
  are multiple Logstash connections and one of the connections recovers
• Fix service start failure after a reboot on systems where /var/run is tmpfs
  (#321)
• Fix shipping encoding error when configuration file is YAML and global fields
  or per-file declaration fields contain nested maps (#325)
• Add the ability to set the group that log-courier runs as

RPM Packaging

• Removed the dependency on ZeroMQ 3 as this was deprecated in 2.x of Log
  Courier

View the full Change Log.

v2.0.3

9th May 2016

• Fix issue where pending payload limit is exceeded when Logstash is overloaded
  (#315)
• Fix incorrect stale bytes count in API / lc-admin
• Fix the harvester status not updating correctly when reaching end of file in
  API / lc-admin
• Reintroduce full status command into lc-admin

View the full Change Log.

v2.0.2

8th May 2016

• Fix a rare hang when endpoint failure occurred (#314)
• Add a new debug command to the REST API and lc-admin tool which gives a
  live stack trace of the application (#315)

View the full Change Log.

v2.0.1

25th April 2016

• Fix lc-admin ignoring -config parameter and not auto-loading the default
  configuration in RPM and DEB packages (#303)
• Fix lc-admin numerical outputs such as file completion percentage showing as
  1.00e2 instead of 100 (#304)
• Fix hang that could occur when Logstash failed in loadbalance or failover
  network methods (#311)
• Fix admin listen address not having a default (#307)
• Improve documentation for lc-admin (#307)
• Improve debug logging of backoff calculations

View the full Change Log.