code_public/logcorrelator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
644d81d33ec284059f56156ea18b728a708def91
logcorrelator/CHANGELOG.md
Jacquin Antoine 514cb553ef feat: release v1.0.3 with flattened JSON output structure 
- breaking: remove apache and network subdivisions from JSON output
- feat: all log fields now merged into single-level JSON structure
- feat: custom MarshalJSON() implementation for flat output
- chore: update ClickHouse schema to use single fields JSON column
- docs: update CHANGELOG.md and README.md with v1.0.3 changes
- build: bump version to 1.0.3 in build.sh and RPM spec

Migration notes:
- Existing ClickHouse tables need schema migration to use fields JSON column
- Replace apache JSON and network JSON columns with fields JSON column

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
2026-02-28 22:26:20 +01:00

3.3 KiB
Raw Blame History

Changelog

All notable changes to logcorrelator are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.0.3] - 2026-02-28

Changed

  • Breaking: Flattened JSON output structure - removed apache and network subdivisions
  • All log fields are now merged into a single-level JSON structure for easier parsing
  • ClickHouse schema updated: replaced apache JSON and network JSON columns with single fields JSON column

Technical Details

  • Custom MarshalJSON() implementation flattens all fields at the root level
  • Backward compatibility: existing ClickHouse tables need schema migration to use fields JSON column

[1.0.2] - 2026-02-28

Fixed

  • Critical: Added missing ClickHouse driver dependency (github.com/ClickHouse/clickhouse-go/v2)
  • Critical: Fixed race condition in orchestrator - reduced from two goroutines to one per source
  • Security: Added explicit source_type configuration for Unix socket sources to prevent source detection spoofing

Changed

  • Unix socket sources now support explicit source_type field in configuration:
    • "A" or "apache" or "http" for Apache/HTTP logs
    • "B" or "network" or "net" for network logs
    • Empty string "" for automatic detection (backward compatible)
  • Updated example configuration (config.example.yml) with source_type documentation

Added

  • Comprehensive test suite improvements:
    • Added tests for source type detection (explicit + auto-detect fallback)
    • Added tests for config validation (duplicate names/paths, empty fields, ClickHouse settings)
    • Added tests for helper functions (getString, getInt, getInt64)
    • Added tests for port validation in JSON parsing
    • Added tests for MultiSink Flush/Close operations
    • Added tests for FileSink path validation and file operations
    • Added tests for CorrelationService buffer management and flush behavior
  • Test coverage improved from 50.6% to 62.0%
  • All tests now pass with race detector enabled

Technical Debt

  • Fixed unused variable in TestCorrelationService_FlushWithEvents
  • Added proper error handling for buffer overflow scenarios
  • Improved code documentation in configuration examples

[1.0.1] - 2026-02-28

Added

  • Initial RPM packaging support for Rocky Linux 8/9 and AlmaLinux 10
  • Docker multi-stage build pipeline
  • Hexagonal architecture implementation
  • Unix socket input sources (JSON line protocol)
  • File output sink (JSON lines)
  • ClickHouse output sink with batching and retry logic
  • MultiSink for fan-out to multiple destinations
  • Time-window based correlation on src_ip + src_port
  • Graceful shutdown with signal handling (SIGINT, SIGTERM)
  • Configuration validation with sensible defaults
  • Basic observability (structured logging to stderr)

Configuration

  • YAML-based configuration file
  • Support for multiple Unix socket inputs
  • Configurable time window for correlation
  • Orphan event policy (Apache always emit, Network drop)
  • ClickHouse batch size, flush interval, and buffer configuration

[1.0.0] - 2026-02-27

Added

  • Initial release
  • Core correlation engine
  • Basic HTTP and network log parsing
  • File-based output