v0.8.10-beta

What's New in v0.8.10-beta

This release adds universal multiline log merging — a two-layer defense that reassembles fragmented Docker container logs and other multi-line messages into complete events.

New: Application-Level Multiline Merging

• Fluent Bit Multiline Parser — New docker_app_multiline parser detects new log entries by their prefix (bracketed tags like [INFO], uppercase levels, timestamps, JSON objects) and merges everything else as continuation lines. Prevents applications that format arrays, objects, or stack traces across multiple lines from producing fragmented events.
• Universal Backend Fragment Detection — Expanded isFragment() heuristic in the backend's multiline reassembly module with new patterns:
  • Quoted data-structure elements ('paxcounter' ], "enabled": true,)
  • Quoted key-value pairs ("key": value)
  • Short lines ending with trailing commas
  • List/diff/separator prefixes (# - + ~ | *)
  • Works for ALL log sources (syslog, Docker, OTLP), not just Docker
• Defense-in-Depth — Fluent Bit catches most cases at the collector layer; the backend catches anything that slips through (cross-batch splits, non-Docker sources, whitespace-stripped fragments)

Discovery Improvements

• Suggestion Suppression — The auto-discovery engine now skips groups already covered by specific (non-catch-all) log sources. Stale suggestions and buffer entries are automatically cleaned up.
• Card-Based UI Redesign — Discovered sources panel uses a cleaner card layout with editable names, event count badges, metadata tags, and organized action buttons.
• Standardized Date Format — All dates in the discovery panel now use DD-MM-YYYY HH:MM:SS format.

Bug Fixes

• Ack All Events/Findings Not Refreshing — Both bulk acknowledgment buttons now refresh criterion groups, meta-analysis summary, findings list, and parent system scores after completion, matching per-group ack behavior.
• Discovery Suggesting Covered Sources — The grouping engine no longer creates suggestions for hosts/IPs already matched by existing specific log sources.
• Score Bars Not Updating After Ack/Unack — Backend event acknowledgment endpoints now run recalcEffectiveScores synchronously before sending the HTTP response, ensuring the frontend receives up-to-date scores on its subsequent refresh.
• Single Finding Ack/Reopen Not Refreshing Scores — handleAcknowledge and handleReopen in the drill-down now call onRefreshSystem so dashboard score bars update after acknowledging or reopening an individual finding.
• Audit Log Page Zero Bug — fetchAuditLog used falsy checks for page and limit params, silently dropping page=0 or limit=0 values. Now uses strict !== undefined checks.
• Multiline Comment/Code Mismatch — isFragment JSDoc incorrectly documented "comma or semicolon" detection but only checked for trailing commas. Comment corrected.
• Finding Transition Writing Non-Existent Column — transitionFindingsOnAck tried to set updated_at on the findings table, which has no such column, causing a PostgreSQL error on every event acknowledgment that matched open findings. Replaced with the correct acknowledged_at and acknowledged_by columns.

Full Changelog

See CHANGELOG.md for complete details.