v1.52.0

Released at 2026-07-16

Update note 1: the base Docker image has been changed from Alpine to distroless in order to reduce an attack surface (The distroless base image doesn't contain any executables contrary to the Alpine base image). For debugging VictoriaLogs containers in Kubernetes it is recommended to use kubectl debug.

Update note 2: VictoriaLogs no longer provides a Docker image for the linux/386 platform because the distroless base image doesn't support this platform. Executable files for linux/386 platform are still published at the VictoriaLogs releases page.

• SECURITY: upgrade Go builder from Go1.26.4 to Go1.26.5. See the list of issues addressed in Go1.26.5.

• FEATURE: switch base Docker image from Alpine to distroless for VictoriaLogs, vlagent and vlogscli. This reduces the image size and attack surface. See #1228.

• FEATURE: LogsQL: add json_array_concat pipe for joining JSON array items stored in the given log field into a string with the given delimiter. See #712.

• FEATURE: data ingestion: adjust _stream field value according to the actual log fields. This simplifies importing of previously modified VictoriaLogs-exported data. See #1122.

• FEATURE: vlagent: add -remoteWrite.basicAuth.usernameFile command-line flag for dynamically reloading basic auth username for the corresponding -remoteWrite.url from the given file. See operator#2371.

• FEATURE: web UI: improve hits chart tooltip timestamp display by hiding excessive precision. See #1533.

• FEATURE: web UI: add Quick start examples to autocomplete suggestions and show recent query history items alongside field and value suggestions. See #1498.

• FEATURE: web UI: persist query history in browser local storage and show the last run time for history items. See #1498.

• FEATURE: web UI: improve hits chart interval selector by using curated interval options and choosing a more suitable default step for the selected time range. See #1511.

• FEATURE: web UI: sync grouping in raw logs panel with Hits chart. Raw Logs are no longer grouped by _stream by default, and both panels now use the same Group by setting. See #1534.

• FEATURE: web UI: persist the selected auto-refresh interval in the URL. See #1310.

• BUGFIX: LogsQL: fix panic when using uniq_values() in the stats pipe in VictoriaLogs cluster when some vlstorage nodes return no values for the requested field while other vlstorage nodes return values for the same group. See #1383.

• BUGFIX: LogsQL: properly select the top N log entries in the json_values stats function with sort by (...) limit N when more than N logs match per group. Previously an arbitrary subset of the matching logs could be returned instead of the top N ones. The returned entries were correctly sorted, but they could be the wrong entries. See #1311.

• BUGFIX: syslog data ingestion: avoid stamping RFC3164 messages received right after the new year with the previous year (which could drop them under a short -retentionPeriod), and compute the year in -syslog.timezone instead of the server local timezone. See #1556.

• BUGFIX: LogsQL: fix field_names pipe not respecting hidden_fields_filters. Fields listed in hidden_fields_filters still appeared in field_names output, leaking their existence to the caller. See #1574.

• BUGFIX: LogsQL: fix a vlselect crash in cluster mode on some valid queries. This happened when a math pipe operand had the same name as a function (such as abs, round or floor), or when from was used as a separator in the split pipe. See #1518.

• BUGFIX: LogsQL: allow filter pipes without the filter prefix when the filter starts with a non-word token or the not keyword, such as ... | !foo, ... | {host="x"}, ... | >5, ... | =foo or ... | not foo. These were unintentionally rejected with unexpected pipe in v1.51.0. A non-word token (and the not operator) cannot clash with a pipe name, so it is unambiguously a filter. See #1522.

• BUGFIX: LogsQL: reject field* wildcards in the comma-separated (no parens) form of uniq, top and unroll pipes, consistently with their parens form, which already rejects wildcards. Previously a query such as uniq by foo* was accepted but could not be parsed back from its string representation. See #1487.

• BUGFIX: cluster version: vlstorage now returns the error and stops processing an /internal/select/* request when the request cannot be parsed, instead of continuing to handle it and writing the response twice.

• BUGFIX: cluster version: bump the internal protocol version for the delete endpoints, which switched to multipart encoding in v1.51.0 but kept the previous version. A version mismatch between vlselect and vlstorage for delete requests is now reported instead of silently mishandled. All cluster components must be upgraded together to use delete.

• BUGFIX: cluster version: avoid cannot connect to storage node at ...: EOF errors after vlselect or vlinsert was idle for more than 60 seconds. See #1440.

• BUGFIX: vlselect: respect -search.maxQueueDuration for queued requests. Previously, when the number of concurrent requests exceeded -search.maxConcurrentRequests, the extra requests could be queued for much longer than -search.maxQueueDuration (up to -search.maxQueryDuration) before being rejected, so a few slow queries could stall other requests for everyone. See #1554.

• BUGFIX: vlselect: properly register -vmalert.proxyURL as a secret flag. Previously, this flag was registered after logger initialization and printed in plaintext on application startup.

• BUGFIX: vlselect: return 502 Bad Gateway HTTP response code for incoming queries when one of the vlstorage nodes runs a VictoriaLogs version with an incompatible internal API instead of 400 Bad Request. This is consistent with the 502 Bad Gateway response returned when a vlstorage node is unavailable, and it allows building a proper failover scheme in high-availability setups. See these docs.

• BUGFIX: multi-level cluster setup: properly return 502 Bad Gateway HTTP response code when a vlselect node queries other vlselect nodes and the underlying vlstorage is unavailable, as described at high availability docs. This allows configuring proper failover schemes to a healthy cluster.

• BUGFIX: /select/tenant_ids: return tenant ids in a deterministic (sorted) order. Previously the order was random across requests. See #1575.

• BUGFIX: web UI: fix hits chart tooltip layout to prevent long values from overflowing the viewport. See #1536.

• BUGFIX: web UI: fix filters sidebar opening on mobile. See #1537.