v1.4.0

Added

• Event validation (--assert) - Validate log events against user-defined conditions. Helps ensure data quality and catch unexpected patterns during log analysis. Fails with exit code 1 if any event violates the assertion.

• track_cardinality() function - Probabilistic cardinality estimation using the HyperLogLog algorithm. Estimates unique counts with ~1% standard error using only ~12KB of memory, regardless of cardinality. Ideal for high-cardinality data (millions of unique IPs, sessions, etc.) where track_unique() would consume too much memory.

  • track_cardinality(key, value) - Track with default ~1% error rate
  • track_cardinality(key, value, error_rate) - Track with custom error rate (0.001-0.26)
  • Output uses ≈ prefix to indicate approximate values
  • Works correctly in parallel mode with proper merge support

Changed

• Config expansion information now displayed at startup for better visibility into which config files are loaded
• Documentation: Clarified that --levels accepts comma-separated values vs multiple flag invocations, with runtime hint for consecutive flags

Fixed

• Removed truncation of Drain sample output for more complete template samples
• Dependencies: Updated lru to 0.16.3

What's Changed

• fix: remove truncation of Drain sample output by @dloss in #114
• fix: allow --drain with multi-key aliases using -K exclusions by @dloss in #116
• feat: add track_cardinality() function using HyperLogLog by @dloss in #117
• Bump lru from 0.16.2 to 0.16.3 by @dependabot[bot] in #118
• Add smart log analysis for command suggestions by @dloss in #115

New Contributors

• @dependabot[bot] made their first contribution in #118

Full Changelog: v1.3.2...v1.4.0