Release Notes

The new Kloudfuse UI now opens by default. To switch to the legacy UI, click Switch to legacy UI in the user menu; each browser will remember the last setting.

Among other improvements:

A new configuration option allows keeping all dimensions for CloudWatch metrics received through Amazon Kinesis. So metrics for target groups registered for all availability zones are no longer dropped.

Storage servers write logs faster and use less memory. Queries also use less CPU and memory, most noticeably, with negative regular expressions (!~) and filters on recently ingested logs.

FuseQL can group, count, and filter logs by fingerprint hash. For example,

Metric queries cost less, most noticeably on clusters with heavy alert load. Alert range queries reuse results that have already been computed. Data that arrives late may not appear in an alert’s result immediately.

New metric data, including rollups, is stored more compactly, so it uses less storage. Existing data keeps its earlier layout. Before you upgrade, see Increase Real-Time Storage Server Heap.

Metrics are rolled can be computed with two resolutions, 5 and 30 minutes. A retention policy can be configured separately for each resolution. See Configure metrics rollup.

A metric shaping rule can apply only to series that match label filters, so you can shape one noisy source without touching the others. See Metric Shaping Rules.

In the new Kloudfuse UI, Metric Usage can be filtered by label, and its details panel shows each metric’s series count and the folders of the dashboards and alerts that use it.

The archive writer no longer lets slow uploads hold up archiving and only stops failing archives when uploads are continuously failing. It can hold more data on its volume while uploads are slow, so you may need more free space for archive writer volumes. Before you upgrade, see Archive Bucket Permissions.

Both UIs show each archive’s priority and flag archives that receive no logs because a higher-priority archive takes them. To fix, change the archive order; see Change evaluation priority.

In the new Kloudfuse UI, hydration jobs show their progress as a percentage, and the Hydration page lists the archives you can hydrate.

Agent Observability is a preview for monitoring AI agents and LLM applications, available in the new Kloudfuse UI under Agents. Send OpenTelemetry GenAI spans to https://<kloudfuse-hostname>/ingester/otlp/v1/genai to see sessions, traces, transcripts, agent graphs, token use, and cost, and to score live traffic with LLM-judge evaluations. Evaluations and playground runs call your own LLM provider account.

kubectl -n <namespace> create secret generic agent-query-service-credential-key \
  --from-literal=credential-key="$(openssl rand -base64 32)"

bashCopied!

global:
  agentic:
    enabled: true
agent-query-service:
  credentialKey:
    secretName: agent-query-service-credential-key

yamlCopied!

The data store updates query routing incrementally and does less work when committing and moving data. This lowers CPU and memory usage on large clusters.

The control-plane dashboards are refreshed. The ingester_events_dropped metric is now ingester_events_dropped_count, with agent_type and reason labels; update any dashboards or alerts of your own that use this metric.

Pinot realtime servers of the main Pinot instance now commit in-progress segments when they stop gracefully, during a rolling upgrade, a restart, or a node drain, so they resume from committed data instead of re-reading it from the ingest stream. In Release 4.3.0, this setting was off by default. Pods can now take up to 5 more minutes to terminate. Isolated Pinot instances, such as pinot-logs, still default to disabled. To keep it disabled, see Disable Pinot Graceful Termination.

Query memory protection, introduced in Release 4.3.0, is now enforced by default on the storage servers and query brokers. A query that allocates too much heap memory or holds too much direct memory is stopped with a resource-limit error, before it can run the server out of memory and disrupt other queries. When memory use on a server becomes critical, the query using the most memory is stopped first. Narrow the time range or add filters to rerun a stopped query. To keep the earlier behavior, see Query Memory Protection Is Enforced by Default.

Performance logs, which power the Expensive Queries dashboard and Metric Usage query counts, are enabled by default. To keep them disabled, see Performance Logs Are Enabled by Default.

The bundled Grafana no longer runs Grafana-managed recording rules by default; recording rules defined in Kloudfuse are not affected.

The Kloudfuse MCP server adds event label and facet tools, query guidance for agents, and grouping by fingerprint in query_logs. See MCP Server Tools.

In the existing UI, you can download a dashboard as a PDF from its Actions menu. See Download Dashboard PDF.

This release refreshes base images across platform components to the latest RHEL 9.8 errata and updates libraries to address security vulnerabilities (CVEs). For the full list of fixed and outstanding CVEs, see Security Advisories — 4.4.0.

A completely rebuilt Kloudfuse user interface ships in this release, available to every deployment at the /f path with no configuration required. The existing UI remains the default experience; each user can switch to the new UI individually, and the choice is remembered in the browser. The new UI unifies design, navigation, and behavior across all screens. Highlights, by area:

Alert details and the alert editors now show a notification routing preview — which contact points an alert will actually deliver to, including those set through simplified routing — so you can confirm where an alert lands before you save it. The contact points page adds a policy health check and shows each contact point’s delivery status. See Notification Routing Preview for per-alert routing, and Policy health and delivery status for the contact points page.

You can now federate multiple Kloudfuse clusters: create a federation, join or remove clusters, and disband it, with membership changes propagating to every cluster live and all federation actions audit logged. Signed-in users switch between federated clusters with the cluster switcher in the new Kloudfuse UI header. See Federation.

A new Metric Usage screen in the new Kloudfuse UI shows where each metric is actually used — in dashboards, alerts, SLOs, recording rules, derived metrics, and shaping rules — along with when each was last queried. Use it to find unused or stale metrics before shaping or dropping them, and to see what a change would affect before you make it. See Metrics Usage.

In the existing UI, the drop preview shown when creating a metric shaping rule now reports series cardinality and system cardinality separately, instead of one combined reduction number.

How incoming log payloads from each agent are normalized — which fields become the message, timestamp, source, and labels — can now be managed from the Logs Remap page in the new Kloudfuse UI. Per-agent defaults cover Datadog, OpenTelemetry, Fluent Bit, Fluentd, Filebeat, Google Cloud, and Amazon Kinesis, and a live preview shows the effect of a change on recently ingested data before you apply it; changes take effect without restarts. Editing is enabled on the Logs Remap page when global.logs.remap.configDb.enabled is true; it is false by default. See Logs Remap, and Log Parsing Configuration for how normalized data then flows through the parsing pipeline.

ConfigMap, StorageClass, IngressClass, and Gateway API objects (Gateway, GatewayClass, and HTTPRoute) — collected since 4.2.2 — are now visible in the Infrastructure explorer. They are collected only by the OpenTelemetry Collector’s Kubernetes objects receiver; add them to its object list as described in Kubernetes Infrastructure Objects.

Archiving remains opt-in. When you enable it, archives are now written by the revamped archive writer introduced in 4.2.0, directly from ingest, with lower lag and memory use than the previous archiver. Each archive’s compression format is configurable (zstd, gzip, tar, or tar.gz). Archives are managed from the Archives screen in the new Kloudfuse UI or through a REST API. See Configuring Log Archives for the Archives screen, Archiving Logs and Hydration for archiving, and Hydrate From Archive for hydration.

When RBAC is enabled, changing archives — creating, editing, starting, stopping, or deleting them — and starting, pausing, resuming, or cancelling hydration jobs now require the Admin role; users with other roles receive a permission error. Listing archives and hydration jobs and viewing job progress remain available to every user, and each change attempt is recorded when audit logging is enabled.

Grep-style searches over the log line are faster in this release.

Term search now splits log lines on every non-alphanumeric character and no longer removes stop words. Sub-parts of dotted names, paths, IP addresses, and underscore-joined identifiers are searchable on their own — scheduler now matches com.example.scheduler.Job, and timeout now matches connection_timeout. Logs indexed before the upgrade keep the previous tokenization until they age out of your retention window. See Logs Search Syntax.

Building on the query memory fixes shipped in 4.2.4, additional off-heap buffers used while scanning log segments are now freed as soon as each segment’s scan finishes instead of waiting for garbage collection, and filtering on recent data is faster — reducing memory pressure and tail latency on busy clusters.

A new end-to-end ingestion delay metric reports, per table and partition, how long data takes from arrival at Kloudfuse until it is indexed and queryable, with percentiles suitable for a freshness SLI and alerting. It is the recommended freshness signal, more accurate than the existing freshness-lag metric, which remains available. The delay is measured at a single point on one clock, idle partitions correctly report near-zero delay, and data replayed after a restart no longer inflates the reported delay, while genuine backlog after an outage is reported at its true age. Companion metrics count partitions that have no consuming segment, and for how long, so stuck ingestion is distinguishable from catch-up after a restart.

The built-in control-plane monitoring dashboards are reworked around the new metric, with per-signal ingest and query sections, ingestion delay panels per signal and per table, segment seal duration and phase breakdown panels, and standardized latency panels across the query APIs. The query API latency metrics behind those panels are updated as well: samples are now labeled with the specific API, the requesting view (an explicit view name, or the alert, dashboard, or service-account origin), and the error outcome — whether the call failed, and a bounded error type such as TIMEOUT or BAD_REQUEST — so latency and error rates can be broken down by API and caller. In addition, the emitted Prometheus histogram buckets are re-spaced — roughly log-scale from 50 ms up to the 180-second query-timeout ceiling — for more accurate latency percentiles at query timescales. If you built your own dashboards or alerts on the query_service_api_query_latency_ms histogram, review them after the upgrade for the new api_name, view_name, error, and error_type labels and the changed bucket boundaries.

Pinot realtime servers can now optionally commit in-progress data segments during a graceful stop — a rolling upgrade, restart, or node drain — so that on restart they resume from committed data instead of re-indexing it from the ingest stream. The setting is disabled by default; see Pinot Graceful Termination for how it works and how to enable it.

Completed storage segments can now be merged into larger ones by an on-demand (or optionally scheduled) background task, reducing per-segment planning and metadata overhead. See Segment Merge Architecture for how it works, and Configure Segment Merge for how to schedule or trigger merges.

Each query’s memory use is now tracked synchronously while it runs; when enforcement is enabled, a query that exceeds its budget is stopped immediately with a clear resource-limit error instead of destabilizing the platform. Enforcement is disabled by default and can be enabled per deployment. It complements the Blocked query priority, which denies queries from a user, team, or service account and is available by default regardless of which query scheduler is active — see The Blocked Sentinel and Query Interleaving.

All query APIs — metrics, logs, traces, events, RUM, and LLM — now share one error contract, expressed in each API’s own wire format. REST calls return a meaningful HTTP status with a JSON body naming the error class (such as BAD_REQUEST, NOT_FOUND, RESOURCE_EXHAUSTED, or TIMEOUT), the message and remediation text, and, when available, a request ID. GraphQL queries and mutations return HTTP 200 and report the same error class and message in the standard errors field; subscriptions, which run over a WebSocket, carry the same errors payload without an HTTP status. See API Response Codes.

Every query service now writes performance logs in one schema, so a single query answers volume, latency, and error questions across metrics, logs, traces, events, RUM, and LLM alike. A request ID ties each call’s lines together and to the queries it ran, and REST error responses return the same ID when one is available, so a failure can be traced back to its log entry. See Performance Log Fields.

The Kloudfuse MCP server adds a get_log_context tool that returns the raw lines surrounding a given log line. get_dashboard_panel_queries now matches a case-insensitive regular expression against row titles as well as panel titles, and returns panels grouped by row. Tool descriptions are rewritten with example-first guidance. See MCP Server Tools and Toolsets.

This release addresses a number of security vulnerabilities (CVEs) across platform components and base images. For the full list of fixed and outstanding CVEs, see Security Advisories — 4.3.0.

Kloudfuse now applies the query timeout you configure to the whole request, across the metrics, logs, events, traces, and RUM query APIs. Several endpoints previously ran with no overall deadline at all, and a timeout larger than your configured ceiling was not capped, so a query could run well past the timeout you expected. The default timeouts have changed, so review the ones you rely on for scheduled queries and alerts.

Alert queries now stop at the alert evaluation timeout. After this timeout is reached, alert evaluation is abandoned. Set it with global.alert.evaluationTimeout in your custom-values.yaml:

global:
  alert:
    evaluationTimeout: 50s

yamlCopied!

Query execution and data loading use less memory, most noticeably Java heap in Pinot servers for logs, metrics, and trace queries.

Query interleaving, enabled by default since 4.1, is now disabled by default. To enable it, set the segment-level scheduler in your custom-values.yaml:

global:
  queryScheduler:
    name: segment_level

yamlCopied!

Kloudfuse enriches telemetry with EC2 capacity reservation tags, and enriches metrics from the CloudWatch ContainerInsights namespace.

Kloudfuse distinguishes OTLP JSON from OTLP protobuf when it records how telemetry was received, so you can see which ingestion formats are in use.

The logs, metrics, and trace transformers use static partition assignment, which spreads work more evenly across their pods and lets a stalled partition be recovered automatically. This requires a pre-upgrade step; see Upgrade to 4.2.4.

This release addresses a number of security vulnerabilities (CVEs) across platform components and base images.

The metrics, logs, traces, events, and RUM query services now return user-friendly error messages for common failures instead of raw internal exceptions.

We optimized file deletion in the Pinot controller so that heavy segment cleanup no longer risks running the controller out of memory. Asynchronous temp-file deletion is now enabled by default.

Log searches over data with many facets could drive offline servers out of memory. These searches now use significantly less memory and release it promptly, so offline servers remain stable under heavy log search load.

Facet filters on log scheduled views are now faster and use less memory. The contains, starts_with, and ends_with operators also now work in these filters, where they previously returned an error.

A grep search combined with other filters made log aggregations run orders of magnitude slower than the same query without it, even when both returned the same results. Aggregations such as count, grouped count, distinct, and minimum or maximum are now substantially faster in this case.

Query operators now sample allocated memory periodically to improve OOM diagnosis, and broker and server logs report allocated memory alongside other memory statistics.

LogsV2 export no longer drops rows across pages, and the editor-mode fingerprint filter supports both include and exclude selection.

The LogsV2 timeline Total now counts events in the exact selected window instead of a wider range.

We fixed a LogsV2 sort clause that referenced the wrong FuseQL timestamp field name, so timestamp sorts now return results in the expected order.

We restored the search box on the span names table in the service detail view.

Long error toast messages are now truncated behind a Show more toggle so they no longer overlap other UI.

When the metrics chart on the alert detail page fails to load, an inline error message now appears in place of a silent empty chart.

The GCP Pub/Sub integration supports multiple subscriptions.

FuseQL adds a fillmissing operator that fills gaps in query results. You can generate missing time buckets with timeslice, or missing label values with values(…​) or values all, and supply per-field defaults with with <value> for <field>.

Azure metrics collection is now opt-in per resource type: you select the Azure resource types to scrape from a Kloudfuse-maintained catalog in your values YAML, and add a custom section to define scrape jobs for resource types not yet in the catalog.

Kloudfuse now collects ConfigMap, StorageClass, IngressClass, Gateway, GatewayClass, and HTTPRoute objects. ConfigMap is queryable through the MCP infrastructure tools; it is not yet surfaced in the Kubernetes UI.

FuseQL log querying is now the default logs experience in the MCP server, replacing the LogQL search_logs tool on the default tool surface. FuseQL language documentation is also served through MCP.

The MCP server adds get_apm_service_nodes, which returns the Kubernetes nodes that served traffic for an APM service over a time window, and search_log_fingerprints, which searches log fingerprints and their patterns.

The query_prometheus, search_prometheus_label_names, and search_prometheus_label_values tools return parsed objects rather than encoded strings, removing a decoding step for clients.

You can now reduce a high-cardinality metric’s series count by aggregating it down to the labels you actually query, and store the result as a new recorded metric. Dashboards and alerts read the smaller shaped metric instead of the full-cardinality metric, so they run faster and cost less. The original metric is always dropped.

You can now precompute a PromQL expression on a fixed interval and store the result as a brand-new metric that dashboards and alerts can query directly. Expensive aggregations and histogram percentiles become cheap to read, and the original source series are always preserved.

A new, improved, and unified Logs experience, now enabled by default, that resolves the minor issues and inconsistencies in the previous Logs experience for a more consistent and reliable workflow.

Save a log query and run it automatically on a planned schedule, with results delivered as an email or written to a lookup table. Email delivery includes a preview of the result table and attaches the full results as a CSV; lookup-table delivery can either merge with the existing table or replace it completely. Results are delivered at each scheduled tick when the configured conditions or thresholds are met. Scheduled searches follow folder RBAC rules, so anyone with the appropriate folder permissions can create, edit, delete, pause, and resume them.

We have improved query scheduling, first introduced in 4.1.0. A new blocked query priority lets administrators fully deny queries from a specific user, group, or service account; blocked queries are rejected instead of being delayed or queued. Query scheduling now round-robins across distinct callers within each priority tier, so a single noisy user can no longer crowd out others at the same priority.

A new high-performance and scalable archive writer is now available. It can be turned on or off as needed for your deployment.

The Metrics Summary view can now be opened directly in the Metrics Explorer, with iconified header controls, an overall cardinality indicator, and a Clear filters action.

Dashboard PDF export now uses canvas-native rendering for higher-fidelity output and consistent layout across panels.

Table headers in query results now expose a tooltip and copy button so column names can be copied to the clipboard.

Administrators can now create, view, label, and manage auth keys directly from the UI, with new auth-key APIs and label support across the backend. Auth-key expiration is interpreted as local end-of-day with the active timezone shown alongside the value. See Ingestion Authentication with API Key.

Pinot segment workers now continuously pull and process individual segments from a shared scheduler instead of being dedicated to a single query for its full lifetime. Work from concurrent queries is interleaved across the worker pool, so small queries no longer wait behind large queries' segment scans. Enabled by default in 4.1.0; see Query Interleaving.

Per-user and per-service-account query priorities can now be configured from the admin UI, with priority and timeout APIs available for users and service accounts. Priority is propagated end-to-end into the query path so high-priority workloads are scheduled ahead of background queries. See Query Priorities.

Traces and RUM events are now linked end-to-end. New tabs surface RUM and Trace context side by side, an optional column lists resources that have associated traces, and the ingester recognizes the latest browser SDK trace headers so the linkage works for newly captured sessions. See Connect RUM and Traces.

The Kloudfuse MCP server gains per-connection toolset selection (via ?toolsets=), a redesigned alerts toolset, typed Pydantic filters across logs, events, infrastructure, RUM, and APM tools, a docs search and retrieval toolset, and a verb-first naming convention across all tools. A Prometheus /metrics endpoint and scrape annotations make the server self-observable.

A new top-level umbrella flag (default true) controls whether per-service GraphQL playground UIs are exposed at /debug/<service>/playground. Disable the flag in custom-values.yaml for hardened or production deployments where the playgrounds should not be reachable:

global:
  EnableDebugPlayground: false

yamlCopied!

A major refresh of the logs experience, with a redesigned logs tab, a FuseQL-powered logs API across the platform, and a refreshed analytics surface. Logs V2 is available as an experimental experience in 4.1.0 and can be enabled on request — contact Kloudfuse support to opt your tenant in.

FuseQL now supports a topk operator, math expressions inside if(…​) value branches, and _view references in where and if predicates.

Pinot servers now preload segment metadata 2.6–2.8× faster using a native properties parser, reducing restart and rolling-upgrade time on servers with tens of thousands of segments.

Added a new parseDate(dateString, pattern[, timezone]) FuseQL function that converts date strings to epoch milliseconds. The function is pushed down to Pinot when supported, with a Go-evaluator fallback for ISO 8601 offset patterns. Defaults to UTC when a timezone is not specified.

Fixed a crash in the log query service when running certain types of queries.

Fixed a crash when previewing lookup table results.

Fixed the concat() function in FuseQL to correctly concatenate string values.

Fixed an issue where anomaly forecast bounds were not displayed in the Metrics Explorer when querying a metric without an aggregation function.

Fixed an issue where the Metrics Explorer did not display query statistics when using formula-only queries.

Fixed an issue where the contact points configuration table did not scroll properly when a contact point had many email recipients.

Fixed an issue where the trace heatmap did not render.

OpenTelemetry Collectors can now be configured with a single HTTP endpoint instead of requiring separate endpoint URLs for metrics, traces, and logs.

Upgraded the ingester service from AWS SDK v1 to v2 to address CVE-2020-8911 and CVE-2020-8912.

Every ingested log line now receives a unique identifier at ingestion time, regardless of agent type or ingestion source. Log IDs enable deterministic sorting and consistent ordering of log results.

Log query results can now be sorted by any column, including timestamp and extracted facets. In the query builder, click any column header to sort. In FuseQL mode, use the sort by clause. Sorting works in the logs list view, analytics table, and dashboard log panels. The selected sort order is preserved when switching between query builder and FuseQL editor modes, when saving queries to dashboards, and when creating alerts. FuseQL queries with sort by before aggregation operators are now also supported.

Log downloads now respect the selected sort order, ensuring exported data matches what is displayed in the UI.

Custom columns added in the query builder or via FuseQL column extraction now persist when switching between modes, and are no longer lost on sort or date range changes.

Kloudfuse now supports Envoy Gateway with the Kubernetes Gateway API as an alternative ingress controller to NGINX Ingress. A zero-downtime 3-step migration path is available for existing deployments. See Configure Envoy Ingress for the installation and migration guide.

Archived logs now include Log IDs and are stored in a new format. This data will be written to the v2 object key instead of the v1 object key.

Log hydration is significantly faster with parallel processing. Multiple concurrent hydration jobs are now supported, jobs can be paused and resumed, and jobs gracefully handle schema changes across time ranges instead of failing. Note that this is only applicable to V2 archives. For V1 archives, hydration will still follow a sequential rehydration process.

The underlying data layout has been significantly optimized for faster filtering and aggregation, especially for queries spanning long time ranges.

The SLO detail page now displays creation date, modification date, and version number.

SLO alerts now include history and versions tabs.

Dashboard table panels now persist the selected sort order across page reloads and dashboard saves.

Stat panels now support custom font sizes and display correct units.

Dashboards now support updating the default time range.

Trace list panels in dashboards now support template variable filtering.

Alert creation now enforces a minimum step interval based on the datasource.

Alerts on logs, traces, and other non-metric datasources now support configurable evaluation frequency.

All services now use FIPS 140-3 validated cryptographic modules for encryption. This release completes FIPS compliance by integrating validated cryptographic libraries across all services and enabling FIPS crypto policy at the operating system level.

All container images have been migrated to Red Hat UBI9-minimal base images and STIG hardened, enabling deployment in regulated environments.

Grafana has been upgraded to v12.4.1 with security fixes and improved compatibility.

Fixed an issue where newly created scheduled views were sometimes not evaluated until the service was restarted.

Fixed a regression where confirmation dialogs (such as adding a user to a folder) were hidden behind the side panel overlay.

Fixed an issue where dashboard charts did not properly display errors on the first query failure.

Fixed an issue where dashboard template variables were not updating when the date range was changed.

Fixed an issue where chained dashboard template variables were not updating dependent filters when a parent filter was changed.

Fixed an issue where dashboard text filter inputs would revert to their previous value when attempting to edit or clear them.

Fixed an issue where scrolling within a Logs dashboard panel moved the entire browser window instead of scrolling within the panel.

Fixed an issue where template variable values were not properly escaped in FuseQL queries.

Fixed a regression where trace sidebar labels were all grouped under "custom" instead of being organized by prefix (e.g., http, kubernetes).

Fixed an issue where searching by Trace ID in the Grafana UI failed to display trace details.

Fixed metrics query performance issues by leveraging rollup to reduce query latency.

Fixed unbounded memory growth in the logs parser service in environments with frequent node recycling, which could lead to out-of-memory conditions over time.

Fixed an issue where PostgreSQL max_connections was reset to the default value of 100 during upgrades, potentially causing connection exhaustion under load.

New unified interface for exploring metrics, labels, and their relationships. Combines metric discovery, label analysis, and cardinality investigation in a single workflow. Supports progressive filtering with promoted label filters and optional series count display for identifying high-cardinality issues. See Metrics Cardinality Explorer.

Metrics rollup tables now support multiple resolutions. Queries automatically select the appropriate rollup resolution and backfill gaps from the raw table, improving query completeness for long time ranges.

Metrics queries with high cardinality label combinations now use less memory and complete faster. Series limits are enforced at all processing stages, preventing out-of-memory failures on high-cardinality queries.

Large range queries automatically split based on series count, avoiding series limit errors on high-cardinality metrics.

SLO metrics are now computed at query time from raw data, improving accuracy and eliminating the need for recording rules.

SLOs now support configurable time windows (7-day and 30-day). The SLO list page shows a new Time column, and the detail page automatically scales lookback windows and graph step sizes to match the configured period.

Trace queries now show documents scanned and total documents during execution, matching the existing logs query stats experience.

Traces, trace errors, and trace analytics now load progressively via streaming, showing partial results as they arrive. Long-running trace queries can be cancelled from the UI. Streaming is also supported in dashboard panels and alert evaluation views.

Query and compare application performance profiles via MCP for AI-assisted performance analysis. Includes tools for discovering profile types, retrieving flame graphs, querying time series, and comparing profiles across time ranges.

PromQL and LogQL queries are validated before execution in safe mode, rejecting bare metric selectors without label filters, excessive lookback/step ratios, and queries that would produce too many data points.

MCP server can be scaled horizontally behind a load balancer for higher availability.

All MCP tool invocations and outbound API calls are logged with duration and error information for compliance and troubleshooting.

All services now run as non-root users by default and support configurable service accounts and security context via Helm values for tighter security posture.

Audit log entries now use the time the event occurred rather than ingestion time, ensuring accurate timelines even when there is ingestion delay.

Pinot servers now preload all segments before becoming available, reducing restart time and eliminating excessive coordination overhead during rolling upgrades.

Fixed double-escaping of alert queries that caused evaluation failures for alerts containing special characters. Existing alerts are automatically normalized when loaded.

Alerts now support managed notification policies with multiple contact points. Configure grouped notification routing to send alerts to different contact points based on alert labels and routing rules.

Alerts created from the Kloudfuse UI can no longer be modified from Grafana, preventing unintended changes to alert configurations managed through Kloudfuse.

Restored compatibility with the latest Grafana Tempo plugin for trace tag autocomplete and query building.

Added support for custom facets scoped to specific applications, allowing per-application facet configuration.

Added support for custom metrics in RUM for tracking web vitals such as LCP, FCP, and INP, with time series aggregation, filtering, and event detail views.

Standardized the main RUM page layout with consistent header, sidebar, and tab positioning matching the rest of the platform. Tabs now use responsive overflow layout and event type filters are integrated into the header bar. This change applies to the main RUM page only.

Added contains pattern filtering for facet names in log search, making it easier to find relevant facets in large schemas.

Save queries now validate that an aggregation operator is present, returning a clear error message for invalid queries instead of producing unexpected results.

Scheduled views now support processing historical data. Specify a start time when creating a view to backfill data from a past point in time. Views that fall behind automatically catch up, processing accumulated data in bounded iterations until current. See Scheduled Views.

Scheduled view status now shows evaluation time, next evaluation time, and lag for monitoring health.

Improved log level detection for OTLP-sourced logs. Logs that carry the level in agent-processed metadata are now correctly classified instead of falling back to message body parsing.

Timestamp bounds checking is now applied to all log sources regardless of the timestamp mode. Previously, out-of-bounds timestamps from agent or ingestion sources could pass through without validation.

Fixed issue where hydration job list would appear empty when archiveAddTags contains invalid JSON.

Panels now correctly use their configured datasource and target settings for more reliable data loading.

Added validation when switching between query modes in dashboard edit to prevent invalid query configurations.

Removed unnecessary borders in dashboard data table panels for cleaner visualization.

Fixed an issue where the loading state was not cleared after a query completed via WebSocket, causing the UI to appear stuck in a loading state.

Introduced new parse multi functionality for parsing multiple patterns from log data.

Added anchored pattern matching to parse multi for more precise log parsing.

Parse multi now supports nodrop option to preserve unmatched fields.

Lookup operations no longer require the 'as' clause, improving query simplicity.

Fixed bug where lookup operations with aliased fields would produce incorrect results.

Corrected configuration handling for saved view expiration settings.

Users can now configure hydration jobs to skip objects that fail to hydrate instead of stopping the entire job, improving resilience for large hydration operations.

Fixed a regression where concatenated JSON payloads (for example, {"log":"a"}{"log":"b"}) were only parsing the first object, silently dropping subsequent log entries. This affects fluentd-json, fluent-bit-json, Datadog, and hydration ingestion paths.

Fixed a regression where Heroku syslog messages were incorrectly wrapped in JSON instead of being passed through as raw messages. Decompression error metrics for Datadog payloads were also restored.

Fixed issue where merging reset adjustments in point ranges could produce incorrect metric values, improving accuracy of counter reset handling.

Fixed an issue where transposed log tables were not rendering correctly in dashboard panels.

Fixed an issue where LogQL-based panels were not working correctly in dashboard views.

Fixed an issue where dashboard template variables were not properly filtering RUM data in dashboard panels.

Increased dashboard list limit from 1000 to 5000, allowing users to view and manage larger dashboard collections.

Fixed an issue where sparkline charts were not showing all bars when a custom timeslice differs from the UI bucket size.

Fixed parsing issues with PromQL expressions in alert configurations.

Fixed syntax handling for log-based anomaly alert definitions.

Fixed regressions in LogQL implementation that affected query execution and result accuracy.

Fixed a panic when using compare operators in streaming queries.

Fixed column naming for minute-duration timeshifts in compare queries.

Fixed issues with NaN values and format function type mismatches in streaming aggregations.

Fixed issues with compose operator returning incomplete results and not respecting subquery limits.

Fixed a performance regression in metrics rollup implementation that affected query latency for rolled-up metrics.

Fixed an issue where the hydration job status UI was blinking and not displaying status correctly.

Added labels section to SLO creation and details page, allowing users to add and manage labels when creating and editing SLOs.

Fixed an issue where editing lookup tables could corrupt data due to column order mismatch.

Added the subquery operator for executing nested queries within FuseQL. This enables complex analytical patterns where results from one query can be used as input for another, supporting use cases like finding logs from hosts with specific error patterns.

Enhanced the transpose operator to support line and column graph visualizations in dashboards. Create graphical representations of transposed data for better trend analysis.

Improved performance for logs analytics, timeline, fingerprint, and download operations with real-time progressive loading for large result sets.

Added real-time query progress display on logs tabs showing documents scanned and total documents. This provides visibility into query execution progress for long-running searches.

Added ability to cancel long-running streaming queries from logs, metrics, dashboards, and alerts screens. Users can now abort queries that are taking too long without refreshing the page.

Added download button for Scheduled Views results, enabling export of scheduled search data for offline analysis.

Improved logs parser scalability, requiring fewer logs parser replicas.

Added native support for Heroku log format parsing with proper handling of empty messages and special characters.

Enhanced RBAC with Folder Permissions for Kloudfuse objects. Assign view or edit permissions at the folder level, with permissions automatically inherited by objects within folders.

Prevents creation of duplicate folder names during create, edit, and move operations for better organization.

Improved audit logging to correctly trigger on folder create, update, and delete operations. Better visibility into permission and folder changes.

Added URL shortening support for all Kloudfuse screens. Share concise URLs instead of long parameter-heavy links that may not work in messaging applications like Slack.

Added RUM-specific template variable support in dashboards. Create and use template variables for RUM panels with proper attribute filtering.

Faster and more responsive rendering for log-based alert evaluation, especially for complex alert queries.

Enforced FuseQL usage for alert queries with proper validation and error messaging when queries cannot be converted to query builder format.

Added display of pending alert silences in the Kloudfuse UI for better visibility into upcoming silence windows.

Improved metrics query performance and scalability with optimizations to label filtering, series enforcement, and aggregation processing. Aggregation output series are now limited to protect system stability during complex queries.

Improved performance when rendering large numbers of SLOs on the SLO list page.

Kloudfuse container images and Helm charts are now signed. Customers can verify image integrity before deployment.

Added support for OIDC federation for external partners to securely pull images from AWS ECR without long-lived credentials. Partners can configure their CI/CD systems to use OIDC tokens for image authentication.

Improved query performance for regex-based label filters with alternation patterns across all telemetry streams (logs, metrics, traces, events, RUM).

Improved metrics ingestion performance for OTLP data sources.

Added support for wildcard patterns in terms search, allowing more flexible log filtering with * patterns.

Dashboard URLs now preserve template variable selections in the URL state, allowing you to bookmark and share dashboards with specific template values applied.

Added regex support for filtering RUM data in timeseries visualizations.

Fixed an issue where switching between advanced search and query builder modes did not work correctly in some cases.

Fixed an issue where changing template variable values did not properly refresh log data in dashboard panels.

Fixed an issue where the logs analytics table would get cut off on smaller screens. The table now includes horizontal scrolling for tables with many columns.

Fixed an issue where regex matching in RUM queries did not work correctly for multi-line string values.

Fixed the Pinot ingestion rate calculation in the control plane dashboard.

Significantly improved query performance for label filters when using regex alternation across Metrics, Logs, and APM. Queries with patterns like {service_name=~"frontend|backend|api"} or {namespace=~"prod|staging"} now execute orders of magnitude faster. This optimization applies to all queries that use regex alternation (|) for matching multiple label values.

Improved logs download performance with WebSocket-based streaming. Large log exports now download faster with better progress indication.

Added support for configuring multiple GCP project IDs for Stackdriver metrics collection. This enables monitoring across multiple GCP projects from a single Kloudfuse deployment.

Improved query performance by automatically using rollup tables for time aggregations when the lookback period is greater than or equal to the rollup interval. This optimization reduces query latency for long-range queries without requiring any configuration changes.

Enabled series limit enforcement by default to protect system stability. Queries without space aggregation are limited to 5,000 series, while queries with aggregation are limited to 20,000 series (prior to aggregation). These limits are configurable via the kfuse chart values.yaml.

Fixed nested resource label caching for namespaces like AWS/ECS. Metrics for ECS services and tasks now correctly inherit and display parent resource labels, improving the accuracy of infrastructure monitoring dashboards.

Added cluster-level metrics scraping for Aurora DB clusters. This enhancement provides visibility into Aurora cluster-wide performance metrics in addition to individual instance metrics.

Added the compare operator for analyzing data across different time periods. Compare current metrics against historical baselines to identify trends, anomalies, and performance changes over time.

Enhanced the transpose operator to support multiple aggregate columns, enabling more complex data transformations in a single query.

The if operator now supports nested function calls, allowing more complex conditional logic in FuseQL queries.

Added support for group by operations on array-type columns, enabling aggregation across multi-valued attributes.

Improved autocomplete suggestions that respect previous filters and query context. The code editor now provides intelligent suggestions based on the current query structure, including function autocomplete for FuseQL and PromQL.

Fixed log table height issues and table cutoff at the bottom of the screen. Improved search bar styling and overall logs screen layout for better usability.

Added support for high cardinality facets in trace analysis with autocomplete, group by, and aggregation capabilities. This enables efficient exploration of trace attributes with many unique values without impacting query performance.

When editing notification templates, you can now load payload data directly from active alerts. This makes it easier to test and preview notification templates with real alert data without manually constructing test payloads.

New dedicated page for viewing active alert notifications. Monitor which notifications are currently being sent and track notification delivery status in real-time.

Added search functionality to the Contact Points page, making it easier to find specific contact points in large configurations.

Added label filter support in the Events panel on the Alert page. Filter alert events by specific label values to focus on relevant alert instances and reduce noise when investigating alert patterns.

This release contains improvements to dashboard performance, rendering, and visualization.

Added Real User Monitoring (RUM) tools to the Kloudfuse MCP Server, enabling AI-assisted analysis of frontend performance, user sessions, and browser metrics.

Added APM execution breakdown tools to the MCP Server, providing AI-assisted analysis of service execution time and downstream dependency contributions.

Create Service Level Objectives using custom PromQL queries, not just pre-defined APM metrics. Define custom numerator and denominator queries for precise SLO calculations tailored to your specific requirements.

Promote custom attributes to facets in RUM for enhanced filtering and analytics. Create custom facets from usr and context attributes to organize and analyze your RUM data according to your application’s specific needs.

Provides AI agent access to Kloudfuse observability data through the Model Context Protocol (MCP) server. Enable AI-powered analysis, troubleshooting, and insights across your entire observability stack.

New History tab displays a comprehensive state timeline for each alert with dropdown filters to narrow history by specific label values. Inspect only the events you care about and track alert state changes over time.

Compare two alert revisions side-by-side and restore older versions. Track changes to alert definitions over time and easily revert to previous configurations when needed.

Each alert instance row clearly displays whether it’s silenced. Mute and unmute buttons use Grafana’s matcher logic to precisely target the exact labels you’re viewing, ensuring suppression rules apply only to intended instances.

Creating or editing alerts now prompts for evaluation duration ("for") and execution frequency ("every") with validation for positive time strings. The reducer automatically adjusts based on above/below threshold selection, and deleted annotations no longer reappear on save.

Alert tags in the alert list table now support expand/collapse functionality for better space utilization and readability.

Fixed APM alert editing performance issue that was causing hundreds of queries to be issued. Editing APM alerts is now significantly faster and more efficient.

Contact point creation now opens in a new tab (instead of modal) with a refresh button to update the contact point selector without losing other form inputs.

Enhanced authentication and session management with improvements to oauth2-proxy and user management service. Includes fixes for session handling and rate limiting enhancements.