What we've shipped and what's coming next.
Performance hardening, enterprise SSO/SAML, advanced RBAC, managed cloud GA, and tiered storage with hot/warm/cold data lifecycle.
A feature release that makes LogTide ready to run as a hosted multi-tenant service, the same groundwork that powers LogTide Cloud. A combined byte quota, email verification, terms acceptance, quota grace and per-user caps are all opt-in: self-hosted installs behave exactly as before.
A feature release that brings billing into the app. Owners and admins see their plan, subscribe, switch plan, cancel, update their card and download invoices from Settings, with the payment form embedded in the page. Self-hosted instances are unchanged.
A feature release. Every dashboard panel now shares one time range list from 15 minutes to 30 days, with a board-wide picker that retimes everything at once. The geo map keeps your pan and zoom across refreshes, and two panels that quietly ignored their configured window are fixed.
A feature release. Five community-requested dashboard panel upgrades: per-panel pause, 12h/24h clock and timezone preferences, larger live streams, metadata Top-N tables and custom series labels. Email digests expand to fifteen toggleable sections, and MongoDB span sorting matches the other engines.
A feature release. Custom dashboards gain a GeoIP world map and a raw log table with configurable metadata columns, webhook channels pointing at Discord finally work, and repeated webhook events no longer get stuck at pending forever.
A feature release. Duplicate error groups are fixed at the root and auto-merged at ingestion, scheduled email digest reports ship complete and enabled, clock skew detection covers logs, spans and metrics, and a full UX audit lands ~25 fixes and refinements across the dashboard.
A feature release. External systems can now push events into LogTide through tokenized inbound webhook receivers (GitHub, Uptime, generic JSON), and deleting a project moves it to a recoverable 30-day trash instead of wiping it. Plus five dashboard and log-count correctness fixes.
A security-focused release resolving privately reported issues (coordinated disclosure via KIberblick.de): cross-tenant dashboard reads, stored XSS in the service map, an open redirect, SSRF DNS-rebinding, and two races. Trace span attributes are now PII-masked. No migrations - a drop-in upgrade.
A frontend correctness and security release from a multi-agent frontend bug hunt, plus hardened auth for the live-streaming endpoints. The headline: single-use stream tickets keep the session token out of WebSocket/SSE URLs. One additive migration - otherwise a drop-in upgrade.
A security and correctness release from a multi-engine bug audit of the 1.0 line. Two cross-tenant data-exposure fixes that were live in 1.0.0, plus a broad sweep of detection, ingestion, storage, alerting and frontend correctness fixes. No migrations - a drop-in upgrade.
First beta of the 1.0 line. Tenant data isolation audit, per-org metering with a capability/quota system, typed lifecycle hooks, a hardened outbound webhook dispatcher, a structured audit log primitive, and fail-closed PII masking.
Closes a sibling-gap left by the 0.9.6 SSRF hardening: the alert/Sigma webhook delivery path now routes through the centralized safeFetch guard instead of the bypassable inline filter (GHSA-7v53-pw6r-99vj, CWE-918).
Frontend now runs as a full SPA on adapter-node (kills hydration bugs), SSRF guard on monitors and webhooks, cross-tenant projectId validation on four routes, OIDC iss-parameter fix for Authelia, and an infinite-skeleton fix on search/traces/metrics.
Metadata filters now work on ClickHouse and MongoDB, error notifications are throttled per group to stop email storms, the notification-channels defaults endpoint accepts monitoring, plus 19 Dependabot advisories resolved.
Data-availability endpoint now reads cached flags on projects (6s+ → <50ms on ClickHouse), activity_overview panel works across all engines, 14 dashboard pages get proper titles, plus uuid 14 and fast-xml-parser 5.7.3 security bumps.
Traces gain live tail (SSE), row expand, keyboard shortcuts and export; monitoring reorganized into tabs; user settings promoted to a full page; new trace_volume and activity_overview dashboard panels; opt-in ReservoirBuffered async ingestion with in-memory and Redis Streams transports.
Generic metadata filters across log search and alert rules, admin-driven user provisioning, editable org/project slugs, org-scoped public status page URLs (BREAKING), plus SIEM heatmap crash fix and three fastify/SvelteKit security bumps.
SQL injection fix in querySpans, ReDoS protection for monitor assertions, 25+ bug fixes across auth, pipelines, SIEM, monitoring, and SSR safety, plus comprehensive input validation on all route params.
Three major features: uptime monitoring with public status pages (#152), log parsing and enrichment pipelines with grok and GeoIP, and fully customizable dashboards with 9 panel types (#151).
Quick Start cURL example now validates without a manual timestamp, Sigma worker no longer floods logs on empty detection batches, and fresh instances without INITIAL_ADMIN_* env vars auto-promote the first registered user to admin.
Fixed ClickHouse traces/metrics data-availability queries failing due to raw epoch date parameters, and resolved stale dashboard sessions after volume resets.
Five cross-org and auth security fixes, corrected SSE real-time streams, resolved 20+ Svelte memory leaks on navigation, and multiple bug fixes across SIEM, incidents, webhooks, and retention jobs.
All dashboard pages now show content-shaped skeleton loaders, automated Helm chart releases on every stable Docker image, and multiple performance and correctness fixes for API endpoints and admin pages.
Major expansion of the audit trail system covering all critical platform actions for GDPR/SOC2 compliance, OIDC provider brand icons, and fixes for date formatting localization and data availability routing.
Daily auto-sync for SigmaHQ community rules, trace navigation from log detail panel, audit logs for alert rules, and security/robustness fixes for ingestion and admin endpoints.
Project name display in error pages, API Key visibility in exception logs, and a fix for data-availability routing when using ClickHouse or MongoDB.
MongoDB storage adapter for @logtide/reservoir, browser and frontend SDKs with source maps and Core Web Vitals, and OTLP metrics dashboards with cross-signal correlation.
POST /api/v1/ingest now accepts direct arrays and wrapped arrays in addition to the standard format, improving compatibility with collectors like Vector and Fluent Bit.
OpenTelemetry metrics ingestion, service dependency graph visualization, audit logging, and major UX restructuring.
SMTP no longer requires user/password credentials. Only the host is needed, and the from address uses the SMTP_FROM parameter.
New write-only API key type safe for browsers and mobile, plus domain/IP allowlists with wildcard subdomain support for origin validation.
ClickHouse as a full alternative to TimescaleDB via the @logtide/reservoir abstraction layer, with factory pattern engine selection and full query migration.
Host security detection packs with MITRE ATT&CK mapping, PII masking at ingestion, rate-of-change alerts, keyboard shortcuts, and admin dashboard revision.
Detection pack category routing directs results to correct UI sections. Multiple fixes for exception handling and onboarding.
Fixed detection category filter validation and optimized admin dashboard from 31s to ~1s with continuous aggregates.
Hostname filter for syslog sources, log retention fixes for compressed chunks, and major performance improvements with TimescaleDB hypertables.
Fastify security vulnerabilities patched, automatic batch request splitting, and Unicode escape sanitization.
Configurable email and webhook notification destinations with channel testing before saving and UI space optimization.
Terminal log view with ANSI color coding, pre-configured detection packs, event correlation by identifier, alert preview testing, and optional Redis dependency.
Centralized clipboard copy function, config validation test coverage, and documentation corrections.
Stack trace parsing support for multiple programming languages and dependency updates including @sveltejs/kit.
Project rebranding from LogWard to LogTide, substring search with trigram indexes, clickable dashboard elements, exception visualization, and customizable retention.
Enterprise authentication with LDAP and OpenID Connect, auth-free mode for home labs, initial admin via environment variables, and ARM64 Docker builds.
Fixed SvelteKit 2 compatibility with new store patterns, traces page navigation 404s, and registration error handling.
Updated security policy with current supported versions for responsible disclosure.
Real-time SIEM dashboard with security widgets, C# / .NET SDK, IP reputation and GeoIP enrichment, and organization invitations.
Syslog integration documentation with device-specific guides, Go SDK documentation, and documentation restructure with new Integrations section.
Automated Docker image publishing via GitHub Actions CI/CD and comprehensive self-hosting deployment documentation.
Multi-step onboarding wizard with progress tracking, empty state components for guidance, and expanded testing infrastructure.
Type-safe Redis caching layer with session validation 30x faster, API key verification 20x faster, query results 10x faster, and aggregations 50x faster.
Full OpenTelemetry support with OTLP endpoints, distributed tracing with complete CRUD operations, and 563+ tests.
First public release of LogTide with multi-organization architecture, batch log ingestion, real-time streaming, TimescaleDB storage, Sigma detection engine, and official SDKs.
Open a discussion on GitHub or vote on existing proposals to help shape the roadmap.
Open a Discussion
