Release notes for v2.26.1

For further information, see the release blogpost. 

Graphistry Versions

Server	2.26.1
JS React+Vanilla	3.7.1
Python PyGraphistry client	0.9.69

Third-Party Versions

BlazingSQL	0.4.6 (from 0.1)
CUDA (In-Docker)	10.0 (from 9.2)
Docker (CE)	19.03.2
Docker Compose	1.24.1
Elasticsearch node driver	14.2.2
Python	3.7.3
Neo4j node driver	1.7.6 (from 1.7.0)
RAPIDS	0.10 (from 0.7)
Splunk node SDK	1.9.0

New Features

• Investigation UI:
  • Edit name in-place
  • See creation date
• Neo4j:
  1. New pivots!
     
     • Structured search: Many common initial searches can now be done purely point-and-click via the new `Search Neo4j nodes` visual query builder
     • Schema viewer: See a graph of your database's node types and how different kinds of relationships tie them together
     • Text search: Neo4j fulltext (lucene) indexes can be conveniently searched as well
  2. Schema inference:
     • By default on system start, Graphistry will scan Neo4j to infer labels, relationships, and their properties, and use that information to make various pivots smarter
     • Disable schema inference by setting neo4j.schema.inferSchema (NEO4J_INFER_SCHEMA) to false
     • Cap how long any schema inference query step takes by setting neo4j.schema.inferTimeout / NEO4J_INFER_TIMEOUT
     • Hardcode the schema to merge in: neo4j.schema.labelProperties / NEO4J_LABEL_PROPERTIES and neo4j.schema.relationshipProperties / NEO4J_RELATIONSHIP_PROPERTIES as dictionaries mapping from label/relationship type names to arrays of property name strings. For fulltext index pivots, you can hint neo4j.schema.textIndexes / NEO4J_TEXT_INDEXES, which is an array of the following for each text index (see neo4j's CALL db.indexes()): 
       {  description: str, indexName: str, tokenNames: [ str ], properties: [ str ], type: "node_fulltext" | "relationship_fulltext"}
  3. Experimental time support:
     • Pivots recognizes neo4j date, datetime, and datetimelocal values
     • Global investigation & per-pivot setting of which node/edge attributes to use for time during searches (when available on a node)
     • Set neo4j.schema.defaultTimeIndex.nodeProperties, neo4j.schema.defaultTimeIndex.relationshipProperties (NEO4J_TIME_INDEX_NODES, NEO4J_TIME_INDEX_RELATIONSHIPS) as an array of strings (the property names to use)
  4. Improved error reporting:
     When Neo4j cannot compute a query, report the query, named parameters, and system parameters
  5. Timeout support:
     • Defaults to 20s search timeout
     • Setting neo4j.searchMaxTime / NEO4J_SEARCH_MAX_TIME (seconds)
     • Per-pivot override via the UI
  6. Query metadata labeling:
     • Set neo4j.metadata / NEO4J_METADATA
• Splunk:
  • Search defaults to all time
  • Can control timeout
• Ontology:
  • More ELK windows support
  • Titles for graph-native connectors:
    • Setting ontology.titles.byField / GRAPHISTRY_TITLES_BY_FIELD): sorted array of case-sensitive field name strings to use if available, else default to nodeTitle/edgeTitle, else default to id . System defaults to "label", "name", "title", "Label", "Name", "Title".
    • Setting ontology.titles.byType / GRAPHISTRY_TITLES_BY_TYPE: dictionary binding from node/edge attribute 'type' value (ex: event column name) to the name of the column to use, such as {"ip": "src_ip"}. If no type match, default to nodeTitle/edgeTitle, else default to id.
• Performance
  • Control the number of cpu/gpu workers (we recommend 1-8 per CPU core and GPU):
    • Streaming clustering workers: defaults to STREAMGL_NUM_WORKERS=4
    • RAPIDS workers: defaults to FORGE_NUM_WORKERS=4
    • Experiment under high load and check nvidia-smi, top for GPU/CPU impact
    • We discourage overly high values because each worker consumes 100MB+ GPU RAM
    • Note that some but not all CPU/GPU access will still be contended
  • Smaller container footprint: 3.4GB -- 50% smaller!
• Infrastructure
  • Docker image and GPU version updates
  • Build: Internally, big upgrade to serverless GPU CI
• RAPIDS 0.10:
  • BlazingSQL 0.4.6: Significantly expanded SQL support
  • cudf, cuml, ...: Out-of-core and multi-gpu support (Dask), and many bug fixes
  • cugraph: multigpu pagerank, ...
  • UMAP

Docs

• Docs
  • Add custom pivots
• Tutorial:
  • GPU BlazingSQL + Graphistry for netflow analysis

Fixes & Tweaks

• AWS G4 / RTX series GPU support: Upstream RAPIDS update for JIT driver bugs
• RAPIDS/BlazingSQL in notebook environment
• Pivot and searchLink annotations for repeatedly returned node/edges now reflect the first pivot hit rather than the last
• Graphs with no edges are now partially supported. UI functionality will steadily improve for this case over the next few releases
• Stronger datetime inference:  more null detection and columns spanning multiple timezones
• Time: Fixed node/edge coloring and more consistent handling of ns vs. ms precision

Migration

• Ensure your host Nvidia driver can run Docker containers with CUDA 10.0
• Neo4j search/expand pivots can no longer specify node titles, instead use the new ontology.titles.* system settings.