Falcon LogScale Collector 1.10.0 GA (2025-08-15)

Version?Type?Release Date?Config.Changes?
1.10.0GA2025-08-15no

Hide file hashes

Show file hashes

Support for routing syslog messages to multiple destinations and various security fixes.

Improvements, new features and functionality

  • Collecting Data

    • Added support for routing syslog messages to multiple destinations using a new internal re-routing architecture. You can now configure different processing rules through transformations for each destination path, and route logs based on content patterns using regex filters. For complete implementation details, please refer to the documentation.

    • The internal representation and calculation of batch sizes has been changed to make it more similar to how events are represented in LogScale/NG SIEM. Previously, a batch where all events had identical fields would only report the size of the fields once, now field sizes are reported per event leading to a more correct representation of event sizes. An additional benefit of this change is that the internal batching and queuing system is now independent of the transport protocol used.

    • The regex_filter transform now supports filtering on fields. Previously this transform only supported filtering events using regex patterns applied to the event message.

    • Optimized the way that event batches are created to stay within the max batch size limits.

  • Debugging

    • Internal log messages have been improved with additional context. For example, messages regarding sink communication now include the sink name.

  • Other

    • To take advantage of the latest optimizations and security updates, the Go version has been updated. Also, various security posture hardening improvements have been implemented.

  • Installation and Deployment

    • Full Install (on Linux) now supports automatically adding capabilities CAP_DAC_READ_SEARCH and CAP_NET_BIND_SERVICE to the Log Collector systemd service file. This allows the Collector to read system files and bind to port numbers lower than 1024.

      To enable this at installation time use the flag --enable-capabilities.

Bug Fixes

  • Installation and Deployment

    • Enhanced the Linux uninstallation process for full installations. Previously, the logscale-collector group remained in place after uninstallation on certain Linux distributions, which could interfere with subsequent reinstallations. The uninstall script now correctly removes both the user and the group, ensuring clean reinstallations.

Known Issues

  • Collecting Data

    • Environment variable expansion is not supported when using the static_fields transform in this release.