Falcon LogScale Collector 1.11.2 GA (2026-04-21)

Version?Type?Release Date?Config.Changes?
1.11.2GA2026-04-21no

Hide file hashes

Show file hashes

Highlights

Bug fixes and security updates

Improvements, new features and functionality

  • Collecting Data

    • The HEC sink now supports additional configuration fields for LogScale deployments:

      • logscaleSpecific.parserIndex

      • logscaleSpecific.parserOrganization

      • logscaleSpecific.organization

      These fields allow parser and organization metadata to be included in the payload sent to HEC endpoints, enabling more precise routing and parsing in LogScale.

  • Other

    • The Go version has been updated to take advantage of the latest optimizations and security updates.

    • The Log Collector now embeds its version directly in the binary. This allows the version info to be reliably extracted by the update service without using the version command on the Collector binary.

  • Installation and Deployment

    • The uninstall scripts for Windows have been augmented with improved error handling and reporting. The following improvements have been made:

      • Added an admin check that fails fast before any work is performed.

      • Errors are now tracked across steps. The script exits with code 1 on failure, and 0 on success.

      • Removal items are now shown even when the -yes flag is used.

Bug Fixes

  • Collecting Data

    • Fixed a memory leak that could occur in pipelines configured with a disk queue and the file source.

    • Fixed a bug in Database sources where TLS connections would fail in FIPS 140 mode due to unsupported elliptic curve preferences.

  • Installation and Deployment

    • Fixed an issue where a Full Install on Windows would fail to re-install due to the error Service already exists.

    • Helm chart version 1.5.2 introduces improved version management:

      • The single image value has been split into imageRepository and imageTag

      • The legacy image field is still supported for backward compatibility. If set, image takes priority over the new fields.

      See the example below:

      yaml
      # New (preferred)
imageRepository: "registry.crowdstrike.com/log-collector/us-1/release/logscale-collector"
imageTag: "1.11.2@sha256:..."

# Legacy (still works)
image: "registry.crowdstrike.com/log-collector/us-1/release/logscale-collector:1.11.2@sha256:..."