Falcon LogScale 1.110.0 Preview (2023-10-03)
|End of Support
|Req. Data Migration
Bug fixes and updates.
The following items are due to change in a future release.
Automation and Alerts
In LogScale version 1.112 we will change how standard alerts handle query warnings. Currently, LogScale will only trigger alerts if there are no query warnings. Starting with upcoming 1.112, alerts will trigger despite most query warnings, and the alert status will show a warning instead of an error.
Up until now, all query warnings have been treated as errors. This means that the alert does not trigger even though it produces results, and the alert is shown with an error in LogScale. Most query warnings mean that not all data was queried. The current behaviour prevents the alert from triggering in cases where it would not have, if all data had been available. For instance, an alert that would trigger if a count of events dropped below a threshold. On the other hand, it makes some alerts not trigger, even though they would still have if all data was available. That means that currently you will almost never get an alert that you should not have gotten, but you will sometime not get an alert that you should have gotten. We plan to revert this.
When this change happens, we no longer recommend to set the configuration option
true, since it treats all query warnings as non-errors, and there are a few query warnings that should make the alert fail.
Improvements, new features and functionality
The contentHash field on the
Fileoutput type has been reintroduced.
Dashboards and Widgets
A parameter configuration option has been added to allow setting a custom message when a parameter input is invalid.
A parameter configuration option has been added to support invalidation of parameter inputs. The format for this is a comma separated list of invalid input patterns (regexes).
It is now possible to see the type of action in Packages (Marketplace, Installed and Create a package).
Filter alerts and Standard alerts are now shown in the same tab Alerts under Assets when installing or viewing installed Packages.
A workaround solution has been identified for those cases where segment files on local disk no longer pass their internal checksum test and are detected as "broken" by the background merge process.
Ensure a copy of the local file is present in the bucket storage, backing up the cluster
Delete the local copy
As a result, any merge attempt involving that file will succeed after the next restart of LogScale.
The buttons used for editing and deleting an ingest listener were overlapping in Safari on the Ingest Listeners page under a repository. This issue has been fixed.
A boot-time version checking issue could cause LogScale to crash on boot, if joining a fresh cluster, and the first node to join that cluster would crash.
Fixed a broken link from saved query asset in