Falcon LogScale 1.151.0 GA (2024-08-13)

Version?Type?Release Date?Availability?End of Support

Security

Updates

Upgrades

From?

Config.

Changes?
1.151.0GA2024-08-13

Cloud

2025-09-30No1.112No

Available for download two days after release.

Bug fixes and updates.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The server.tar.gz release artifact has been deprecated. Users should switch to the OS/architecture-specific server-linux_x64.tar.gz or server-alpine_x64.tar.gz, which include bundled JDKs. Users installing a Docker image do not need to make any changes. With this change, LogScale will no longer support bringing your own JDK, we will bundle one with releases instead.

    We are making this change for the following reasons:

    • By bundling a JDK specifically for LogScale, we can customize the JDK to contain only the functionality needed by LogScale. This is a benefit from a security perspective, and also reduces the size of release artifacts.

    • Bundling the JDK ensures that the JDK version in use is one we've tested with, which makes it more likely a customer install will perform similar to our own internal setups.

    • By bundling the JDK, we will only need to support one JDK version. This means we can take advantage of enhanced JDK features sooner, such as specific performance improvements, which benefits everyone.

    The last release where server.tar.gz artifact is included will be 1.154.0.

  • The HUMIO_JVM_ARGS environment variable in the LogScale Launcher Script script will be removed in 1.154.0.

    The variable existed for migration from older deployments where the launcher script was not available. The launcher script replaces the need for manually setting parameters in this variable, so the use of this variable is no longer required. Using the launcher script is now the recommended method of launching LogScale. For more details on the launcher script, see LogScale Launcher Script. Clusters that still set this configuration should migrate to the other variables described at Configuration.

  • The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Functions

    • Prior to LogScale v1.147, the array:length() function accepted a value in the array argument that did not contain brackets [ ] so that array:length("field") would always produce the result 0 (since there was no field named field). The function has now been updated to properly throw an exception if given a non-array field name in the array argument. Therefore, the function now requires the given array name to have [ ] brackets, since it only works on array fields.

New features and improvements

  • UI Changes

    • LogScale administrators can now set the default timezone for their users.

      For more information, see Setting Time Zone.

    • The design of the file editor for Lookup Files has been improved. The editor is now also more responsive and has support for tab navigation.

    • The Client type item in the Query details tab has been removed. Previously, Dashboard was incorrectly displayed as the value for both live dashboard and alert query types.

      For more information, see Query Monitor — Query Details.

  • Automation and Alerts

    • It is no longer possible to use @id as throttle field in filter alerts, as this has no effect. Any existing filter alerts with @id as throttle field will continue to run, but the next time the filter alert is updated, the throttle field must be changed or removed.

      For more information, see Field-Based Throttling.

  • GraphQL API

    • A new field named searchUsers has been added on the group() output type in graphql, which is used to search users in the group. The field also allows for pagination, ordering and sorting of the result set.

  • Configuration

    • The QueryBacktrackingLimit feature is now enabled by default. The default value for the max number of backtracks (number of times a single event can be processed) a query can do has been reduced to 2,000.

  • Ingestion

    • To avoid exporting redundant fields in the parsers, LogScale will now omit YAML fields with a null value when exporting YAML templates — even when such fields are contained inside a list. Omitting fields with a null value previously only happened for fields outside a list.

Fixed in this release

  • UI Changes

    • The settings used to disable automatic searching would not be respected when creating a new alert. This issue has now been fixed.

    • When Creating a File, saving an invalid .csv file was possible in the file editor. This wrong behavior has now been fixed.

  • Dashboards and Widgets

    • Shared dashboards created on the special humio-search-all view wouldn't load correctly. This issue has now been fixed.

  • Ingestion

    • Event Forwarding would fail silently if an error occurred while executing the query. This issue has now been fixed.

    • Event Forwarding using match() or lookup() with a missing file would continue to fail after the file was uploaded. This issue has now been fixed.

  • Log Collector

    • Queries that were nested too deeply would crash LogScale nodes. This issue has now been fixed.

  • Functions

    • writeJson() would write invalid JSON by not correctly quoting numbers starting with unary plus or ending with a trailing . (dot).

Known Issues

  • Queries

    • A known issue in the implementation of the match() function when using cidr option in the mode parameter, could cause a reduction in performance for the query, and block other queries from executing.