Falcon LogScale 1.153.3 LTS (2024-10-02)

Version?Type?Release Date?Availability?End of Support

Security

Updates

Upgrades

From?

Config.

Changes?
1.153.3LTS2024-10-02

Cloud

2025-09-30Yes1.112No
TAR ChecksumValue
MD511d707c1e84f5de2386b6cef2e9a7309
SHA1978a3bced7ad25a0c5d6cbe02975636be07ec829
SHA25636a4ba68604c328b0efc5ed3dcde506f0a5664e77be1f3db0760b917aa35d11b
SHA5126c084b83bd6764e8a190bd5c4324da3e6394eb47b60a456cffcd539a20057b9003f2c2b00263d2af7db3d65ebd86eadd38380e70b7778d4fdba613e5e5eac70c
Docker ImageIncluded JDKSHA256 Checksum
humio22a2672fa37f835074b5f9c75fc5806c116a8211f9e6f2cb2fd3623cf20bdc8e4b
humio-core22febf83507daf65f91789b4b2a19e9d116f8572bce00d7e269c40c1112b1bbd7d
kafka22968b820261790d6ea9bb24427850168039d558e2a87c7e8fe59d14dee89390fb
zookeeper22ec4b860137b8f152fd74b164a00ab28134436f42f6d7de1b18de9fce96a86b13

Download

Bug fixes and updates.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The server.tar.gz release artifact has been deprecated. Users should switch to the OS/architecture-specific server-linux_x64.tar.gz or server-alpine_x64.tar.gz, which include bundled JDKs. Users installing a Docker image do not need to make any changes. With this change, LogScale will no longer support bringing your own JDK, we will bundle one with releases instead.

    We are making this change for the following reasons:

    • By bundling a JDK specifically for LogScale, we can customize the JDK to contain only the functionality needed by LogScale. This is a benefit from a security perspective, and also reduces the size of release artifacts.

    • Bundling the JDK ensures that the JDK version in use is one we've tested with, which makes it more likely a customer install will perform similar to our own internal setups.

    • By bundling the JDK, we will only need to support one JDK version. This means we can take advantage of enhanced JDK features sooner, such as specific performance improvements, which benefits everyone.

    The last release where server.tar.gz artifact is included will be 1.154.0.

  • The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Functions

    • Prior to LogScale v1.147, the array:length() function accepted a value in the array argument that did not contain brackets [ ] so that array:length("field") would always produce the result 0 (since there was no field named field). The function has now been updated to properly throw an exception if given a non-array field name in the array argument. Therefore, the function now requires the given array name to have [ ] brackets, since it only works on array fields.

Fixed in this release

  • Functions

    • A regression issue has been fixed in the match() function in cidr mode, which was significantly slower when doing submission of the query.

Known Issues

  • Queries

    • A known issue in the implementation of the match() function when using cidr option in the mode parameter, could cause a reduction in performance for the query, and block other queries from executing.