Falcon LogScale 1.173.0 GA (2025-01-28)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.173.0GA2025-01-28

Cloud

2026-03-31No1.150.01.157.0No

Available for download two days after release.

Hide file download links

Show file download links

Bug fixes and updates.

Removed

Items that have been removed as of this release.

Configuration

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The color field on the Role type has been marked as deprecated (will be removed in version 1.195).

  • The storage task of the GraphQL NodeTaskEnum is deprecated and scheduled to be removed in version 1.185. This affects the following items:

  • The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

  • The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

Upgrades

Changes that may occur or be required during an upgrade.

  • Installation and Deployment

    • The JDK included in container deployments has been upgraded to 23.0.2.

New features and improvements

  • User Interface

    • Field Aliasing schemas now require unique names. If you create a schema with a name that has been utilized before, you'll be prompted to give the schema a different name.

  • Storage

    • To reduce load on global database, datasources now take longer to enter idle state when they stop receiving data.

  • GraphQL API

    • A new, optional argument has been added to the restoreDeletedSearchDomain() GraphQL mutation. The purpose is to be able to restore a deleted search domain even though its limit has also been deleted, by specifying a new limit to use instead.

  • Configuration

    • The new METRIC_RETENTION_IN_DAYS environment variable now allows users to configure the humio-metrics repository retention.

      For more information, see METRIC_RETENTION_IN_DAYS.

    • LogScale now provides environment variables to configure individual Kafka clients. The new environment variables have the following prefixes:

      • KAFKA_ADMIN

      • KAFKA_CHATTER_CONSUMER

      • KAFKA_CHATTER_PRODUCER

      • KAFKA_GLOBAL_CONSUMER

      • KAFKA_GLOBAL_PRODUCER

      • KAFKA_INGEST_QUEUE_CONSUMER

      • KAFKA_INGEST_QUEUE_PRODUCER

      In addition, KAFKA_COMMON can be utilized to pass the configuration to all clients; however, settings configured using the client-specific prefixes have precedence if the setting is present with both prefixes.

      Kafka configuration options, such as request.timeout.ms can be passed with these prefixes using a simple rewrite:

      1. Uppercase the option name. Example: REQUEST.TIMEOUT.MS

      2. Replace . with _. Example: REQUEST_TIMEOUT_MS.

      3. Apply the prefix for the target client. Example: KAFKA_INGEST_QUEUE_CONSUMER_REQUEST_TIMEOUT_MS.

      4. Pass this as an environment variable to LogScale on boot. Example: KAFKA_INGEST_QUEUE_CONSUMER_REQUEST_TIMEOUT_MS=30000.

      As a consequence, EXTRA_KAFKA_CONFIGS_FILE has been deprecated in favor of these new environment variables. This feature will be removed no earlier than version 1.225.0. The configuration passed via EXTRA_KAFKA_CONFIGS_FILE can be moved into the new environment variables using the procedure outlined above, while using the KAFKA_COMMON_ prefix.

      After the EXTRA_KAFKA_CONFIGS_FILE removal, LogScale will not start if this variable is set. This behavior will help users recognize that they need to update their configuration, as described in this release note.

  • Log Collector

    • LogScale Collector now handles a longer list of available downloads. Older versions which have reached end-of-life are marked as such.

  • Functions

    • Introducing the new query function array:sort(), which sorts the element of a given array using a given sort type and order. This function is similar to the sort() function, but works on the array elements of a single event instead of multiple events.

      For more information, see array:sort().

    • A new prefix parameter has been added to the kvParse()function. The parameter is an alias for the existing parameter as parameter.

Fixed in this release

  • Installation and Deployment

    • Testing event forwarder connectivity would permanently consume a thread and TCP connection to the Kafka broker. This issue has now been fixed.

  • Automation and Alerts

    • Listing actions on a trigger referencing a non-existing action would fail. This issue has been fixed.

  • GraphQL API

    • The searchDomainRoles GraphQL field on the Group datatype could fail if given a view ID for which the group did not have any role assignments. This issue has now been fixed.

  • Queries

    • Queries did not restart when adding, changing, or removing view connections. This issue has now been fixed so that queries correctly restart at view connections updates.

    • Queries would sometimes be incorrectly reused even though they had a warning attached. This would mean that a new query would get the same warnings instead of running a new search. This issue has now been fixed.

Improvement

  • Queries

    • Queries producing more events via its aggregators than the events configured by AggregatorOutputRowLimit will now get cancelled and not produce an output. Previously, queries would only produce a log and continue to run when the limit was exceeded. This can happen for instance when nesting multiple groupBy() function calls with high cardinality results. This change is being introduced to protect the system against runaway queries that take up resources from the whole cluster.

    • Regular expressions compiled using the new LogScale Regular Expression Engine v2 are now cached to avoid compiling the same regex multiple times.