Falcon LogScale 1.186.0 GA (2025-04-29)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.186.0GA2025-04-29

Cloud

Next LTSNo1.150.01.177.0No

Available for download two days after release.

Hide file download links

Show file download links

Bug fixes and updates.

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Packages

    • Previously, LogScale would allow dashboard YAML template files to not contain a $schema field, but this is no longer optional. The $schema field is what LogScale uses to determine how it should read the template file, so it is important that it is correct. Before this change, if the $schema field was missing from a dashboard template, LogScale would assume the file was a dashboard template, using the dashboard schema version 0.1.0, which was released in 2020. As this old schema version doesn't recognize any features released since then, using it as the default value can cause confusing error messages if you try to omit the $schema field. Therefore, the field is now required instead. If you now have a dashboard YAML template file that __ls_shortname_ rejects due to this change, try adding the following line to the file: $schema": "https://schemas.humio.com/dashboard/v0.1.0, which should make it work as before.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The color field on the Role type has been marked as deprecated (will be removed in version 1.195).

  • LogScale is deprecating free-text searches that occur after the first aggregate function in a query. These searches likely did not and will not work as expected. Starting with version 1.189.0, this functionality will no longer be available. A free-text search after the first aggregate function refers to any text filter that is not specific to a field and appears after the query's first aggregate function. For example, this syntax is deprecated:

    logscale Syntax
    "Lorem ipsum dolor" 
    | tail(200)         
    | "sit amet, consectetur"

    Some uses of the wildcard() function, particularly those that do not specify a field argument are also free-text-searches and therefore are deprecated as well. Regex literals that are not particular to a field, for example /(abra|kadabra)/ are also free-text-searches and are thus also deprecated after the first aggregate function.

    To work around this issue, you can:

    • Move the free-text search in front of the first aggregate function.

    • Search specifically in the @rawstring field.

    If you know the field that contains the value you're searching for, it's best to search that particular field. The field may have been added by either the log shipper or the parser, and the information might not appear in the @rawstring field.

    Free-text searches before the first aggregate function continue to work as expected since they are not deprecated. Field-specific text searches work as expected as well: for example, myField=/(abra|kadabra)/ continue to work also after the first aggregate function.

  • The use of the event functions eventInternals(), eventFieldCount(), and eventSize() after the first aggregate function is deprecated. For example:

    Invalid Example for Demonstration - DO NOT USE
    logscale
    eventSize() | tail(200) | eventInternals()

    Usage of these functions after the first aggregate function is deprecated because they work on the original events, which are not available after the first aggregate function.

    Using these functions after the first aggregate function will be made unavailable in version 1.189.0 and onwards.

    These functions will continue to work before the first aggregate function, for example:

    logscale
    eventSize() | tail(200)
  • The setConsideredAliveUntil and setConsideredAliveFor GraphQL mutations are deprecated and will be removed in 1.195.

  • The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

  • The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Storage

    • The S3 SDK retry logic has been broadened:

      • LogScale will now do retries for bucket storage operations on a much broader range of exceptions (SDKException).

      • Segment uploads that fail after the SDK call will no longer be retried immediately, but will still be re-queued.

      • Uploads of global snapshots and uploaded files will still be retried implicitly, and the retry log lines now specify which type of upload is initiating it.

Upgrades

Changes that may occur or be required during an upgrade.

  • Installation and Deployment

    • The bundled JDK has been upgraded to version 24.0.1.

New features and improvements

  • Security

    • The view level permission Query model for persistent queries has been renamed to Query ownership for persistent queries.

  • User Interface

    • The Query model label has been renamed to Query ownership. This change applies to the current query model UI sections in triggers, packages and shared dashboards.

  • Automation and Alerts

    • The triggers property pane has some layout changes:

      • Section General renamed to General properties

      • Section Query renamed to Configuration

      • Section Actions moved above the Advanced settings section - now only visible when the trigger type is selected

      • Throttling moved to Configuration section

      • Trigger panel title changed

  • Configuration

    • The default value for the AUTOSHARDING_MAX configuration variable is now 128K (was 1k).

  • Log Collector

    • Replacing Custom Install Legacy Fleet Management configuration snippet with supported enrollment mode localConfig.

Fixed in this release

  • User Interface

    • Links to the documentation in the LogScale UI have been fixed to point to the correct pages instead of the library homepage.

  • Automation and Alerts

    • Large query results (more than 1GB) for alerts could cause the query to crash. This issue has been fixed to now handle large alert datasets.

  • Storage

    • Resolved an issue that could cause a Resetting minimum offset due to truncation of the ingest queue warning message.

    • A very rare race condition could cause global transactions to appear to have succeeded when they actually didn't. This issue has now been fixed.

  • Functions

    • In case of invalid input containing unescaped = characters in the parseCEF() function, the entire query execution or parser execution would fail. This issue has been fixed so that parseCEF() now properly recovers from the invalid input and adds an @error field to the event.

Improvement

  • Storage

    • Improve the response time when there's a large number of datasources for:

      • GraphQL calls fetching repository.datasources field

      • api/v1/dataspaces or api/v1/repositories endpoints

  • Functions

    • The groupBy() function now displays a more descriptive error message when the maximum limit is exceeded, specifying the maximum allowed limit for your environment.