Falcon LogScale 1.187.0 GA (2025-05-06)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.187.0GA2025-05-06

Cloud

Next LTSNo1.150.01.177.0No

Available for download two days after release.

Hide file download links

Show file download links

Bug fixes and updates.

Advance Warning

The following items are due to change in a future release.

  • Functions

    • Starting from release 1.195, the query functions asn() and ipLocation() will display an error instead of a warning should an error occur with their external dependency. This change will align their behavior to functions using similar external resources, like match(), iocLookup(), and cidr().

Removed

Items that have been removed as of this release.

Installation and Deployment

  • Support for the HUMIO_DEBUG, JAVA_DEBUG_PORT, DEBUG_SUSPEND_FLAG and JAVA_DEBUG_OPTS environment variables in the LogScale Launcher Script has been removed. If the LogScale process needs to be started in debug mode, set the relevant flags in the HUMIO_OPTS environment variable instead.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The color field on the Role type has been marked as deprecated (will be removed in version 1.195).

  • LogScale is deprecating free-text searches that occur after the first aggregate function in a query. These searches likely did not and will not work as expected. Starting with version 1.189.0, this functionality will no longer be available. A free-text search after the first aggregate function refers to any text filter that is not specific to a field and appears after the query's first aggregate function. For example, this syntax is deprecated:

    logscale Syntax
    "Lorem ipsum dolor" 
| tail(200)         
| "sit amet, consectetur"

    Some uses of the wildcard() function, particularly those that do not specify a field argument are also free-text-searches and therefore are deprecated as well. Regex literals that are not particular to a field, for example /(abra|kadabra)/ are also free-text-searches and are thus also deprecated after the first aggregate function.

    To work around this issue, you can:

    • Move the free-text search in front of the first aggregate function.

    • Search specifically in the @rawstring field.

    If you know the field that contains the value you're searching for, it's best to search that particular field. The field may have been added by either the log shipper or the parser, and the information might not appear in the @rawstring field.

    Free-text searches before the first aggregate function continue to work as expected since they are not deprecated. Field-specific text searches work as expected as well: for example, myField=/(abra|kadabra)/ continue to work also after the first aggregate function.

  • The use of the event functions eventInternals(), eventFieldCount(), and eventSize() after the first aggregate function is deprecated. For example:

    Invalid Example for Demonstration - DO NOT USE
    logscale
    eventSize() | tail(200) | eventInternals()

    Usage of these functions after the first aggregate function is deprecated because they work on the original events, which are not available after the first aggregate function.

    Using these functions after the first aggregate function will be made unavailable in version 1.189.0 and onwards.

    These functions will continue to work before the first aggregate function, for example:

    logscale
    eventSize() | tail(200)

  • The setConsideredAliveUntil and setConsideredAliveFor GraphQL mutations are deprecated and will be removed in 1.195.

  • The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

  • The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

New features and improvements

  • Installation and Deployment

    • The HUMIO_NON_HEAP_SIZE_MB launcher variable now accounts for off-heap memory. Example: if you have 1 CPU core resulting in a reservation of 250MB for off-heap memory, 4GB RAM and have set HUMIO_NON_HEAP_SIZE_MB=500, the launcher will now reserve 3.25GB for the heap, and 250MB for off-heap, leaving 500MB free. Previously, LogScale would reserve 3.5GB for the heap, and 250MB for the off-heap, leaving 250MB free.

  • User Interface

    • Added a failureOrigin field to all logs in the humio-activity repository for filter and aggregate alerts as well as scheduled searches, where status=Failure. The value of the new field can be either System or User, and indicates a best guess as to whether this failure is due to a system error or due to a user error, like for example errors in the query.

  • Storage

    • LogScale now supports Azure bucket storage with account key-based authentication.

      For more information, see Azure Bucket Storage.

  • Ingestion

  • Functions

    • Query functions using files will now report warnings for missing files or other file errors when used in parsers.

      For more information, see Errors, Validation Checks, and Warnings.

    • The ioc:lookup() query function now emits warnings in parsers when there are issues with the IOC service, instead of throwing an error. Errors are still thrown during query execution in case of errors.

      For more information, see Parser Behavior with Missing Database.

Fixed in this release

  • Installation and Deployment

    • The java.logging module has now been included in the bundled JDK. This dependency was erroneously missing and was throwing a NoClassDefFoundErrors error.

  • Administration and Management

    • In Multi-Cluster Search environments, queries could fail to start when attempting to fetch tables. This was caused by the worker cluster incorrectly reporting that the table already existed due to local filesystem/cache of the specific node handling the request, while the table coordinator node (where tables should be fetched from) did not actually have the table. With this fix, LogScale now first checks the availability of the table on the table coordinator node rather than checking on the local node, thus ensuring queries start correctly.

  • User Interface

    • The Export file as CSV option would fail or would yield an empty file when one of the exported fields is a tag field. This issue has now been fixed.

    • Fixed an issue where auto-completion for field names in the Query editor would sometimes be missing.

  • Queries

    • When multiple events have the same timestamp, they are sorted by ID, which could cause an unstable order as well as internal errors for a few queries, due to violated assumptions. This issue has now been fixed.

    • Fixed an issue where a query using a lookup file might fail to start since query dependencies were not propagated in time to query workers. Such a query would be stopped with a Failed to load file or table. Try again shortly message.

    • If a query were to hit an internal error, such as failure to distribute tables, polling such a query would result in a 404 Not Found error. This issue has been fixed so that the correct 5** error is now propagated to the client.

  • Functions

    • The readFile() function has been fixed to now correctly emit warnings that might occur from loading the files requested.

Improvement

  • Storage

    • Heap memory estimation for digesters has been adjusted:

      • Reduced estimated heap memory requirement from 5MB to 1MB per datasource.

      • No impact on runtime behavior

      • Produced warning messages via the DigesterHeapSizeEstimateLogging if the estimated memory requirements are not met.

  • Functions

    • The parseCEF() query function has an improved output message in case of incorrect input conditions.