Falcon LogScale 1.199.0 GA (2025-07-29)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.199.0GA2025-07-29

Cloud

2026-09-30No1.150.01.177.0No

Available for download two days after release.

Hide file download links

Show file download links

Bug fixes and updates

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

  • The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

  • rdns() has been deprecated and will be removed in version 1.249. Use reverseDns() as an alternative function.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Installation and Deployment

    • When using KAFKA_MANAGED_BY_HUMIO=true, LogScale will now crash on boot if it fails to determine whether its topics exist in Kafka via Kafka's admin API. Previously, LogScale would assume the topics didn't exist and attempt to create them, resulting in confusing error messages if the topics actually existed.

  • GraphQL API

    • Setting the MaxRelocatedDatasourcesInGlobal field of the DynamicConfig datatype to 0 or negative value now sets the limit to 0 instead of resetting to the default value. Users wishing to return to the default value should use the API to unset the configuration.

  • Packages

    • Custom packages now require a more strict folder structure to ensure consistency and reliability:

      • The manifest.yaml file can be located anywhere in the project, and its location defines the package root.

      • All asset folders (such as parsers, alerts, and actions) must be directly located in the project root.

New features and improvements

  • Functions

    • Added text:startsWith() which can be used to test whether a field or string constant contains a specific prefix.

    • Added text:endsWith() which can be used to test whether a field or string constant contains a specific suffix.

Fixed in this release

  • Functions

    • The correlate() function has been fixed as conditional statements (such as case / if) with field assignments incorrectly included fields from all branches in the output, rather than only fields from the executed branch.