Falcon LogScale 1.201.0 GA (2025-08-12)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.201.0GA2025-08-12

Cloud

2026-09-30No1.150.01.177.0No

Available for download two days after release.

Hide file download links

Show file download links

Bug fixes and updates

Removed

Items that have been removed as of this release.

GraphQL API

  • Removed the deprecated field lastScheduledSearch on the GraphQL mutation ScheduledSearch.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • AUTOSHARDING_MAX configuration variable is now being deprecated and will be removed in version 1.207.

  • The lastScheduledSearch field from the ScheduledSearch datatype is now deprecated and planned for removal in LogScale version 1.202. The new lastExecuted and lastTriggered fields have been added to the ScheduledSearch datatype to replace lastScheduledSearch.

  • The EXTRA_KAFKA_CONFIGS_FILE configuration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.

  • rdns() has been deprecated and will be removed in version 1.249. Use reverseDns() as an alternative function.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

New features and improvements

  • Automation and Triggers

    • It is now possible for LogScale to distribute the execution of scheduled searches running more frequently than every hour across different minutes using H/n notation in cron schedules. For example, use H/5 for a search that should run every 5 minutes.

      Supported intervals: every 2, 3, 4, 5, 6, 10, 12, 15, 20, or 30 minutes.

      Note

      Changing an existing scheduled search from */5 to H/5, for example, may result in two runs that either overlap or have a gap between them.

      For example, if the updated schedule for the scheduled search runs at 3 minutes, 8 minutes, and so on, and you make the change after the run at 0:00 with the old schedule, but before 0:03, then you will get a new run at 0:03. The time from 0:03 to 0:05 is covered by both runs. If you instead make the change after 0:03, but before 0:05, the next run will be at 0:08, meaning that the time between 0:05 and 0:08 is not searched by any run.

      For more information, see Cron Scheduling.

  • GraphQL API

Fixed in this release

  • Storage

    • Fixed an issue causing the creation of 140,000 datasources in global when repositories hit the max datasource limit. When the limit is hit, LogScale now directs events into an "overflow datasource" with a fixed set of tags. This overflow datasource will now shard itself as necessary to keep up with digest, consistent with the behavior of all other datasources.

      For more information, see Ingestion: Ingest Phase.

  • Functions

    • Fixed the defineTable() and join() functions as subqueries would use an incorrect search interval when using @ingesttimestamp.

    • Fixed an issue where identifiers with array indices (for example, foo[0] and abc.foo[0].bar[2]) were incorrectly rejected on the right side of the link operator ( <=> ) when using the correlate() function.

Improvement

  • Storage

    • Improved S3 download efficiency by optimizing data streaming and download management, delivering significant performance improvements across memory utilization, garbage collection, and network throughput.

      Internal load tests show that memory usage no longer spikes and remains stable during heavy downloads, resulting in significantly less CPU load and approximately 20% faster download speeds.

      For more information, see Ingestion: Storage Phase.

  • Queries

    • Improved performance by compiling queries once instead of twice when submitting a scheduled search job.

      For more information, see Triggers.

  • Functions