Falcon LogScale 1.222.0 GA (2026-01-06)
| Version? | Type? | Release Date? | Availability? | End of Support | Security Updates | Upgrades From? | Downgrades To? | Config. Changes? |
|---|---|---|---|---|---|---|---|---|
| 1.222.0 | GA | 2026-01-06 | Cloud | 2027-04-30 | No | 1.150.0 | 1.177.0 | No |
Hide file download links
Download
Use docker pull humio/humio-core:1.222.0 to download the latest version
Bug fixes and updates
Advance Warning
The following items are due to change in a future release.
Security
Starting from LogScale version 1.237, support for insecure
ldapconnections will be removed. Self-Hosted customers using LDAP will only be able to useldapssecure connections.User Interface
From version 1.225.0, LogScale will enforce a new limit of 10 labels that can be added or removed in bulk for assets such as dashboards, actions, alerts and scheduled searches.
Labels will also have a character limit of 60.
Existing assets that violate these newly imposed limits will continue to work until they are updated - users will then be forced to remove or reduce their labels to meet the requirement.
Queries
Due to various upcoming changes to LogScale and the recently introduced regex engine, the following regex features will be removed in version 1.225:
Octal notation
Quantification of unquantifiable constructs
Octal notation is being removed due to logic application difficulties and its tendency to make typographical errors easier to overlook.
Here is an example of a common octal notation issue:
regex/10\.26.\122\.128/In this example,
\122is interpreted as the octal escape forRrather than the intended literal122. Similarly, the.matches not just the punctuation itself but also any single character except for new lines.Any construction of
\xwherexis a number from 1 to 9 will always be interpreted as a backreference to a capture group. If the corresponding capture group does not exist, it will be an error.Quantification of unquantifiable constructs is being removed due to lack of appropriate semantic logic, leading to redundancy and errors.
Unquantifiable constructs being removed include:
^(the start of string/start of line)
$(the end of string/end of line)
?=(a positive lookahead)
?!(a negative lookahead)?<= (a positive lookbehind)
<?<!> (a negative lookbehind)
\b(a word boundary)
\B(a non-word boundary)For example, the end-of-text construct
$*only has meaning for a limited number of occurrences. There can never be more than one occurrence of the end of the text at any given position, making elements like$redundant.A common pitfall that causes this warning is when users copy and paste a glob pattern like
*abc*in as a regex, but delimit the regex with start of text and end of text anchors:regex/^*abc*$/The proper configuration should look like this:
regex/abc/For more information, see LogScale Regular Expression Engine V2.
Deprecation
Items that have been deprecated and may be removed in a future release.
The following GraphQL APIs are deprecated and will be removed in version 1.225 or later:
In the updateSettings mutation, these input arguments are deprecated:
isPackageDocsMessageDismissed
isDarkModeMessageDismissed
isResizableQueryFieldMessageDismissed
On the UserSettings type, these fields are deprecated:
isPackageDocsMessageDismissed
isDarkModeMessageDismissed
Note
The deprecated input arguments will have no effect, and the deprecated fields will always return true until their removal.
The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.
The
EXTRA_KAFKA_CONFIGS_FILEconfiguration variable has been deprecated and planned to be removed no earlier than version 1.225.0. For more information, see RN Issue.
rdns()has been deprecated and will be removed in version 1.249. UsereverseDns()as an alternative function.The Secondary Storage feature is now deprecated and will be removed in LogScale 1.231.0.
The Bucket Storage feature provides superior functionality for storing rarely queried data in cheaper storage while keeping frequently queried data in hot storage (fast and expensive). For more information, see Bucket Storage.
Please contact LogScale support for any concerns about this deprecation.
Known Issues
Storage
For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between
PRIMARY_STORAGE_PERCENTAGEandPRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.
Improvement
Administration and Management
For release 1.222.0, several minor internal changes were completed for processes unrelated to the user's experience.
Recent Package Updates
The following LogScale packages have been updated within the last month.
Package Changes
infoblox/nios has been updated to v1.3.4.
Updated ECS version to 9.2.0
Fixed DNS answers type field mapping to use array notation (dns.answers[0].type)
Updated parser version to 2.2.4
For more information, see Package infoblox/nios Release Notes.
imperva/cloud-waf has been updated to v1.6.0.
Updated ECS version to 9.2.0
Updated CPS version to 1.1.0
Updated parser version to 4.0.0
Enhanced event categorization with improved event.category and event.type arrays
Added comprehensive client, server, and destination field mappings
Improved network type detection for IPv4 and IPv6 addresses
Added observer, network, and URL field mappings
For more information, see Package imperva/cloud-waf Release Notes.
infoblox/nios has been updated to v1.4.0.
Enhanced DHCP parsing with support for BOOTREPLY, BOOTREQUEST, ICMP, and NOT FREE events
Added support for password_expired and logout authentication events in audit logs
Improved field mapping with client.address and server.address normalization
Added transaction.id field mapping for DHCP events
Enhanced DNS parsing with timeout resolution support
Updated parser version to 3.0.0
For more information, see Package infoblox/nios Release Notes.
haproxy/haproxy has been updated to v1.2.3.
Enhanced syslog parsing with improved BSD Syslog format support
Added comprehensive HTTP, TCP, and error log format parsing
Updated ECS version to 9.2.0
Improved field mappings for client, source, destination, and server fields
Added TLS version detection and SSL handshake failure parsing
Enhanced URL parsing with query parameter extraction
Added IP address validation for source and client fields
Improved event categorization and outcome determination
For more information, see Package haproxy/haproxy Release Notes.
cisco/firepower has been updated to v1.7.6.
Updated parser version to 3.3.6
Enhanced key-value parsing for events 430001-430007 to better handle UserAgent field extraction
Improved regex pattern to handle complex field values with commas and special characters
For more information, see Package cisco/firepower Release Notes.
f5networks/bigip has been updated to v3.0.0.
Updated to support RFC 5424 syslog format
Added checks to ensure IPs are valid prior to assignment
Improved parsing around login/logout events
For more information, see Package f5networks/bigip Release Notes.
aruba/clearpass has been updated to v1.4.0.
Updated ECS version to 9.2.0 and parser version to 3.0.0
Enhanced field mapping with improved address handling using client.address, source.address, and server.address fields
Improved MAC address formatting with dash separators and uppercase conversion
Changed event.id to event.code for better ECS compliance
Enhanced observer IP handling with array support
Improved address validation with CIDR checking and domain/IP separation
Fixed AD/LDAP event outcome mapping from success to failure
Enhanced event type mapping for authentication requests and file transfer operations
Removed redundant array drops for better performance
For more information, see Package aruba/clearpass Release Notes.
cloudflare/zerotrust has been updated to v2.1.0.
Modified risk score to severity mapping: 1-20 (severity 70), 21-50 (severity 50), 51-80 (severity 30), 81-100 (severity 10)
Updatedparser version to 4.1.0
For more information, see Package cloudflare/zerotrust Release Notes.
cisco/ios has been updated to v1.9.0.
Breaking Change: Fixed server.domain field assignment typo
Potentially Breaking Change: Improved ACCOUNTING event parsing with key-value extraction for better field normalization
Potentially Breaking Change: Improved network transport protocol normalization to lowercase
Enhanced regex patterns to support alphanumeric severity codes (A-Z0-7) for broader log format compatibility
Added new timestamp format support for logs with year prefix (yyyy MMM dd HH:mm:ss)
Added severity code remapping values to standard numeric codes
Enhanced SYSTEM_MSG event parsing with support for authentication failures, file errors, and general error messages
Added support for ENCRYPTED, ELEMENT_CRITICAL, FAIL_CONFIG, and NATIVE_VLAN_MISMATCH event types
Updated parser version to 2.8.0
For more information, see Package cisco/ios Release Notes.
akamai/asec has been updated to v1.2.0.
Enhanced parser with comprehensive field extraction and decoding capabilities
Added support for HTTP request and response header parsing
Implemented advanced categorization logic based on WAF actions and response codes
Added geolocation and network type detection for IPv4 and IPv6 addresses
Enhanced rule field mappings with decoded attack data
Improved TLS version parsing and HTTP/2 protocol detection
Updated ECS version to 9.2.0 and CPS version to 1.1.0
Added user agent extraction and network bytes calculation
For more information, see Package akamai/asec Release Notes.
cisco/meraki has been updated to v1.5.4.
Enhanced firewall flow parsing with improved regex pattern for better action extraction
Added support for pattern-based action determination (0/1 and allow/deny patterns)
Improved handling of firewall events with more robust field extraction
For more information, see Package cisco/meraki Release Notes.
fortinet/fortigate has been updated to v2.2.0.
Enhanced event categorization with improved network session and connection type mapping
Added comprehensive event.type array population based on event.action and session context
Improved source and destination address handling with lowercase normalization
Enhanced destination port mapping to include additional vendor fields (Vendor.dpt)
Updated event.action priority logic to handle UTM block actions specifically
Refined network protocol detection and event type classification
Updated parser version to 5.0.0
For more information, see Package fortinet/fortigate Release Notes.
zscaler/internet-access has been updated to v2.1.0.
Enhanced firewall event categorization with improved event.type arrays for connection events
Added event.outcome field mapping for web events based on action types
Improved file field handling logic with better conditional checks for filename presence
Updated file.name field to use coalesce function for better fallback handling
Enhanced firewall events with intrusion detection categorization for IPS actions
Enhanced HTTP response status code validation to exclude wildcard and "NA" values
Added event.type arrays for DNS and tunnel events to improve event classification
Updated parser version to 4.0.0
For more information, see Package zscaler/internet-access Release Notes.
infoblox/nios has been updated to v1.3.5.
Enhanced DNS query parsing to support view-specific queries with improved regex pattern
Added support for extracting view information from DNS messages
Fixed network transport protocol normalization to lowercase format
Updated parser version to 2.2.5
For more information, see Package infoblox/nios Release Notes.
fortinet/fortigate has been updated to v2.1.0.
Enhanced CEF parsing with improved priority handling and format normalization
Fixed CEF header format by replacing "CEF: 0" with "CEF:0" for proper parsing
Reordered parsing logic to prioritize CEF format detection before syslog priority extraction
Improved source.address field mapping with enhanced coalesce logic to preserve existing values
Updated parser version to 4.2.0
For more information, see Package fortinet/fortigate Release Notes.
cisco/ios has been updated to v1.8.0.
Enhanced timezone extraction from timestamp field to improve parsing accuracy
Added conditional logic to extract timezone information when not already present
Alias source/destination/client/server .ip fields to .address fields, checking if valid ip prior to assignment
Improve parsing for CONFIG events
Add parsing for TRUSTPOOL_EXPIRATION_WARNING events
Updated parser version to 2.7.0
For more information, see Package cisco/ios Release Notes.
palo-alto/prisma-sd-wan has been updated to v1.3.0.
Updated parser version to 3.0.0 with enhanced field mapping and categorization
Improved ECS compliance with version 9.2.0 and CPS version 1.1.0
Enhanced event categorization with dynamic array-based event.category and event.type fields
Added comprehensive IP address validation using CIDR functions
Improved zbfw_classification_rules parsing with JSON structure support
Enhanced authentication failure detection and message parsing
Added client/server field mappings for non-flow events
Improved event outcome determination based on various conditions
Enhanced regex patterns for better log parsing accuracy
Added support for multiple authentication scenarios and connection events
For more information, see Package palo-alto/prisma-sd-wan Release Notes.
microsoft/windows-dns-debug has been updated to v1.5.1.
Enhanced timestamp parsing to support additional date format (d/M/yyyy HH:mm:ss)
Improved regex pattern for PACKET log entries to handle multiple timestamp formats
Fixed timestamp parsing for LOOKUP operation logs
Updated parser version to 2.4.1
For more information, see Package microsoft/windows-dns-debug Release Notes.
microsoft/dhcp-client has been updated to v1.1.3.
Updated parser version to 1.2.0
Enhanced ECS version to 9.2.0
Updated CPS version to 1.1.0
Added comprehensive event categorization using array:append
Implemented event severity mapping based on Windows event levels
Added error field mappings for error codes and messages
Enhanced host field mappings with hostname normalization
Added source and client field mappings for DHCP client identification
Implemented IP address validation and filtering
Added process thread ID mapping
Removed deprecated windows-dhcpclient.yaml parser file
Updated minimum LogScale version requirement to 1.207.0
For more information, see Package microsoft/dhcp-client Release Notes.