Falcon LogScale 1.243.0 GA (2026-06-02)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.243.0GA2026-06-02

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Deprecation

Items that have been deprecated and may be removed in a future release.

New features and improvements

  • API

    • The following endpoint has been added:

      POST /api/v1/repositories/{repo}/queryjobs/{id}/newclient

      This endpoint creates a new client for an existing query, allowing multiple independent consumers to poll the same query session.

Fixed in this release

  • Administration and Management

    • Fixed an issue where removing a node using the Cluster administration menu, with the REST endpoint DELETE /api/v1/clusterconfig/members/<node_id>, or with GraphQL API using the mutation clusterUnregisterNode could lead to data loss, even when the flag force/accept-data-loss was not set.

      A validation step has also been added that ensures data is properly replicated before allowing node removal, which may slightly slow the operation.

      The fix can be disabled via the feature flag RefreshClusterManagementStatsInUnregisterNode, which is scheduled for removal in version 1.252. If issues arise that lead to the need to disable the feature flag, inform support.

      For more information, see Best Practice: Contacting Support.

  • User Interface

    • Fixed an issue where recalling a recent query would incorrectly display results as an event list instead of auto-selecting the appropriate visualization.

  • Queries

    • Fixed an issue where, in rare cases, queries could go missing when reusing query sessions and submitting identical queries close together, causing a race condition.

  • Auditing and Monitoring

    • An issue has been fixed where audit log entries exceeding 16KB would be truncated with an ellipsis character (...), causing the resulting JSON to be unparseable. The maximum string length for audit log JSON output has also been increased to 900KB.

  • Functions

    • The parseLEEF() function now correctly adds error messages to the @error_msg[] field when failing to parse. This aligns error reporting with other parse functions.

    • The sankey() function now displays a more specific warning when the number of source-target flows exceed the limit, instead of showing the more generic groupBy() function limit warning.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • User Interface

    • Recent queries are now saved after the first results arrive rather than immediately after a search is initiated. This allows the system to correctly determine whether to store the current widget type for manually selected visualizations, or omit it for auto-detected visualizations, ensuring recalled queries display with the correct visualization.

  • Storage

    • A new environment variable, S3_STORAGE_STREAM_IDLE_TIMEOUT_SECONDS, has been introduced. The environment variable ensures that if an Amazon S3 provider fails to send any data for the configured time duration, the transfer is aborted instead of hanging indefinitely and blocking other transfers from being scheduled. When using this variable, it's important to note the following:

      • If not defined, the default duration value is 180 seconds.

      • This environment variable controls the stream idle timeout for both upload and download times.

      • While the timeout mechanism was already in place for S3 upload, it was not previously present for S3 download.

  • Configuration

    • The following environment variables have been added to control start rate limiting for the query coordinator:

      These environment variables allow for controlling an existing mechanism. No new mechanism is introduced. If these limits are reached, queries are delayed and do not start execution until later.