Falcon LogScale 1.250.0 GA (2026-07-21)
| Version? | Type? | Release Date? | Availability? | End of Support | Security Updates | Upgrades From? | Downgrades To? | Config. Changes? |
|---|---|---|---|---|---|---|---|---|
| 1.250.0 | GA | 2026-07-21 | Cloud | Next LTS | No | 1.177.0 | 1.177.0 | No |
Hide file download links
Download
Use docker pull humio/humio-core:1.250.0 to download the latest version
Bug fixes and updates
Advance Warning
The following items are due to change in a future release.
Installation and Deployment
We are decommissioning the the Nexus server used to host Java-based LogScale installation binaries, with a tentative decommission date of August 14, 2026. To download Java-based LogScale installers, please send a request to logscalesuccess@crowdstrike.com to obtain a username & API token, which are required to download from our new distribution platform.
Documentation
Our documentation homepage, functionality, and content will undergo a series of improvements before the end of August 2026. As the volume of content on the site has grown significantly, we recognize that finding the right information can be challenging. These changes are designed to improve navigation, make content easier to find, and provide clearer distinctions between content areas.
Functionality and Navigation
New Default Homepage โ Improved navigation and organization to help you find information more quickly. The existing legacy homepage will remain available.
Curated Content Pages โ Topic-specific pages that provide key resources tailored to different areas of the documentation. Each page includes:
Search scoped to that specific content area
Highlights of new and recently updated pages
Guided Workflow Pages โ Step-by-step, page-by-page guides to help you learn about specific areas of LogScale.
Bookmark Groups โ Organize bookmarks into custom groups to create your own categorized link collections.
Page Watching and Notifications โ Monitor pages and content for changes, so you're always aware of updates to the content you use most.
Custom Homepage โ Set a Curated Content page as your homepage, so visiting library.humio.com takes you directly to your preferred content area.
Content Improvements
New CrowdStrike Query Language (CQL) Manual โ A standalone manual covering:
Query structure and execution context
Internal data representation
Datatypes used in queries and functions
Function types, input and output values, and related functions
Common query patterns organized by use case and challenge
Guides for translating SQL to CQL
New Getting Data Out Manual โ Covers the different ways to extract information from LogScale, including APIs, the search interface, dashboards, and automation.
New Getting Data In Manual โ Covers the methods, tools, and integrations available for ingesting data into LogScale.
New Administration Manuals โ Separate, dedicated manuals for Self-Hosted and Cloud customers.
We will provide updates as each improvement becomes available โ we welcome your feedback as the changes roll out.
API
Starting in version 1.258, the
queryjobsendpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameterQueryResultRowCountLimithas been raised from its default value, this will initially be the entire result.All clients should begin transitioning to use the paginated polling method ahead of version 1.258.
Deprecation
Items that have been deprecated and may be removed in a future release.
The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.
Behavior Changes
Scripts or environment which make use of these tools should be checked and updated for the new configuration:
GraphQL API
After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:
recoverOrganization โ Restores the organization to visible state.
rollbackOrganization โ Fully deletes the organization under certain conditions and permissions.
Previously, you could call any mutation on a soft-deleted organization.
Fixed in this release
Security
The constraint that required email domains to be unique has been removed for Identify Provider (IDP) configurations on clusters that use URL subdomains. SAML no longer requires unique domains in Distributed Cluster (DC) configurations.
GraphQL API
The GraphQL endpoint analyzeQuery() has been updated to include a revised error recovery strategy that allows it to stop earlier when encountering an error. In cases of multiple errors, fewer error reports may be observed as a result. Behavior for successfully executed cases remains unaffected.
Storage
Fixed an issue in bucket storage download code that could cause unnecessary segment downloads that were already present locally when those segments did not have auxiliary files associated with them.
API
Fixed an issue where the update process for lookup files via the Lookup API
/filesendpoint would clear any labels added to the file. Labels, key columns, and watermark information are now correctly preserved when patching a file.
Ingestion
Fixed an issue where a parser error was causing field-operator expressions to be parsed incorrectly within filter contexts. These expressions were incorrectly handled in cases where they appeared parenthetically or when located on the left side of
or/andexpressions, such ascode=~ /5../ or error=true.
Queries
Fixed an issue where queries with large
join()subquery results could cause the node to crash during query submission from the query coordinator to worker nodes.
Metrics and Monitoring
Fixed an issue where the log field percentageOfMappingTimeSpentThrottledDueToQueryPermits would sometimes return a value of
NaN(Not a Number) due to a potential division by zero.
Known Issues
Storage
For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between
PRIMARY_STORAGE_PERCENTAGEandPRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.
Improvement
Security
Token-based request performance has been improved by caching computed permission assignments on a per-request basis instead of recomputing them with every permission check. Additional performance improvements have also been made for verification checks that confirm whether any kind of permissions exist on read-only token requests.
The creation of certain permission assignment sets has been optimized to avoid continual re-enlargement.
API
The
GET /api/v1/bucket-storage-targetAPI has been updated to return the count of bale lookup files using the field baleLookupFilesUsingBucket for each bucket entity.
Ingestion
In order to improve efficiency, the process of writing lookup files and table structures to CSV has been adjusted to serialize data in increments of 64 MB. This allows the system to retain only a portion of serialized data in memory at any one time.
Queries
A limit has been introduced for the number of saved query expansions allowed during query submission. Queries that attempt to expand more saved queries than the configured limit will be rejected.
Fleet Management
Multiple improvements have been made to the Fleet Management groups dialog:
Column selection has been introduced for the collectors table.
OS and Collector ID columns have been added to the collectors table.
The non-queryable platform field has been removed from the help text.
Metrics and Monitoring
Query cost metrics have been extended to include the new category resultPostProcess, which is now included in the total query cost.
As a result, the total reported cost will be negligibly higher compared to previous versions.
Recent Package Updates
The following LogScale packages have been updated within the last month.
Package Changes
zscaler/internet-access has been updated to v2.1.3.
Enhanced firewall event categorization with improved match syntax for better performance
Updated event.action matching logic to include "bypassed" actions as allowed events
Improved conditional logic structure using match syntax instead of case statements
Updated ECS version to 9.3.0 and CPS version to 1.2.0
Updated parser version to 4.0.3
For more information, see Package zscaler/internet-access Release Notes.
cisco/meraki has been updated to v2.0.2.
Refactored parser logic to use match expressions for improved readability and performance
Added support for anyconnect_vpn_session_manager event type with session ID and user extraction
Enhanced case statement structure for better maintainability
Improved pattern matching efficiency in event type determination
For more information, see Package cisco/meraki Release Notes.
cisco/ios has been updated to v1.10.1.
Enhanced regex patterns to handle optional carriage return characters at end of log messages for improved parsing reliability
For more information, see Package cisco/ios Release Notes.
aruba/clearpass has been updated to v1.4.1.
Added support for log4j format parsing with new regex pattern
Updated parser version to 3.0.1
Updated ECS version to 9.3.0 and CPS version to 1.2.0
For more information, see Package aruba/clearpass Release Notes.
dell/isilon has been updated to v1.3.1.
Updated parser version to 1.2.1
Enhanced regex pattern for uid and sid field extraction to handle non-numeric values using [^;]* pattern instead of \d+
Added new test case for handling SID values with alphanumeric format (SID:S-1-22-1-0)
Improved parsing reliability for API audit logs with complex user identifiers
For more information, see Package dell/isilon Release Notes.