Falcon LogScale 1.252.0 GA (2026-08-04)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.252.0GA2026-08-04

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Functions

    • LogScale LTS version 1.258 will include a breaking change to subquery semantics for the worldMap() and sankey() functions. Result fields will no longer be automatically detected, and results must be assigned to a specific field - magnitude for worldMap() and weight for sankey() respectively.

      This change avoids unpredictable behavior in sub-queries, and allows further development on related systems. The following is an example of a query that is impacted by this change:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })

      Currently, the query will be interpreted as:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | magnitude := sum(w_squared) })

      From version 1.258, the math:sqrt part of the query will no longer be discarded.

Advance Warning

The following items are due to change in a future release.

  • Documentation

    • Our documentation homepage, functionality, and content will undergo a series of improvements before the end of August 2026. As the volume of content on the site has grown significantly, we recognize that finding the right information can be challenging. These changes are designed to improve navigation, make content easier to find, and provide clearer distinctions between content areas.

      Functionality and Navigation

      • New Default Homepage โ€” Improved navigation and organization to help you find information more quickly. The existing legacy homepage will remain available.

      • Curated Content Pages โ€” Topic-specific pages that provide key resources tailored to different areas of the documentation. Each page includes:

        • Search scoped to that specific content area

        • Highlights of new and recently updated pages

      • Guided Workflow Pages โ€” Step-by-step, page-by-page guides to help you learn about specific areas of LogScale.

      • Bookmark Groups โ€” Organize bookmarks into custom groups to create your own categorized link collections.

      • Page Watching and Notifications โ€” Monitor pages and content for changes, so you're always aware of updates to the content you use most.

      • Custom Homepage โ€” Set a Curated Content page as your homepage, so visiting library.humio.com takes you directly to your preferred content area.

      Content Improvements

      • New CrowdStrike Query Language (CQL) Manual โ€” A standalone manual covering:

        • Query structure and execution context

        • Internal data representation

        • Datatypes used in queries and functions

        • Function types, input and output values, and related functions

        • Common query patterns organized by use case and challenge

        • Guides for translating SQL to CQL

      • New Getting Data Out Manual โ€” Covers the different ways to extract information from LogScale, including APIs, the search interface, dashboards, and automation.

      • New Getting Data In Manual โ€” Covers the methods, tools, and integrations available for ingesting data into LogScale.

      • New Administration Manuals โ€” Separate, dedicated manuals for Self-Hosted and Cloud customers.

      We will provide updates as each improvement becomes available โ€” we welcome your feedback as the changes roll out.

  • API

    • Starting in version 1.258, the queryjobs endpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameter QueryResultRowCountLimit has been raised from its default value, this will initially be the entire result.

      All clients should begin transitioning to use the paginated polling method ahead of version 1.258.

Removed

Items that have been removed as of this release.

GraphQL API

  • The deprecated GraphQL mutation updateScheduledSearchV2 has been removed.

Configuration

Other

  • The feature flag RefreshClusterManagementStatsInUnregisterNode has been removed per the announcement in version 1.243.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • The following libraries have been upgraded to address security vulnerabilities:

      • Netty upgraded to 4.2.16.Final.

      • Jackson Java upgraded to 2.22.1.

      For more information regarding the Netty update, refer to their documentation here.

      For more information regarding the Jackson update, refer to their documentation refer to their documentation here.

  • User Interface

    • LogScale's UI timezone database has been upgraded to Internet Assigned Numbers Authority (IANA) version 2026c. For more information regarding the IANA update, refer to IANA's documentation here.

New features and improvements

Fixed in this release

  • Storage

    • Fixed an issue where the component RegisterLocalSegmentsJob was not shut down in the correct order relative to other components, causing spurious error log entries during node termination for self-hosted users.

    • Fixed an issue that could cause slow replication of segments after a node restart.

  • Queries

    • Fixed an issue where live queries using a match() function could retain outdated table information, leading to higher memory use.

    • Fixed an issue where the results of multi-cluster search queries using readFile() and createEvents() would sometimes be missing the digestInfo field.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Automation and Triggers

    • The Scheduled reports section located in the Automation menu now includes a column labeled Last report attempt, which displays when the most recent report generation was sent to the render service, and eliminates uncertainty regarding whether the report is running.

    • Scheduled reports are now more resilient to transient failures, and are no longer permanently disabled due to temporary connectivity issues or render timeouts. Previously, network disruptions between the PDF render service and LogScale could cause a report to be immediately and permanently disabled, requiring manual reenablement.

      Transient failures are now retried with exponential backoff - if retries are exhausted, the report is rescheduled to its next execution window. A warning is also provided in the report's execution status to notify users when an execution was skipped.

      Reports are still disabled for genuinely unrecoverable errors, such as a deleted dashboard or an invalid query configuration.

  • Storage

    • LogScale now logs how much time is spent downloading global snapshots during boot in milliseconds (ms).

      An example log entry might look something like this:

      Fetched a global snapshot from bucket storage. timeSpentDownloadingMs=1000

    • Logs produced during segment download from another node in the cluster now include timing fields, indicating how much time the download spent queued in milliseconds (ms), and how much time was spent performing the download.

      An example log entry might look something like this:

      Fetched segment ... timeSpentDownloadingMs=5000 timeSpentQueuedMs=1000 timeSpentOnAllDownloadAttemptsMs=5000

    • The logs produced during segment download from bucket storage now include fields indicating how much time in milliseconds (ms) the download spent queued, and how much time was spent performing the download.

      An example log entry might look something like this:

      Download from bucket completed for raw segment ... timeSpentQueuedMs=1000 timeSpentDownloadingMs=5000"

  • Configuration

    • Introduced the dynamic configuration parameter MaxTableForQuerySizeBytes, which limits loaded file and table size for query use cases. This protects the cluster from using tables that are excessively large.

      The default value is set to twice the CSV file size limit configured for the cluster, which is determined by CsvFileSizePerOrgOverrideLimit and/or the dynamic configuration parameter MaxCsvFileUploadSizeBytes to avoid rejecting files that only slightly exceed the limit.

  • Ingestion

    • User and Entity Behavior Analytics (UEBA) files are now updated every 10 minutes via a lightweight update mechanism, replacing the previous update interval of every 2 hours.

  • Packages

    • Error messages have been improved when installing and/or udpating packages in the following ways:

      • Parse errors now identify the specific file within the zip archive that failed validation.

      • Installation errors now identify the entity type and name that caused the failure, for example: Failed to install AggregateAlert 'My Alert': Expected an expression.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • cisco/meraki has been updated to v2.0.3.

      • Fixed content_filtering_block parsing to use flexible key-value extraction instead of a rigid positional regex, allowing optional fields such as category0 between url= and server= to be handled without breaking the match

      • Updated server.ip and server.port extraction for content_filtering_block to split from the combined Vendor.server value produced by kvParse

      • Added user.name mapping from Vendor.user for content_filtering_block events

      • Added host.name mapping from Vendor.clientName for File Scanned events

      For more information, see Package cisco/meraki Release Notes.

    • zscaler/private-access has been updated to v1.5.2.

      • Refactored user field handling into a unified post-processing block applied across all log types

      • User identity fields (user.email, user.name, user.domain) are now resolved from a consolidated coalesce of Vendor.User, Vendor.NameID, Vendor.Username, and Vendor.suser

      • When the resolved username contains @, user.email is set and user.name and user.domain are extracted via regex

      • user.id is now assigned using coalesce([Vendor.ModifiedBy, user.email]) for all log types

      • Removed per-dataset inline user field assignments from audit, browser-access, user-activity, and user-status log type handlers

      • Updated ECS version to 9.4.0

      • Updated CPS version to 1.2.0

      For more information, see Package zscaler/private-access Release Notes.

    • cisco/ios has been updated to v1.11.0.

      • Added support for AireOS/WLC (Wireless LAN Controller) style log headers with new regex pattern

      • Added parsing for DISC_INTF_ERR2 events for AP discovery request failures on wrong VLANs

      • Added parsing for DISC_AP_MGR_ERR1 events for AP manager discovery failures

      • Added parsing for MOBILESTATION_NOT_FOUND events for mobile station database lookup failures

      • Added parsing for Q_IND events for association request failures with client limit reached

      • Enhanced MAC address normalization to convert colon-separated format to dash-separated uppercase format

      • Reverted recent timezone handling change to ensure event timezone is prioritized over data connector timezone selection

      • Updated ECS version to 9.4.0

      • Updated CPS version to 1.2.0

      For more information, see Package cisco/ios Release Notes.

    • zscaler/internet-access has been updated to v2.1.4.

      • Consolidated user field handling into a unified post-processing block after all sourcetype-specific logic, replacing per-sourcetype user field extraction

      • Added user.id field assignment set equal to user.email when a valid email is detected

      • Removed per-sourcetype user field case blocks from zscalernss-dns, zscalernss-fw, zscalernss-web, zscalernss-tunnel, and zscalernss-casb sections

      • User resolution now uses coalesce([Vendor.elogin, Vendor.login, Vendor.user, Vendor.adminid]) across all sourcetypes

      • Updated ECS version to 9.4.0

      • Updated parser version to 4.0.4

      For more information, see Package zscaler/internet-access Release Notes.