Falcon LogScale 1.254.0 GA (2026-08-18)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.254.0GA2026-08-18

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Functions

    • LogScale LTS version 1.258 will include a breaking change to subquery semantics for the worldMap() and sankey() functions. Result fields will no longer be automatically detected, and results must be assigned to a specific field - magnitude for worldMap() and weight for sankey() respectively.

      This change avoids unpredictable behavior in sub-queries, and allows further development on related systems. The following is an example of a query that is impacted by this change:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })

      Currently, the query will be interpreted as:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | magnitude := sum(w_squared) })

      From version 1.258, the math:sqrt part of the query will no longer be discarded.

Advance Warning

The following items are due to change in a future release.

  • Documentation

    • Our documentation homepage, functionality, and content will undergo a series of improvements before the end of August 2026. As the volume of content on the site has grown significantly, we recognize that finding the right information can be challenging. These changes are designed to improve navigation, make content easier to find, and provide clearer distinctions between content areas.

      Functionality and Navigation

      • New Default Homepage โ€” Improved navigation and organization to help you find information more quickly. The existing legacy homepage will remain available.

      • Curated Content Pages โ€” Topic-specific pages that provide key resources tailored to different areas of the documentation. Each page includes:

        • Search scoped to that specific content area

        • Highlights of new and recently updated pages

      • Guided Workflow Pages โ€” Step-by-step, page-by-page guides to help you learn about specific areas of LogScale.

      • Bookmark Groups โ€” Organize bookmarks into custom groups to create your own categorized link collections.

      • Page Watching and Notifications โ€” Monitor pages and content for changes, so you're always aware of updates to the content you use most.

      • Custom Homepage โ€” Set a Curated Content page as your homepage, so visiting library.humio.com takes you directly to your preferred content area.

      Content Improvements

      • New CrowdStrike Query Language (CQL) Manual โ€” A standalone manual covering:

        • Query structure and execution context

        • Internal data representation

        • Datatypes used in queries and functions

        • Function types, input and output values, and related functions

        • Common query patterns organized by use case and challenge

        • Guides for translating SQL to CQL

      • New Getting Data Out Manual โ€” Covers the different ways to extract information from LogScale, including APIs, the search interface, dashboards, and automation.

      • New Getting Data In Manual โ€” Covers the methods, tools, and integrations available for ingesting data into LogScale.

      • New Administration Manuals โ€” Separate, dedicated manuals for Self-Hosted and Cloud customers.

      We will provide updates as each improvement becomes available โ€” we welcome your feedback as the changes roll out.

  • GraphQL API

  • API

    • Starting in version 1.258, the queryjobs endpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameter QueryResultRowCountLimit has been raised from its default value, this will initially be the entire result.

      All clients should begin transitioning to use the paginated polling method ahead of version 1.258.

Removed

Items that have been removed as of this release.

GraphQL API

  • The GraphQL field remoteServerCompatVersion has been removed from the datatype RemoteClusterConnectionStatus in the GraphQL API. This field has been deprecated for some time, and marked for deletion after version 1.207.0.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The GraphQL mutation deleteFeatureFlag has been deprecated and a new mutation, resetFeature, has been introduced with similar behavior and a clearer name.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

New features and improvements

  • Dashboards and Widgets

    • Dashboards now have an Update from template action in the โ‹ฎ menu. It opens a dialog where a YAML template can be dragged and dropped (or browsed for) to replace the dashboard's content in place.

      The dashboard retains its existing ID and URL, so any links, bookmarks, or references to it continue to work. The action is available for any dashboard with edit permission, regardless of whether it was installed from a package.

      For more information, see Manage individual dashboards.

Fixed in this release

  • User Interface

    • Fixed an issue where the LogScale UI was using the incorrect name for lookup file actions in the Filter menu located in the Actions view under Automation, causing an incorrect number of results.

  • Storage

    • Fixed an issue where cancelled queries requiring segment downloads from bucket storage could lead to concurrent segment downloads above configured limits.

    • Fixed an issue where query segment fetches could potentially starve segment fetches required for bucket storage upload during rolling cluster upgrades due to deprioritization.

  • Queries

    • Fixed an issue with queries using defineTable(), where the percentage value of the GraphQL parameter workDone could decrease if a subquery was restarted while the main query was still running.

    • Fixed an issue where queries containing the functions defineTable() or remotetable() would receive an initial estimated cost of 0. The main query will now have a cost of 2 KB per subquery defined.

  • Metrics and Monitoring

    • Fixed an issue where the metric temp-disk-usage-bytes would sometimes spuriously report a 0 value.

  • Packages

    • Fixed an issue where package exports containing saved queries and/or dashboards using a fixed start time and a relative end time such as now would incorrectly fix the end time to the moment of export, breaking the export/install.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • GraphQL API

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Configuration

    • The maximum number of scheduled reports per view is now configurable. Previously, the limit was hard-coded to 20 scheduled reports per view. It can now be adjusted using two dynamic configurations, set with the GraphQL mutation setDynamicConfig. This process (requires root-level access; LogScale Cloud customers should contact Support to have the limit changed):

      The default limit is unchanged at 20, so there is no change in behavior unless one of these configurations is set.

      The format of MaxScheduledReportsPerViewPerOrgOverride is semicolon-separated CID:LIMIT entries, where CID is the organization ID. For example: CID_X:50;CID_Y:60. Spaces and trailing semicolons must not be included - if the value cannot be parsed, the entire override is ignored (a warning is logged) and MaxScheduledReportsPerView applies to all organizations.

      Lowering the limit below the number of reports a view already has does not delete or disable those reports. Existing reports can still be edited, but no new ones can be created until the count is below the limit.

      Either configuration can be reverted to the default with the mutation unsetDynamicConfig.

  • Queries

    • Introduced a limit for the format() function that checks the total length of the result at submission/compilation. If the calculated length is above the limit, the query will fail. At this time, the limit is 10 MB.

      For example, if you write a query using format() like the following example, it will fail, because the calculated length is above the limit: 

      (format="%.1048575s %<1048575s")

      However, if you write the query like the following example instead, the query will not fail, beause we do not statically know whether the length is above the limit: 

      format(format="%.s %<s")