Falcon LogScale 1.256.0 GA (2026-09-01)
| Version? | Type? | Release Date? | Availability? | End of Support | Security Updates | Upgrades From? | Downgrades To? | Config. Changes? |
|---|---|---|---|---|---|---|---|---|
| 1.256.0 | GA | 2026-09-01 | Cloud | Next LTS | No | 1.177.0 | 1.177.0 | No |
Hide file download links
Download
Use docker pull humio/humio-core:1.256.0 to download the latest version
Bug fixes and updates
Breaking Changes
The following items create a breaking change in the behavior, response or operation of this release.
Functions
LogScale LTS version 1.258 will include a breaking change to subquery semantics for the
worldMap()andsankey()functions. Result fields will no longer be automatically detected, and results must be assigned to a specific field - magnitude forworldMap()and weight forsankey()respectively.This change avoids unpredictable behavior in sub-queries, and allows further development on related systems. The following is an example of a query that is impacted by this change:
logscaleworldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })Currently, the query will be interpreted as:
logscaleworldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | magnitude := sum(w_squared) })From version 1.258, the
math:sqrtpart of the query will no longer be discarded.
Advance Warning
The following items are due to change in a future release.
GraphQL API
The mutation deleteFeatureFlag will be removed from the code in LTS 1.270. It is replaced by resetFeature.
API
Starting in version 1.258, the
queryjobsendpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameterQueryResultRowCountLimithas been raised from its default value, this will initially be the entire result.All clients should begin transitioning to use the paginated polling method ahead of version 1.258.
Deprecation
Items that have been deprecated and may be removed in a future release.
The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.
To temporarily opt out of the authentication requirement, the feature flag
UnauthenticatedMetacan be enabled.The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.
Behavior Changes
Scripts or environment which make use of these tools should be checked and updated for the new configuration:
GraphQL API
After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:
recoverOrganization โ Restores the organization to visible state.
rollbackOrganization โ Fully deletes the organization under certain conditions and permissions.
Previously, you could call any mutation on a soft-deleted organization.
Upgrades
Changes that may occur or be required during an upgrade.
Security
LogScale has upgraded the Netty package to version 4.2.17.Final to address open CVEs. See Netty project for more information.
New features and improvements
Security
Support for token rotation has been added when configuring multi-cluster search. Previously, a token with view permission and
Data read accesswas required remained valid indefinitely. Now, a token is provided withChange permission tokens on repo or viewpermission, then used to periodically issue new tokens withData read accesswhile periodically rotating itself.
Fixed in this release
Queries
An issue has been fixed where multi-cluster search queries using the
correlate()function could fail to complete if changes occurred while the query was running, such as an update to a view's connections. These queries are now stopped with a warning and are allowed to rerun.
Metrics and Monitoring
The metric time-parsing for the repository humio-metrics has been reverted to the behavior where it measures per-batch parsing time.
Known Issues
Storage
For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between
PRIMARY_STORAGE_PERCENTAGEandPRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.
Improvement
GraphQL API
The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.
The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.
Existing scheduled reports are automatically migrated, no action is required.
Queries
An optimization has been added to the Regular Expression Engine V2 where alternations of single character predicates are compiled as character classes. For example, alternations like
a|bare compiled to the equivalent character class[ab].This improvement provides up to 20% better performance and helps prevent stack overflows during execution.