Falcon LogScale 1.257.0 GA (2026-09-08)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.257.0GA2026-09-08

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Functions

    • LogScale LTS version 1.258 will include a breaking change to subquery semantics for the worldMap() and sankey() functions. Result fields will no longer be automatically detected, and results must be assigned to a specific field - magnitude for worldMap() and weight for sankey() respectively.

      This change avoids unpredictable behavior in sub-queries, and allows further development on related systems. The following is an example of a query that is impacted by this change:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })

      Currently, the query will be interpreted as:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | magnitude := sum(w_squared) })

      From version 1.258, the math:sqrt part of the query will no longer be discarded.

Advance Warning

The following items are due to change in a future release.

  • GraphQL API

  • API

    • Starting in version 1.258, the queryjobs endpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameter QueryResultRowCountLimit has been raised from its default value, this will initially be the entire result.

      All clients should begin transitioning to use the paginated polling method ahead of version 1.258.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

  • Fleet Management

    • Fleet Management groups no longer query collectors running versions below 1.5.0. Collectors below version 1.5.0 that are part of a group will subsequently be removed from that group.

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • LogScale has upgraded the following packages to address open CVEs:

      • io.projectreactor.netty:reactor-netty-http from version 1.3.6 to version 1.3.7

      • org.apache.qpid:proton-j from version 0.34.1 to version 0.35.0

      • io.projectreactor:reactor-core from version 3.8.6 to version 3.8.7

New features and improvements

  • Fleet Management

    • Fleet Management groups can now be exported as a CSV file. The export option is available in the â‹® menu for each group.

Fixed in this release

  • User Interface

    • Rows in the Table widget could not be selected while a query was in a stopped state. This issue has been fixed and row selection now works for stopped queries, matching the existing behavior for completed and live queries.

    • Two issues regarding the Fields panel have been fixed:

      • The cardinality value now matches the top values when in a view after selecting the Sample more button.

      • The total number of events after selecting the Sample more button is now reported correctly. The Showing fields from latest N events label displays the correct count and the percentages column is enabled when possible.

    • Fixed an issue with the GraphQL API Explorer where a user's session would not be refreshed by the UI due to credential timeout.

  • Automation and Triggers

    • Two issues related to saved searches have been resolved:

      • Saved searches grouped by Last Modified are now bucketed according to the user's configured time zone instead of Coordinated Universal Time (UTC). Previously, searches had the potential to appear under the the wrong day for users outside UTC.

      • The Saved searches list now updates immediately following the creation of a new saved search. Previously, the new search did not populate until the user navigated away from and then returned to the Saved searches tab.

  • Queries

    • Fixed an issue in the query scheduler that could cause starvation of organization or user queries for extended periods.

    • Fixed an issue where the query scheduler may prioritize an organization or user unfairly.

    • Fixed a number of issues in the query scheduler which would cause unfair prioritization. These issues could lead to queries being deprioritized or taking significantly longer than expected to complete.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • User Interface

    • The Query Editor now highlights specific characters in a malformed regular expression instead of the entire expression. Running an erroneous query no longer garbles the error message in the Results tab.

  • Storage

    • The timeout for uploading CSV/JSON files to bucket storage has been removed, and upload operations are now queued and run concurrently instead of each operation runnning sequentially.

  • GraphQL API

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Queries

    • Improved query caching and reuse by introducing a canonical sort order to the internal representation of filter queries. For example, the queries A AND B AND C and B AND A AND C can now share cached results.