Falcon LogScale 1.258.0 GA (2026-09-15)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.258.0GA2026-09-15

Cloud

2027-10-31No1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Functions

    • LogScale LTS version 1.258 will include a breaking change to subquery semantics for the worldMap() and sankey() functions. Result fields will no longer be automatically detected, and results must be assigned to a specific field - magnitude for worldMap() and weight for sankey() respectively.

      This change avoids unpredictable behavior in sub-queries, and allows further development on related systems. The following is an example of a query that is impacted by this change:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })

      Currently, the query will be interpreted as:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | magnitude := sum(w_squared) })

      From version 1.258, the math:sqrt part of the query will no longer be discarded.

Advance Warning

The following items are due to change in a future release.

  • GraphQL API

  • API

    • Starting in version 1.258, the queryjobs endpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameter QueryResultRowCountLimit has been raised from its default value, this will initially be the entire result.

      All clients should begin transitioning to use the paginated polling method ahead of version 1.258.

Removed

Items that have been removed as of this release.

Configuration

  • The feature flag NewTableCoordinator has been removed. The feature is now enabled by default, and the ability to disable it has now been removed.

Metrics and Monitoring

  • The metrics segment-fetch-requested-but-already-in-progress and segment-fetch-requested-but-upstream-has-been-deleted for the database humio-metrics have been removed due to disuse.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Administration and Management

    • For organizations that have been deleted, LogScale now internally "soft-deletes" the organization briefly to allow for recovery without data loss. Once an organization is soft-deleted, only the GraphQL mutations dealing with recovery and rollback (recoverOrganization and rollbackOrganization) are permitted on that organization. All other mutations will fail.

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

  • Auditing and Monitoring

    • Deleting the humio-audit repository is now prohibited.

Upgrades

Changes that may occur or be required during an upgrade.

  • Installation and Deployment

    • LogScale's bundled Java Development Kit (JDK) has been upgraded to version 25.0.4.1.

New features and improvements

  • GraphQL API

    • The following dynamic configuration parameters have been added to the GraphQL enum DynamicConfig:

      • RawSegmentSearchEnabled - the default value is false.

      • RawSegmentSearchMaxSegments - the default value is 10,000,000.

  • Fleet Management

    • Log Collector configurations can now be built using the new Configuration Wizard, which walks users through sources, destinations, and their parameters. Manual configuration editing is still supported- the Wizard appears alongside the YAML editor, and stays in sync as the user completes work.

    • Falcon LogScale Collector Fleet Management now supports exporting the Fleet Overview as a .CSV file. The export includes all visible columns for collectors matching the active filters. To export, users should locate the Export button in the Overview table toolbar.

Fixed in this release

  • Queries

    • An issue has been fixed where long-running live queries using the function remoteTable() would sometimes be unprepared to complete the handover process after more than 24 hours of run-time.

    • An issue has been fixed regarding query migration for queries that referenced the same table twice while matching on different columns, such as the following example:

      logscale
      match(file=foo, column=a, ...) | match(file=foo, column=b, ...)

      Previously this issue caused migration to fail and restart, losing progress. Migrated queries now continue with the progress already made.

    • An issue has been fixed where queries containing the function defineTable() would not finish if it was started in a multi-cluster search view that had only a local connection and no remote connections.

    • An issue has been fixed where queries using the functions defineTable() or remoteTable() would sometimes continue running even when a subquery encountered a fatal error. Now, primary queries are prevented from presenting results if one or more dependencies have stopped updating.

  • Fleet Management

    • An issue has been fixed with YAML validation in the Fleet Management configuration editor that prevented configurations from having more than one type of transform per source.

  • Functions

    • An issue has been fixed that caused the function correlate() to miss matches in instances where a non-final query contained two link operator instances linking to the same target, such as in the following example:

      logscale
      correlate(
  A: { ... | x <=> B.z | y <=> B.z },
  B: { ...}
)

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

  • Fleet Management

Improvement

  • Administration and Management

    • The Customer ID (CID) responsible for loading or fetching a table or lookup file is now logged when the information is available.

  • Automation and Triggers

    • The scheduled search logs for the repository humio-activity labeled Scheduled search successfully triggered at least one action and Scheduled search found no results and will not trigger now include the field nextExecutionTime, which contains the next scheduled run time.

  • GraphQL API

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Storage

    • Amazon S3 bucket storage now honors the Retry-After header from S3 responses, and will now wait the server-requested duration before retrying. Furthermore, the internal retry policy has changed from linear retry to exponential retry, with jitter to address cases that involve server overload.

      This behavior is controlled by the environment variable BUCKET_STORAGE_HONOR_RETRY_AFTER_HEADER, whose default value is set to true. To disable honoring the Retry-After header, set the environment variable to false. Exponential backoff with jitter remains active regardless of this setting.

    • The node-to-node fetcher has been improved in several ways:

      • Prioritization for node-to-node fetching has been reduced in cases where the segment is already well-replicated and the fetch is intended for rebalancing, not data safety.

      • The code related to node-to-node segment fetching in the correct priority order has been improved. Previously, it was impossible for high-priority fetches to skip ahead of low-priority fetches when many fetches of both types were pending.

  • Ingestion

    • The User and Entity Behavior Analytics (UEBA) file difference update functionality now stops polling after 30 consecutive fetches. This protects against excessive memory use when the Sync API is not performing baseline updates for Lookup Files.

  • Queries

    • Cost estimates that are used by the query scheduler have been improved, and are now biased toward recent work in order to improve scheduling fairness.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • microsoft/windows-dns-debug has been updated to v1.5.2.

      • Refactored timestamp parsing logic into a unified post-case __timestamp match block supporting five distinct timestamp formats

      • Added support for new timestamp format: d-M-yyyy H:mm:ss (e.g., 04-08-2026 19:55:33)

      • Simplified regex patterns in case statement to use generic .*? timestamp capture group for broader format compatibility

      • Removed inline parseTimestamp and drop calls from individual case branches

      • Updated ECS version to 9.4.0 and CPS version to 1.2.0

      For more information, see Package microsoft/windows-dns-debug Release Notes.

    • infoblox/nios has been updated to v1.5.0.

      • Extended audit log parsing to support additional service names: python, sshd, and -serial_console in addition to httpd

      • Added client.address mapping from Vendor.audit.ip for login events

      • Enhanced created, modified and called events with object type/name extraction via regex and kvParse

      • Extended RestartService match to include ClearRestartFlags and NodeAdminOperation

      • Extended TransferTrafficCapture match to include CSV

      • Added process.id extraction from syslog priority format messages

      • Added BOOTREQUEST outcome handling: failure when message contains no dynamic leases, success otherwise

      • Added bind update event parsing with client.address, Vendor.action_blocked, and Vendor.reject_reason fields

      • Added r-l-e (Renewed/Issued/Freed) lease event parsing with client.ip, client.mac, host.name, DHCP state, time, vendor class, option tag, and network fields

      • Extended DNS service name match to include idns_healthd in addition to named

      • Added ICMP monitor event parsing for DNS dataset with client.domain, client.address, and ICMP status fields

      • Added cloud_dns_task_executor_overlay_ctl service handling mapped to nios.dns dataset

      For more information, see Package infoblox/nios Release Notes.