Falcon LogScale 1.258.0 GA (2026-09-15)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.258.0GA2026-09-15

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Functions

    • LogScale LTS version 1.258 will include a breaking change to subquery semantics for the worldMap() and sankey() functions. Result fields will no longer be automatically detected, and results must be assigned to a specific field - magnitude for worldMap() and weight for sankey() respectively.

      This change avoids unpredictable behavior in sub-queries, and allows further development on related systems. The following is an example of a query that is impacted by this change:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })

      Currently, the query will be interpreted as:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | magnitude := sum(w_squared) })

      From version 1.258, the math:sqrt part of the query will no longer be discarded.

Advance Warning

The following items are due to change in a future release.

  • GraphQL API

  • API

    • Starting in version 1.258, the queryjobs endpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameter QueryResultRowCountLimit has been raised from its default value, this will initially be the entire result.

      All clients should begin transitioning to use the paginated polling method ahead of version 1.258.

Removed

Items that have been removed as of this release.

Configuration

  • The feature flag NewTableCoordinator has been removed. The feature is now enabled by default, and the ability to disable it has now been removed.

Metrics and Monitoring

  • The metrics segment-fetch-requested-but-already-in-progress and segment-fetch-requested-but-upstream-has-been-deleted for the database humio-metrics have been removed due to disuse.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Administration and Management

    • For organizations that have been deleted, LogScale now internally "soft-deletes" the organization briefly to allow for recovery without data loss. Once an organization is soft-deleted, only the GraphQL mutations dealing with recovery and rollback (recoverOrganization and rollbackOrganization) are permitted on that organization. All other mutations will fail.

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

  • Auditing and Monitoring

    • Deleting the humio-audit repository is now prohibited.

Upgrades

Changes that may occur or be required during an upgrade.

  • Installation and Deployment

    • LogScale's bundled Java Development Kit (JDK) has been upgraded to version 25.0.4.1.

New features and improvements

  • GraphQL API

    • The following dynamic configuration parameters have been added to the GraphQL enum DynamicConfig:

      • RawSegmentSearchEnabled - the default value is false.

      • RawSegmentSearchMaxSegments - the default value is 10,000,000.

  • Fleet Management

    • Log Collector configurations can now be built using the new Configuration Wizard, which walks users through sources, destinations, and their parameters. Manual configuration editing is still supported- the Wizard appears alongside the YAML editor, and stays in sync as the user completes work.

    • Falcon LogScale Collector Fleet Management now supports exporting the Fleet Overview as a .CSV file. The export includes all visible columns for collectors matching the active filters. To export, users should locate the Export button in the Overview table toolbar.

Fixed in this release

  • Queries

    • An issue has been fixed where long-running live queries using the function remoteTable() would sometimes be unprepared to complete the handover process after more than 24 hours of run-time.

    • An issue has been fixed regarding query migration for queries that referenced the same table twice while matching on different columns, such as the following example:

      logscale
      match(file=foo, column=a, ...) | match(file=foo, column=b, ...)

      Previously this issue caused migration to fail and restart, losing progress. Migrated queries now continue with the progress already made.

    • An issue has been fixed where queries containing the function defineTable() would not finish if it was started in a multi-cluster search view that had only a local connection and no remote connections.

    • An issue has been fixed where queries using the functions defineTable() or remoteTable() would sometimes continue running even when a subquery encountered a fatal error. Now, primary queries are prevented from presenting results if one or more dependencies have stopped updating.

  • Functions

    • An issue has been fixed that caused the function correlate() to miss matches in instances where a non-final query contained two link operator instances linking to the same target, such as in the following example:

      logscale
      correlate(
  A: { ... | x <=> B.z | y <=> B.z },
  B: { ...}
)

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Administration and Management

    • The Customer ID (CID) responsible for loading or fetching a table or lookup file is now logged when the information is available.

  • Automation and Triggers

    • The scheduled search logs for the repository humio-activity labeled Scheduled search successfully triggered at least one action and Scheduled search found no results and will not trigger now include the field nextExecutionTime, which contains the next scheduled run time.

  • Storage

    • Amazon S3 bucket storage now honors the Retry-After header from S3 responses, and will now wait the server-requested duration before retrying. Furthermore, the internal retry policy has changed from linear retry to exponential retry, with jitter to address cases that involve server overload.

      This behavior is controlled by the environment variable BUCKET_STORAGE_HONOR_RETRY_AFTER_HEADER, whose default value is set to true. To disable honoring the Retry-After header, set the environment variable to false. Exponential backoff with jitter remains active regardless of this setting.

    • The node-to-node fetcher has been improved in several ways:

      • Prioritization for node-to-node fetching has been reduced in cases where the segment is already well-replicated and the fetch is intended for rebalancing, not data safety.

      • The code related to node-to-node segment fetching in the correct priority order has been improved. Previously, it was impossible for high-priority fetches to skip ahead of low-priority fetches when many fetches of both types were pending.

  • GraphQL API

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Ingestion

    • The User and Entity Behavior Analytics (UEBA) file difference update functionality now stops polling after 30 consecutive fetches. This protects against excessive memory use when the Sync API is not performing baseline updates for Lookup Files.

  • Queries

    • Cost estimates that are used by the query scheduler have been improved, and are now biased toward recent work in order to improve scheduling fairness.