Falcon LogScale 1.259.0 GA (2026-09-22)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.259.0GA2026-09-22

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Automation and Triggers

    • Filter alert validation has become stricter. Queries can no longer assign values to the reserved fields @ingesttimestamp and @id.

  • API

    • The field queryToRead for query poll responses has been undeprecated. The field was previously deprecated due to a process change for populating table tabs. However, it is still required to open a new browser tab with the subquery string pre-filled.

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • Two dependencies have been updated to address Snyk security warnings: zstd-jni has been updated to version 1.5.7-16, and FasterXML/jackson-bom has been updated to version 2.22.2.

New features and improvements

  • Automation and Triggers

    • A new S3 action type has been added that uploads trigger results to a Google Cloud Storage bucket.

  • Functions

    • Aggregation queries are now supported for the function correlate(), and can be used to enrich constellations from mandatory queries with aggregated data.

      The following example counts the number of page views for a user between a login and a purchase event:

      logscale
      correlate(
  Login: { #action="login" },
  Purchase: { #action="purchase" | userId <=> Login.userId },
  aggregation = [
    pageViews: { #action="pageView" | userId <=> Login.userId | count() }
      after: "Login" before: "Purchase"
  ]
)

      For more information, see correlate().

Fixed in this release

  • Security

    • Two places in the UI were incorrectly checking for broad change permissions instead of the specific create permissions:

      • The button for creating a new action, shown when picking actions for a trigger, previously required Change actions. It now requires Create actions.

      • The saved searches panel on the search page previously used the Change saved queries permission to determine whether to offer creating a saved query. It now uses Create saved queries.

      Before this fix, users with only the create permission was told they did not have permission and could not use either feature.

  • User Interface

    • Two issues have been fixed related to file export error handling:

      • Exporting a file that fails now shows an error toast explaining what went wrong, including the server error message. Previously, the notification remained indefinitely with no indication that the export had failed.

      • Exporting search results to a file now shows an error toast when the download fails, and the export dialog remains open so users can try again. Previously, the dialog remained in a preparing state with no indication of failure.

  • Storage

    • Two issues regarding consistency in persisted aggregation have been fixed:

      • Deleted persisted aggregations on non-1:1-linked views now delete consistently and completely, restoring tag reuse.

      • Rare cases of persisted aggregations being unintentionally deleted have now been eliminated.

  • Ingestion

    • An issue has been fixed where an out-of-memory error in a digest reader thread would continue running but could not divest its remaining work during digest reassignment, causing the cluster to stop consuming from some ingest partitions until the node was fully restarted. The node now restarts immediately when this condition occurs.

    • An issue has been fixed where an uncaught exception in a Kafka consumer thread would leave the thread in a broken state, causing Kafka partitions to remain unconsumed. The node now restarts immediately when an uncaught exception occurs in a digest consumer thread.

  • Queries

    • An issue in the query scheduler has been fixed that could harm scheduling fairness. A cost clamping mechanism was applied to too few query cases, which could cause query penalties to diverge when some queries could not saturate the hardware with work. This caused newly started queries to receive lower priority than expected.

  • Functions

    • An issue has been fixed with the function defineTable() where a column with an included name was not created unless an event containing that field value already existed.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Security

    • Permission requirements for creating persisted aggregation repositories have been reduced. A user with permission to create standard repositories can now also create persisted aggregation repositories.

  • Documentation

    • LogScale's release notes system now includes two new features that improve how users view and search for release notes across versions:

      What release notes are displayed depends on the release type. A standard GA release includes only the changes associated with that version. An LTS release includes all release notes for every version it contains - typically the previous 4 to 6 versions. These are called imported release notes.

      • Imported release notes can now be hidden on any LTS release notes page using the Hide/Show Imported Release Notes button, which also shows a count of imported entries. Each imported entry shows the version it was imported from. For example, see the 1.252.1 release notes page.

      • The Search Release Notes page now includes a unified view option that shows changes between two releases without grouping them by version number. This is useful for listing all changes of a specific type โ€” for example, all security fixes โ€” between two versions, regardless of which version they appear in. Users can also select to hide imported entries in that view. For example, to view only the changes that originated in 1.252.1, use the release notes search page and toggle Hide Imported Entries on.

  • GraphQL API

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Configuration

    • The feature flag DoNotCheckActiveDigestTasksForThrottling has been removed, and its associated behavior is now enabled by default. As a result, periodic offloading of live query states from workers is now enabled.

  • Queries

    • The number of iterations performed by the query coordinator when managing queries has been reduced with the introduction of three new collection queues:

      • A queue for queries that are awaiting dependencies.

      • A queue that prioritizes using the principle of First In First Out (FIFO) for queries awaiting resource availability.

      • A queue for queries that are currently running.