Falcon LogScale 1.262.0 GA (2026-10-13)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.262.0GA2026-10-13

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

New features and improvements

  • Queries

    • A new coordinator for the Export query type has been introduced, which manages time-slicing of queries for export to bucket storage. This feature is behind the feature flag ExportQueries.

      The following dynamic configuration parameters manage the new coordinator:

      • ExportMaxSlices - Maximum number of times a query can be subdivided into smaller time slices, and the maximum number of files uploaded to bucket storage during the total query runtime.

      • ExportMinSliceDurationMs - Minimum duration of query time slices, to prevent slices from being too compact relative to the search range.

      • ExportSliceSearchTargetSizeMB - Target value used in time-slicing logic, representing the amount of data each worker should search on average per time-sliced query.

Fixed in this release

  • Storage

    • An issue has been fixed where segments were sometimes not fully skipped even when hash filters indicated no search work was needed.

      This caused unnecessary loading of segment metadata that was then immediately discarded.

  • Queries

    • An issue has been fixed where searches that included Unicode symbols represented by more than one UTF-16 code point could return results that were missing certain events.

    • An issue has been fixed where persisted aggregations with a Monthly or Yearly interval did not always align with calendar boundaries, causing some executions to not cover exactly one calendar month or year.

  • Functions

    • The format() function now prints trailing zeros for the imprecise portion of double values (which have a precision of approximately 15.9 digits) to prevent overflow of the long type (approximately 19 digits) that represents the fractional part of the formatted float.

  • Packages

    • An issue has been fixed where exporting a package could fail with a duplicate entry error if it contained multiple assets whose names differed only by whitespace.

      Asset filenames inside exported package zip files now preserve the whitespace of the asset name. Characters that cannot appear in a zip entry name are percent-escaped: %, /, and control characters in an asset name become %25, %2F, and (for example) %09.

      Asset names themselves are unchanged - they are always read from the file contents, not from the filename, and packages exported with earlier versions can still be installed.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Security

    • For SAML identity providers configured to fetch certificates from a metadata endpoint, failed authentication now reloads the metadata from the endpoint rather than keeping certificates cached for 30 minutes.

      To prevent excessive requests when an identity provider is misconfigured, reloads are attempted at most once every 60 seconds by default. You can configure this interval at the cluster level using the dynamic configuration parameter SamlMetadataMinimumAgeBeforeInvalidationSeconds (minimum value is 1 second, maximum value is 3600 seconds).

    • A daily job has been added that removes all ingest tokens from the sandbox repositories of users who have not logged in for more than 180 days. The sandbox repository itself is retained. Users who have never logged in, such as users who only use API tokens, are not affected.

      The job also deletes sandbox repositories whose owner has been deleted. Ingest tokens used by actions in other views are retained, and sandboxes with such tokens are not deleted.

      All deletions and token removals are audit logged in the humio-audit repository of the organization that owns the sandbox.

      The job is disabled by default and can be enabled with the dynamic configuration parameter OrphanedSandboxCleanupEnabled. While disabled, the job only logs which sandboxes it would delete and which ingest tokens it would remove.

  • User Interface

    • Persisted aggregation repositories can now be deleted from the UI through the Danger Zone settings page.

  • GraphQL API

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Storage

    • Deduplication of pending fetches for the same segment has been added to reduce how often full global scans are triggered because the fetch queue reaches capacity.

  • API

    • The maximum allowed length for extra log field keys and values has been increased from 128 to 512 characters.

      For more information, see Creating a Query Job.

  • Ingestion

    • Error log messages for ingest event deletion failures have been downgraded from ERROR to WARN level. Repeated ingest event deletion failures are now captured by the system alert IngestQueueOffsetDeletionStalled.

  • Queries

    • Query performance has been improved for regular expressions containing optional or alternated parts, such as https?:// or a{0,1}.

    • Query submission to workers now stops when failure responses are received. Previously, all worker submissions completed before any responses were evaluated, which wasted work when the initial worker had already rejected the submission because of a validation failure.

    • Queries that use persisted aggregations can now be cached.