Falcon LogScale 1.263.0 GA (2026-10-20)
| Version? | Type? | Release Date? | Availability? | End of Support | Security Updates | Upgrades From? | Downgrades To? | Config. Changes? |
|---|---|---|---|---|---|---|---|---|
| 1.263.0 | GA | 2026-10-20 | Cloud | Next LTS | No | 1.177.0 | 1.177.0 | No |
Hide file download links
Download
Use docker pull humio/humio-core:1.263.0 to download the latest version
Bug fixes and updates
Advance Warning
The following items are due to change in a future release.
GraphQL API
The mutation deleteFeatureFlag will be removed from the code in LTS 1.270. It is replaced by resetFeature.
Deprecation
Items that have been deprecated and may be removed in a future release.
The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.
To temporarily opt out of the authentication requirement, the feature flag
UnauthenticatedMetacan be enabled.The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.
Upgrades
Changes that may occur or be required during an upgrade.
Security
The following dependencies have been updated to address multiple CVEs:
org.xerial.snappy:snappy-javaupdated to version 1.1.10.10.
org.bouncycastle:bc-jdk18on-bomupdated to version 1.86.1.
New features and improvements
Functions
Persisted Aggregation with Rollup Support is now generally available. The feature flag
RollupablePersistedAggregationshas been set to roll out.Users can now create persisted aggregations with rollup support and read the stored results using the
readPersistedAggregation()function. This type of persisted aggregation stores results that can be read in coarser time spans than the original aggregation interval.For more information, see Persisted Aggregation with Rollup Support.
Fixed in this release
Security
An issue has been fixed where the organization permission
CreateRepositoryincorrectly allowed users to change retention on all repositories in the organization.The new organization permission
ChangeRetentionForAllRepositoriesgrants the ability to change retention policies on all repositories in the organization. Users who previously relied onCreateRepositoryfor access should be assigned this new permission instead.
Storage
An additional fix has been applied to the previous issue of segments not being fully skipped when hash filters indicated no search work was needed, causing segment metadata to be loaded and discarded unnecessarily.
Queries
An issue has been fixed where tag distinction for persisted aggregations was checked across the entire organization instead of within the destination repository. Tags are now constrained based on the destination repository.
An issue has been fixed where deleting a persisted aggregation did not remove its results from the destination repository. If a persisted aggregation with the same tag was created again, the data was written to the same location, combining the old results with the new results.
Results are now removed from the destination repository after a persisted aggregation is deleted, and results that arrive afterward are no longer retained.
An issue has been fixed with connection changes in multi-cluster search views for already running queries. New and updated connections on remote views would not check the connection tags filter, resulting in unnecessary query submissions and network calls between clusters, even though the query results were still correct.
An issue has been fixed where federated queries and queries referencing tables were not stopped correctly in some scenarios.
Fleet Management
An issue has been fixed where users navigating to the Fleet Management Configuration Wizard via a link would redirect users to the incorrect page.
Functions
An error message regression has been fixed where invalid regular expressions passed as a string to the
regex()function or theregexargument of thereplace()function could produce an internal validation error when passed to the parser's default regex engine (JitRex, also known as V1 engine).Including the same field more than once when using the function
defineTable()now returns an error at time of submission rather than causing the query to fail with an internal error.
Known Issues
Storage
For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between
PRIMARY_STORAGE_PERCENTAGEandPRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.
Improvement
GraphQL API
The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.
The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.
Existing scheduled reports are automatically migrated, no action is required.
Auditing and Monitoring
Audit log entries for creating, updating, deleting, enabling, and disabling a scheduled report now include the following additional fields:
viewId
viewName
scheduledReportId
scheduledReportName
The previously included field dashboardId remains available. Existing searches and dashboards involving these audit log entries continue to work, and can now filter and group by report and view.