Falcon LogScale 1.264.0 GA (2026-10-27)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.264.0GA2026-10-27

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Fleet Management

    • The feature flag FleetInstallTokenExpiry has been enabled. Default and sensor installation tokens now expire after 30 days. Custom enrollment tokens are enforced with a maximum expiry of 180 days. Existing custom tokens that exceed this limit have 180 days applied from the time of this update.

  • Functions

    • The function readPersistedAggregation() is now the only supported way to read data from a Persisted Aggregation repository. This restriction is enforced across all query paths.

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • The base Docker image has been updated to remove compromised eMudhra CA certificates.

    • Compromised eMudhra CA certificates have been removed from the bundled JRE trust store.

New features and improvements

  • User Interface

    • A query formatter is now available in the query editor. Formatting normalizes indentation and line breaks, and inserts line breaks where applicable when a line becomes too long. When text is selected, formatting applies only within the selection.

      The keyboard shortcut is Shift+Alt+F on Windows and Cmd+Option+F on macOS.

Fixed in this release

  • Storage

    • An issue has been fixed where searches could silently miss events after their segment closed, with no error or warning. This occurred when a parser built a field value from text at the end of @rawstring followed by text from the beginning of another field, such as @timezone.

      For example, a parser that stores @timezone as Z and ts as 2026-09-29T12:58:42Z could have those events missed by a search for ts="2026-09-29T12:58:42Z" after the segment closed. Whether an event was missed depended on which other events were stored alongside it, however the events themselves were stored correctly.

      The fix applies to newly written data. Segments written before this fix retain the issue until their hash filter files are regenerated or the segments age out.

    • An issue has been fixed where httponly and ingest nodes never stored lookup tables in their table disk cache, delaying queries that use lookup files. These nodes now only use up to 10% of available disk space for the table cache by default.

      Cache size is configurable with the dynamic configuration parameter TableCacheMaxStorageFractionForIngestAndHttpOnly.

  • Ingestion

    • An issue has been fixed where non-finite floating-point values like positive infinity, negative infinity, and NaN resulted in invalid JSON when ingested through Open Telemetry Protocol (OTLP). Now these values produce the strings Infinity, -Infinity, and NaN respectively, following the ProtoJSON format for representing protobuf as JSON.

  • Queries

    • Two corner case issues have been fixed where an invalid regular expression could produce an internal validation error instead of a descriptive error message such as Unknown escape sequence.

    • An issue has been fixed where query handover during upgrades could fail when upgrading from a version earlier than 1.263.

    • An issue has been fixed where match() functions with cross-view file references using the file:// syntax did not work in multi-cluster search queries. For example, match(file="file://otherView:lookup.csv", ...) now works correctly when the query runs across federated clusters.

  • Functions

    • An issue has been fixed where a missing tag or view parameter in the function readPersistedAggregation() returned an InternalErrorDuringFunctionValidation error instead of a MissingRequiredArgument error.

    • A regression introduced in version 1.261 has been fixed where the function selectLast() discarded fields with an empty string ("") as their value.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Administration and Management

    • The GraphQL mutation redactEvents() now emits a log line when a redaction job ends. The log entry includes how long the job took and the reason it ended.

  • GraphQL API

    • The GraphQL query analyzeQuery() now supports the argument parser, enabling analysis of parser queries.

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Configuration

    • The default request timeout for HTTP endpoints that handle file uploads has been increased to 10 minutes to prevent failures during large file uploads.

  • Ingestion

    • Memory allocations during gzip and deflate decompression have been reduced by eliminating unnecessary copies of input buffers.

  • Queries

    • Query reuse checks during submission now timeout after 5 seconds, ensuring the check does not run longer than the total time allowed for the submission.

  • Fleet Management

    • Users without change permissions for Fleet Management now see a read-only version of the Config Editor page and a read-only Group Details dialog.

    • The ability for the Fleet Management configuration editor to test configuration drafts on selected collector instances before publish has been restored. Publishing a tested draft is now completed from the configuration editor rather than from the test status page.