Falcon LogScale 1.266.0 GA (2026-11-10)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.266.0GA2026-11-10

Cloud

Next LTSNo1.177.01.177.0No

Hide file download links

Show file download links

Bug fixes and updates

Advance Warning

The following items are due to change in a future release.

Removed

Items that have been removed as of this release.

GraphQL API

  • LogScale's Query Migration Assistant has been removed. The GraphQL query field queryAssistance now always returns the error QueryAssistantError. The QueryAssistant value of the OrganizationAction enum has been deprecated and will be removed at the earliest in version 1.276. The QueryAssistant feature flag no longer has any effect.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

  • The configuration variable USING_EPHEMERAL_DISKS is now slated for deprecation and removal in LogScale version 1.282.

    Because this configuration variable can only be enabled on clusters with bucket storage and there is no use case for disabling it, the option will be deprecated. Instead, LogScale will adopt the correct behavior based on whether bucket storage is configured. When bucket storage is enabled, nodes will be ephemeral; when bucket storage is disabled, nodes will be non-ephemeral.

    Clusters that have configured bucket storage but have not set USING_EPHEMERAL_DISKS will be silently migrated to ephemeral disks.

    Clusters that have configured bucket storage and have explicitly set USING_EPHEMERAL_DISKS to false will crash on boot. Administrators should unset USING_EPHEMERAL_DISKS on such clusters.

    To boot a cluster with bucket storage and include USING_EPHEMERAL_DISKS with it set to false as a temporary measure, set ALLOW_USING_NON_EPHEMERAL_DISKS_WITH_BUCKET_STORAGE to true. This configuration option will also be removed in 1.282, and exists only as an escape hatch.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Ingestion

    • Events exceeding the maximum event size or field count now use consistent priority-based truncation. Both cases preserve event fields with the same prioritization: special fields (such as @timestamp and tags) are retained first, followed by @-prefixed fields, then @rawstring, then remaining fields. Within each group, fields are ordered lexicographically by name, making which fields are retained more predictable.

New features and improvements

  • GraphQL API

    • The GraphQL mutation setChildSizeInParentOrgForOrganization() has been added; Set the size of the organization within the CID of its parent organization for a product type.

    • The GraphQL mutation updateOAuthSecurityPolicies() has been added; Update the OAuth sign-in security policies for the organization. Refused while OAuth sign-in is off.

    • The GraphQL mutation setParentOrgForOrganization() has been added; Set the parent organization holding the CID size of the organization for a product type.

Fixed in this release

  • Queries

    • An issue has been fixed where the function readFile() accepted arbitrary Uniform Resource Identifier (URI) schema prefixes. For example, readFile("anything://test.csv") was treated as readFile("test.csv"). Now, only the file:// scheme is now accepted, and other schemes will produce a validation error.

    • An issue has been fixed where code waiting for lookup tables or lookup files to be loaded always waited, whether it was necessary or not.

    • An issue has been fixed where exporting results to a file from a multi-cluster search view would fail with the error Can't export filter query results for queries using an aggregate function such as head() or tail(). Any query containing an aggregate function can now be exported from a multi-cluster view, including when the aggregate function is part of a saved query.

    • An issue has been fixed that caused unintentional minor penalization in the query scheduler for organizations or users when canceling queries.

    • An issue has been fixed where regexes with optional quantifiers like ?, *, or {0,n} directly after a character outside the Basic Multilingual Plane such as an emoji, could miss matching events. For example, a=/hello😀*world/ could miss events containing hello😀world.

      The same issue applied to character classes containing such characters at the end of a regex. For example, a=/hello[😀😐]/ could miss events containing hello😀.

    • An issue has been fixed where exceeding the aggregator output row limit while reading a persisted aggregation would return an empty result with a generic warning instead of canceling the query as expected.

    • An issue has been fixed where queries on search nodes for repositories with no data to search could fail with a validation error. Now, queries on empty repositories succeed with an empty result.

    • An issue has been fixed with query scheduling, where queries from organizations or users that had just started searching could be delayed for tens of seconds on busy nodes, even though they should have been prioritized.

    • An issue has been fixed where the function readPersistedAggregation() would fail with a file not found error when reading persisted aggregations containing rollup support and whose query used a file reference before the first aggregator.

    • An issue has been fixed where hexadecimal escape sequences in regexes such as \x{...} were erroneously rejected when the first character was a valid hex letter like a-f or A-F.

  • Metrics and Monitoring

    • An issue has been fixed where the humio-metrics node-level metric dynamic-table-reference-controller-size-of-tables-in-use-by-queries reported the last recorded value instead of the current value, leading to system metrics being shifted backward by a value of one.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Automation and Triggers

    • Scheduled reports now wait up to 45 minutes for the Auxiliary PDF Render Service to finish, up from 35 minutes. This gives large reports that are slow to load and convert to PDF time to complete.

  • GraphQL API

    • The GraphQL datatype ScheduledReport now exposes the field createdInfo, which contains structured creation metadata. Data points include author and timestamp, which is consistent with other asset types such as filter alerts, dashboards, and parsers.

      The existing fields createdBy and creationDate are now deprecated and will be removed in version 1.306. Migration to the createdInfo field is recommended, as it provides richer author information (user, token, and/or system) alongside the creation timestamp.

      Existing scheduled reports are automatically migrated, no action is required.

  • Configuration

    • The dynamic configuration parameter MaxSegmentRebalancingDecisionsPerRound has been added, which limits how many segment moves each node decides on a per-segment rebalancing round. The default value is 1000, which is the previous fixed limit. The minimum allowed value is 1.

    • The environment variable MAX_GLOBAL_LATENCY_MS_FOR_DIGEST_COORDINATOR has been added to control how much round-trip latency to global nodes a node tolerates before becoming ineligible to perform digest coordination. The dynamic configuration parameter MaxGlobalLatencyMsForDigestCoordinator provides runtime control of the same setting.

      The default value is 500 milliseconds. The minimum allowed value is 500 milliseconds, and the maximum is 10,000 milliseconds.

  • Queries

    • The feature flag PreferNodeToNodeFetchingForQueries has been rolled out, which allows queries to fetch segments from other nodes in addition to fetching them from bucket storage.

  • Metrics and Monitoring

    • The humio-metrics repository now includes the repository metric lookup-tables-size-of-index-structures, which shows the total heap size estimate of the index structures cached on the cluster.

    • Hash filter metrics now account only for data within the query's time span:

      • read-prefilter-bytes now counts only the hash filter bytes actually read. Previously, this metric counted the entire hash filter file for every segment evaluated, even when the query covered only a few blocks. Expect lower values, especially for frequent queries over short time ranges on large or wide-spanning segments.

      • skippedSize now no longer includes data outside the query's timespan when hash filters rule out an entire segment. Expect lower values for queries whose time range only partially overlaps segments.

      • hashfilter-skipped-blocks now includes blocks from segments that the hash filter ruled out entirely. These were previously not counted, so expect this metric to increase.

  • Auditing and Monitoring

    • Query completion activity logs now contain the field errorClassification, which indicates whether the error leading to query failure was on behalf of the user or the system.