logstash-filter-elasticsearch 3.15.0 → 3.15.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c988a59e14c49b5b169b0b797cc2844d747d1cb67c7daef426d1008b10064c79
-  data.tar.gz: 20febabc910c17435dca65e5d326e73ea48b3897743e19102101fba316a5e96c
+  metadata.gz: 64700ddd93547ed4e08abfb73028ab17f7dc6bd6d591840c622b5f7e24b3d5c3
+  data.tar.gz: 9cdf64fc9afe9a2a66c453850d2b4c0d910af5251567799bfd6612737045ba50
 SHA512:
-  metadata.gz: 6d22b647190c79c1ef8ce703a2212ca7bbedd2f6ce621b81a0bd305c9e523371eb1f6e6bc2435952c2d5d776779588aba7e45fb3e4e07227648f399ed41651b3
-  data.tar.gz: 529b58bb8a8a7097cfc4c205044f2eb3d478300f9c6d5273446063afdf55402a5f76157f7e98e51bf4491a9ddc3a6e2ed572ae1fd4110737b2bbd2be829c52f7
+  metadata.gz: 54c710f94a363bb2f8c9b1ecf450ec3397b50792fb7d4c2035a2ee7c70b347c7a41a4c8d7959bcd0eb8403a5df786bdfbebb5bb600f54a4668d6f4905d429054
+  data.tar.gz: 4f788bb3592c42fc2003e22c94c49d53272063ec2fadbe85f49e3653ba7bdfbbf81024cb34d8e81cec7f7eaf9968fc2be8fd704da5678d34eae60a3fd47d184f

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 3.15.2
+  - Added checking for `query` and `query_template`. [#171](https://github.com/logstash-plugins/logstash-filter-elasticsearch/pull/171)
+  
+## 3.15.1
+  - Fixes a regression introduced in 3.15.0 which could prevent a connection from being established to Elasticsearch in some SSL configurations
+
 ## 3.15.0
   - Added SSL settings for: [#168](https://github.com/logstash-plugins/logstash-filter-elasticsearch/pull/168)
     - `ssl_enabled`: Enable/disable the SSL settings. If not provided, the value is inferred from the hosts scheme

data/docs/index.asciidoc

@@ -320,6 +320,7 @@ environment variables e.g. `proxy => '${LS_PROXY:}'`.
 Elasticsearch query string. More information is available in the
 {ref}/query-dsl-query-string-query.html#query-string-syntax[Elasticsearch query
 string documentation].
+Use either `query` or `query_template`.
 
 
 [id="plugins-{type}s-{plugin}-query_template"]
@@ -330,6 +331,7 @@ string documentation].
 
 File path to elasticsearch query in DSL format. More information is available in
 the {ref}/query-dsl.html[Elasticsearch query documentation].
+Use either `query` or `query_template`.
 
 [id="plugins-{type}s-{plugin}-result_size"]
 ===== `result_size` 

data/lib/logstash/filters/elasticsearch.rb

@@ -170,6 +170,7 @@ class LogStash::Filters::Elasticsearch < LogStash::Filters::Base
       @query_dsl = file.read
     end
 
+    validate_query_settings
     fill_hosts_from_cloud_id
     setup_ssl_params!
     validate_authentication
@@ -317,7 +318,9 @@ class LogStash::Filters::Elasticsearch < LogStash::Filters::Base
                         "to make sure your data is secure set `ssl_verification_mode => full`"
           ssl_options[:verify] = :disable
         else
-          ssl_options[:verify] = :strict
+          # Manticore's :default maps to Apache HTTP Client's DefaultHostnameVerifier,
+          # which is the modern STRICT verifier that replaces the deprecated StrictHostnameVerifier
+          ssl_options[:verify] = :default
       end
     end
 
@@ -389,6 +392,16 @@ class LogStash::Filters::Elasticsearch < LogStash::Filters::Base
     hosts.is_a?(Array) && hosts.size == 1 && !original_params.key?('hosts')
   end
 
+  def validate_query_settings
+    unless @query || @query_template
+      raise LogStash::ConfigurationError, "Both `query` and `query_template` are empty. Require either `query` or `query_template`."
+    end
+
+    if @query && @query_template
+      raise LogStash::ConfigurationError, "Both `query` and `query_template` are set. Use either `query` or `query_template`."
+    end
+  end
+
   def validate_authentication
     authn_options = 0
     authn_options += 1 if @cloud_auth

data/logstash-filter-elasticsearch.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-elasticsearch'
-  s.version         = '3.15.0'
+  s.version         = '3.15.2'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Copies fields from previous log events in Elasticsearch to current events "
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/filters/elasticsearch_spec.rb

@@ -15,9 +15,11 @@ describe LogStash::Filters::Elasticsearch do
 
   context "registration" do
 
-    let(:plugin) { LogStash::Plugin.lookup("filter", "elasticsearch").new({}) }
+    let(:plugin) { LogStash::Plugin.lookup("filter", "elasticsearch").new(config) }
 
     context "against authentic Elasticsearch" do
+      let(:config) { { "query" => "*" } }
+
       before do
         allow(plugin).to receive(:test_connection!)
       end
@@ -28,6 +30,7 @@ describe LogStash::Filters::Elasticsearch do
     end
 
     context "against not authentic Elasticsearch" do
+      let(:config) { { "query" => "*" } }
       let(:failing_client) do
         client = double("client")
         allow(client).to receive(:ping).and_raise Elasticsearch::UnsupportedProductError
@@ -45,6 +48,19 @@ describe LogStash::Filters::Elasticsearch do
         expect {plugin.register}.to raise_error(LogStash::ConfigurationError)
       end
     end
+
+    context "query settings" do
+      it "raise an exception when query and query_template are empty" do
+        plugin = described_class.new({})
+        expect {plugin.register}.to raise_error(LogStash::ConfigurationError)
+      end
+
+      it "raise an exception when query and query_template are set" do
+        config = { "query" => "*", "query_template" => File.join(File.dirname(__FILE__), "fixtures", "query_template_unicode.json") }
+        plugin = described_class.new(config)
+        expect {plugin.register}.to raise_error(LogStash::ConfigurationError)
+      end
+    end
   end
 
   describe "data fetch" do
@@ -594,7 +610,7 @@ describe LogStash::Filters::Elasticsearch do
 
   describe "ca_trusted_fingerprint" do
     let(:ca_trusted_fingerprint) { SecureRandom.hex(32) }
-    let(:config) { {"ssl_enabled" => true, "ca_trusted_fingerprint" => ca_trusted_fingerprint}}
+    let(:config) { {"ssl_enabled" => true, "ca_trusted_fingerprint" => ca_trusted_fingerprint, "query" => "*"}}
 
     subject(:plugin) { described_class.new(config) }
 
@@ -633,6 +649,7 @@ describe LogStash::Filters::Elasticsearch do
         'hosts' => 'https://localhost:9200',
         'ssl_keystore_path' => keystore_path,
         'ssl_keystore_password' => keystore_password,
+        'query' => '*'
       }
     end
 
@@ -663,7 +680,7 @@ describe LogStash::Filters::Elasticsearch do
 
   describe "defaults" do
 
-    let(:config) { Hash.new }
+    let(:config) { {"query" => "*"} }
     let(:plugin) { described_class.new(config) }
 
     before { allow(plugin).to receive(:test_connection!) }

data/spec/filters/elasticsearch_ssl_spec.rb

@@ -5,7 +5,7 @@ require "logstash/codecs/base"
 describe "SSL options" do
   let(:es_client_double) { double("Elasticsearch::Client #{self.inspect}") }
   let(:hosts) {["localhost"]}
-  let(:settings) { { "ssl_enabled" => true, "hosts" => hosts } }
+  let(:settings) { { "ssl_enabled" => true, "hosts" => hosts, "query" => "*" } }
 
   subject do
     require "logstash/filters/elasticsearch"
@@ -36,7 +36,8 @@ describe "SSL options" do
     context "false and cloud_id resolved host is https" do
       let(:settings) {{
         "ssl_enabled" => false,
-        "cloud_id" => "sample:dXMtY2VudHJhbDEuZ2NwLmNsb3VkLmVzLmlvJGFjMzFlYmI5MDI0MTc3MzE1NzA0M2MzNGZkMjZmZDQ2OjkyNDMkYTRjMDYyMzBlNDhjOGZjZTdiZTg4YTA3NGEzYmIzZTA6OTI0NA=="
+        "cloud_id" => "sample:dXMtY2VudHJhbDEuZ2NwLmNsb3VkLmVzLmlvJGFjMzFlYmI5MDI0MTc3MzE1NzA0M2MzNGZkMjZmZDQ2OjkyNDMkYTRjMDYyMzBlNDhjOGZjZTdiZTg4YTA3NGEzYmIzZTA6OTI0NA==",
+        "query" => "*"
       }}
 
       it "should not infer the ssl_enabled value" do
@@ -82,7 +83,8 @@ describe "SSL options" do
 
     context "and cloud_id resolved host is https" do
       let(:settings) {{
-        "cloud_id" => "sample:dXMtY2VudHJhbDEuZ2NwLmNsb3VkLmVzLmlvJGFjMzFlYmI5MDI0MTc3MzE1NzA0M2MzNGZkMjZmZDQ2OjkyNDMkYTRjMDYyMzBlNDhjOGZjZTdiZTg4YTA3NGEzYmIzZTA6OTI0NA=="
+        "cloud_id" => "sample:dXMtY2VudHJhbDEuZ2NwLmNsb3VkLmVzLmlvJGFjMzFlYmI5MDI0MTc3MzE1NzA0M2MzNGZkMjZmZDQ2OjkyNDMkYTRjMDYyMzBlNDhjOGZjZTdiZTg4YTA3NGEzYmIzZTA6OTI0NA==",
+        "query" => "*"
       }}
 
       it "should infer the ssl_enabled value to false" do
@@ -122,7 +124,7 @@ describe "SSL options" do
 
       it "should pass the flag to the ES client" do
         expect(::Elasticsearch::Client).to receive(:new) do |args|
-          expect(args[:ssl]).to match hash_including(:enabled => true, :verify => :strict)
+          expect(args[:ssl]).to match hash_including(:enabled => true, :verify => :default)
         end.and_return(es_client_double)
 
         subject.register
@@ -199,7 +201,7 @@ describe "SSL options" do
                                       :truststore => ssl_truststore_path,
                                       :truststore_type => "jks",
                                       :truststore_password => "foo",
-                                      :verify => :strict,
+                                      :verify => :default,
                                       :cipher_suites => ["TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"],
                                       :protocols => ["TLSv1.3"],
                                     )
@@ -235,7 +237,7 @@ describe "SSL options" do
                                       :ca_file => ssl_certificate_authorities_path,
                                       :client_cert => ssl_certificate_path,
                                       :client_key => ssl_key_path,
-                                      :verify => :strict,
+                                      :verify => :default,
                                       :cipher_suites => ["TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"],
                                       :protocols => ["TLSv1.3"],
                                     )

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-elasticsearch
 version: !ruby/object:Gem::Version
-  version: 3.15.0
+  version: 3.15.2
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-10 00:00:00.000000000 Z
+date: 2023-07-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -195,7 +195,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
+rubygems_version: 3.2.33
 signing_key:
 specification_version: 4
 summary: Copies fields from previous log events in Elasticsearch to current events