logstash-filter-elasticsearch 4.4.0 → 4.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10a199f70ca7ff54065e7e4963955fdf4d53d0518600aab629afaa411d160e83
-  data.tar.gz: a5dc7db41fa52d8fc015251f7bbc01306ff56fa0f08788fa24e07a9786fb9271
+  metadata.gz: 460b1e72f53335af42fd95c998fb8fe158a705beeaf60e53d199aa8b9c64ab6f
+  data.tar.gz: 1d031b1b9783a30d7d849c320dc0ca7fec747192ee6e6a818b5873eb7a678875
 SHA512:
-  metadata.gz: e863b563166c5e221435aa0df97a196dee7640810266089ed2ba76f931986631a3d573c2bc82a16457b19d7c33e8edef09ee65b2b0ae556515ed8267cee5e298
-  data.tar.gz: 3fa03c7460eb9c345251bfe02b93b9b00d975592dc1efd8a18aa4bd3a35c73e48407cc6b65b22288f218578b3eacdaedbbbe4980a2c851bf74ed5463ca6d603a
+  metadata.gz: 24c037f834fadb3d4c5f988d197f2bc3de60c657bc00be9d04ee97e979adcd18c8e99deefda37e836ab49976402b659e0cb6d71c4b2f1a0e01e0d7fc9703f0e3
+  data.tar.gz: 8bcf2cf0303eb4339b1ebdffeb01a2588c5826ec8178fdffd8d0fc755008f3fffbfa8edf31abc80c0e4078536f2c18d36e14919902ced4046d562f5ba9946b2d

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 4.4.1
+  - Support Elastic Cloud API keys in the `api_key` option, which now accepts an `id:api_key` pair, its base64-encoded form, or an `essu_` Cloud API key, and rejects an unrecognized format at startup [#215](https://github.com/logstash-plugins/logstash-filter-elasticsearch/pull/215)
+
 ## 4.4.0
   - Drop a support for Logstash 7.x by requiring `elasticsearch` gem >= 8. Logstash 8+ continues to work as before. [#213](https://github.com/logstash-plugins/logstash-filter-elasticsearch/pull/213)
 

data/docs/index.asciidoc

@@ -307,8 +307,11 @@ Example:
 Authenticate using Elasticsearch API key. Note that this option also requires
 enabling the <<plugins-{type}s-{plugin}-ssl_enabled>> option.
 
-Format is `id:api_key` where `id` and `api_key` are as returned by the
-Elasticsearch {ref}/security-api-create-api-key.html[Create API key API].
+The format is `id:api_key`, where `id` and `api_key` are as returned by the
+Elasticsearch {ref}/security-api-create-api-key.html[Create API key API]. The
+base64-encoded form of that pair is also accepted, as is an
+https://www.elastic.co/docs/deploy-manage/api-keys/elastic-cloud-api-keys[Elastic Cloud API key]
+(prefixed with `essu_`), which is used as-is.
 
 [id="plugins-{type}s-{plugin}-ca_trusted_fingerprint"]
 ===== `ca_trusted_fingerprint`

data/lib/logstash/filters/elasticsearch/client.rb

@@ -102,10 +102,32 @@ module LogStash
       def setup_api_key(api_key)
         return {} unless (api_key&.value)
 
-        token = base64?(api_key.value) ? api_key.value : Base64.strict_encode64(api_key.value)
+        token = resolve_api_key(api_key.value)
         { 'Authorization' => "ApiKey #{token}" }
       end
 
+      # Resolves the `api_key` value into the credential used in the
+      # `Authorization: ApiKey` header. An already base64-encoded key and an
+      # Elastic Cloud API key are used as-is; a raw `id:api_key` pair is
+      # base64-encoded. An unrecognized value is rejected so a malformed key
+      # surfaces at startup rather than as a later authentication failure.
+      def resolve_api_key(key_value)
+        if base64?(key_value) || cloud_api_key?(key_value)
+          key_value
+        elsif key_value.match?(/\A[^:]+:[^:]+\z/)
+          Base64.strict_encode64(key_value)
+        else
+          raise LogStash::ConfigurationError, "Invalid api_key format. Expected a base64-encoded key, an 'id:api_key' pair, or a Cloud API key (essu_ prefix)."
+        end
+      end
+
+      # Elastic Cloud API keys (such as the unified Serverless keys) are opaque
+      # tokens prefixed with `essu_` that Elasticsearch accepts verbatim in the
+      # `Authorization: ApiKey` header, with no base64 encoding.
+      def cloud_api_key?(string)
+        string.match?(/\Aessu_.+/)
+      end
+
       def base64?(string)
         string == Base64.strict_encode64(Base64.strict_decode64(string))
       rescue ArgumentError

data/lib/logstash/filters/elasticsearch.rb

@@ -72,7 +72,8 @@ class LogStash::Filters::Elasticsearch < LogStash::Filters::Base
   config :cloud_auth, :validate => :password
 
   # Authenticate using Elasticsearch API key.
-  # format is id:api_key (as returned by https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key])
+  # Format is either the `id:api_key` pair (as returned by https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key]),
+  # its base64-encoded form, or an https://www.elastic.co/docs/deploy-manage/api-keys/elastic-cloud-api-keys[Elastic Cloud API key] (prefixed with `essu_`) can be used.
   config :api_key, :validate => :password
 
   # Set the address of a forward HTTP proxy.

data/logstash-filter-elasticsearch.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
 
   # Files
-  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]
+  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "version", "docs/**/*"]
 
   # Tests
   s.test_files = s.files.grep(%r{^(test|spec|features)/})

data/spec/filters/elasticsearch_spec.rb

@@ -325,6 +325,31 @@ describe LogStash::Filters::Elasticsearch do
           it_behaves_like "a plugin that sets the ApiKey authorization header"
         end
 
+        context "with an Elastic Cloud API key (essu_ prefix)" do
+          # The suffix is intentionally not canonical base64: a Cloud key is opaque
+          # and must be forwarded verbatim regardless of its payload encoding.
+          let(:api_key_value) { "essu_VFZGblZreFhTekJ4ZDB4M2NHUnZRMEU2YzNWd1pYSnpaV055WlhRPQ==AAAAAAAA" }
+
+          it "sets the Authorization header verbatim without re-encoding" do
+            plugin.register
+            client = plugin.send(:get_client).client
+            auth_header = extract_transport(client).options[:transport_options][:headers]['Authorization']
+
+            expect(auth_header).to eql("ApiKey #{api_key_value}")
+          end
+        end
+
+        context "with an unrecognized api_key format" do
+          let(:api_key_value) { "not-a-valid-key" }
+
+          # `test_connection!` and `setup_serverless` are stubbed here, so the
+          # client is built explicitly, as in the other api_key examples.
+          it "fails to build a client with a configuration error" do
+            plugin.register
+            expect { plugin.send(:get_client) }.to raise_error(LogStash::ConfigurationError, /Invalid api_key format/)
+          end
+        end
+
         context 'user also set' do
           let(:config) { super().merge({ 'api_key' => 'foo:bar', 'user' => 'another' }) }
 

data/version

@@ -0,0 +1 @@
+4.4.1

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-elasticsearch
 version: !ruby/object:Gem::Version
-  version: 4.4.0
+  version: 4.4.1
 platform: ruby
 authors:
 - Elastic
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-07-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api
@@ -196,6 +196,7 @@ files:
 - spec/filters/fixtures/test_certs/ls.key
 - spec/filters/integration/elasticsearch_esql_spec.rb
 - spec/filters/integration/elasticsearch_spec.rb
+- version
 homepage: https://elastic.co/logstash
 licenses:
 - Apache License (2.0)
@@ -216,7 +217,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 3.6.3
 specification_version: 4
 summary: Copies fields from previous log events in Elasticsearch to current events
 test_files: