logstash-input-beats 6.9.10-java → 7.0.0-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aea8fa87304c3fae25d0ff75082d56efad83f0c8cdfa573f8a25b8c8858b72c3
-  data.tar.gz: f052df7f29fa91fef3f77243a18998d67595949898f5f9ec927d2f9a933d2f89
+  metadata.gz: 0f99bdf1800764220d652953474bd4b98195cca6dec131e73fdbfdfae37c7d86
+  data.tar.gz: 3bafe83e5f676a384f2c7ecc473a600b922d31e6a3f1f6c3e9b3c6b4008f73da
 SHA512:
-  metadata.gz: 2acf11ef02750723d7a44b9a55fd78553947125eb7a4feb419198bdd0ba57866c5c37ef43b98aaa23f3943ba377bb78570eb8cd25b0760aa4edf34ea59c83dca
-  data.tar.gz: 42eb08a03c47429a6304af8604e2027a2b27123eb472f68cb909d68fd3554cde5a1ede412e5800a344a2d3f748c72b7d14c1503fcf1e2ec58dc89d989020f0c0
+  metadata.gz: 4d7ad1989c834ef2b9230904b0cf4bf19e168de73db12a7e06ea1a90edc546c4823b32cb823f68ee815740760716d315537c682adb91b7d5ab8b18b3d251f3c0
+  data.tar.gz: 709f7c0e404c009390fc94468ebdaa55a9cba2b702e2cf38b294ac81f00e2c227fd4242838a70bdd3e3b33236a45d16dd0177c08756e8075a503864f95acd52b

data/CHANGELOG.md

@@ -1,29 +1,14 @@
-## 6.9.10
-  - Update Netty dependency to 4.1.135.Final [#566](https://github.com/logstash-plugins/logstash-input-beats/pull/566)
-
-## 6.9.9
-  - Update Netty dependency to 4.1.134.Final [#540](https://github.com/logstash-plugins/logstash-input-beats/pull/540)
-
-## 6.9.8
-  - Update Netty dependency to 4.1.132.Final [#534](https://github.com/logstash-plugins/logstash-input-beats/pull/534)
-
-## 6.9.7
-  - Upgrade netty to 4.1.131 [#532](https://github.com/logstash-plugins/logstash-input-beats/pull/532)
-
-## 6.9.6
-  - Re-packaging the plugin [#529](https://github.com/logstash-plugins/logstash-input-beats/pull/529)
-
-## 6.9.5
-  - Upgrade netty to 4.1.129 [#526](https://github.com/logstash-plugins/logstash-input-beats/pull/526)
-
-## 6.9.4
-  - Upgrade netty to 4.1.126 [#518](https://github.com/logstash-plugins/logstash-input-beats/pull/518)
-
-## 6.9.3
-  - Upgrade netty to 4.1.118 [#514](https://github.com/logstash-plugins/logstash-input-beats/pull/514)
-
-## 6.9.2
-  - Name netty threads according to their purpose and the plugin id [#511](https://github.com/logstash-plugins/logstash-input-beats/pull/511)
+## 7.0.0
+  - Remove deprecated SSL settings
+  - SSL settings that were marked deprecated in version `6.6.0` are now marked obsolete, and will prevent the plugin from starting.
+  - These settings are:
+    - `cipher_suites`, replaced by `ssl_cipher_suites`
+    - `ssl`, replaced by `ssl_enabled`
+    - `ssl_peer_metadata`, replaced by `enrich`
+    - `ssl_verify_mode`, replaced by `ssl_client_authentication`
+    - `tls_max_version`, replaced by `ssl_supported_protocols`
+    - `tls_min_version`, replaced by `ssl_supported_protocols`
+    - [#508](https://github.com/logstash-plugins/logstash-input-beats/pull/508)
 
 ## 6.9.1
   - Upgrade netty to 4.1.115 [#507](https://github.com/logstash-plugins/logstash-input-beats/pull/507)

data/VERSION

@@ -1 +1 @@
-6.9.10
+7.0.0

data/docs/index.asciidoc

@@ -209,11 +209,13 @@ e|N/A
 
 This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
 
+NOTE: As of version `7.0.0` of this plugin, a number of previously deprecated settings related to SSL have been removed.
+Please check out <<plugins-{type}s-{plugin}-obsolete-options>> for details.
+
 [cols="<,<,<",options="header",]
 |=======================================================================
 |Setting |Input type|Required
 | <<plugins-{type}s-{plugin}-add_hostname>> |<<boolean,boolean>>|__Deprecated__
-| <<plugins-{type}s-{plugin}-cipher_suites>> |<<array,array>>|__Deprecated__
 | <<plugins-{type}s-{plugin}-client_inactivity_timeout>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-ecs_compatibility>> | <<string,string>>|No
 | <<plugins-{type}s-{plugin}-enrich>> |<<string,string>>|No
@@ -222,7 +224,6 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-host>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-include_codec_tag>> |<<boolean,boolean>>|__Deprecated__
 | <<plugins-{type}s-{plugin}-port>> |<<number,number>>|Yes
-| <<plugins-{type}s-{plugin}-ssl>> |<<boolean,boolean>>|__Deprecated__
 | <<plugins-{type}s-{plugin}-ssl_certificate>> |a valid filesystem path|No
 | <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-ssl_cipher_suites>> |<<array,array>>|No
@@ -231,11 +232,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-ssl_handshake_timeout>> |<<number,number>>|No
 | <<plugins-{type}s-{plugin}-ssl_key>> |a valid filesystem path|No
 | <<plugins-{type}s-{plugin}-ssl_key_passphrase>> |<<password,password>>|No
-| <<plugins-{type}s-{plugin}-ssl_peer_metadata>> |<<boolean,boolean>>|__Deprecated__
 | <<plugins-{type}s-{plugin}-ssl_supported_protocols>> |<<array,array>>|No
-| <<plugins-{type}s-{plugin}-ssl_verify_mode>> |<<string,string>>, one of `["none", "peer", "force_peer"]`|__Deprecated__
-| <<plugins-{type}s-{plugin}-tls_max_version>> |<<number,number>>|__Deprecated__
-| <<plugins-{type}s-{plugin}-tls_min_version>> |<<number,number>>|__Deprecated__
 |=======================================================================
 
 Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
@@ -253,14 +250,6 @@ input plugins.
 
 Flag to determine whether to add `host` field to event using the value supplied by the {plugin-singular} in the `hostname` field.
 
-[id="plugins-{type}s-{plugin}-cipher_suites"]
-===== `cipher_suites`
-deprecated[6.4.0, Replaced by <<plugins-{type}s-{plugin}-ssl_cipher_suites>>]
-
-  * Value type is <<array,array>>
-
-The list of cipher suites to use, listed by priorities.
-
 [id="plugins-{type}s-{plugin}-client_inactivity_timeout"]
 ===== `client_inactivity_timeout`
 
@@ -399,17 +388,6 @@ deprecated[6.5.0, Replaced by <<plugins-{type}s-{plugin}-enrich>>]
 
 The port to listen on.
 
-[id="plugins-{type}s-{plugin}-ssl"]
-===== `ssl`
-deprecated[6.6.0, Replaced by <<plugins-{type}s-{plugin}-ssl_enabled>>]
-
-  * Value type is <<boolean,boolean>>
-  * Default value is `false`
-
-Events are by default sent in plain text. You can
-enable encryption by setting `ssl` to true and configuring
-the `ssl_certificate` and `ssl_key` options.
-
 [id="plugins-{type}s-{plugin}-ssl_certificate"]
 ===== `ssl_certificate`
 
@@ -497,18 +475,6 @@ openssl pkcs8 -inform PEM -in path/to/logstash.key -topk8 -nocrypt -outform PEM
 
 SSL key passphrase to use.
 
-[id="plugins-{type}s-{plugin}-ssl_peer_metadata"]
-===== `ssl_peer_metadata`
-
-deprecated[6.5.0, Replaced by <<plugins-{type}s-{plugin}-enrich>>]
-
-  * Value type is <<boolean,boolean>>
-  * Default value is `false`
-
-Enables storing client certificate information in event's metadata.
-
-This option is only valid when <<plugins-{type}s-{plugin}-ssl_client_authentication>> is set to `optional` or `required`.
-
 [id="plugins-{type}s-{plugin}-ssl_supported_protocols"]
 ===== `ssl_supported_protocols`
 
@@ -526,45 +492,23 @@ NOTE: If you configure the plugin to use `'TLSv1.1'` on any recent JVM, such as
 the protocol is disabled by default and needs to be enabled manually by changing `jdk.tls.disabledAlgorithms` in
 the *$JDK_HOME/conf/security/java.security* configuration file. That is, `TLSv1.1` needs to be removed from the list.
 
-[id="plugins-{type}s-{plugin}-ssl_verify_mode"]
-===== `ssl_verify_mode`
-deprecated[6.6.0, Replaced by <<plugins-{type}s-{plugin}-ssl_client_authentication>>]
-
-  * Value can be any of: `none`, `peer`, `force_peer`
-  * Default value is `"none"`
-
-By default, the server doesn't do any client verification. If the <<plugins-{type}s-{plugin}-ssl_certificate_authorities>>
-is configured, and no value or `none` is provided for this option, it defaults to `force_peer` instead of `none`.
-
-`peer` will make the server ask the client to provide a certificate.
-If the client provides a certificate, it will be validated.
-
-`force_peer` will make the server ask the client to provide a certificate.
-If the client doesn't provide a certificate, the connection will be closed.
+[id="plugins-{type}s-{plugin}-obsolete-options"]
+==== Beats Input Obsolete Configuration Options
 
-When mutual TLS is enabled (`peer` or `force_peer`), the certificate presented by the client must be signed by trusted
-<<plugins-{type}s-{plugin}-ssl_certificate_authorities>> (CAs).
-Please note that the server does not validate the client certificate CN (Common Name) or SAN (Subject Alternative Name).
-
-NOTE: This setting can be used only if <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> is set.
+WARNING: As of version `7.0.0` of this plugin, some configuration options have been replaced.
+The plugin will fail to start if it contains any of these obsolete options.
 
-[id="plugins-{type}s-{plugin}-tls_max_version"]
-===== `tls_max_version`
-deprecated[6.4.0, Replaced by <<plugins-{type}s-{plugin}-ssl_supported_protocols>>]
 
-  * Value type is <<number,number>>
-
-The maximum TLS version allowed for the encrypted connections.
-The value must be the one of the following: 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLSv1.3
-
-[id="plugins-{type}s-{plugin}-tls_min_version"]
-===== `tls_min_version`
-deprecated[6.4.0, Replaced by <<plugins-{type}s-{plugin}-ssl_supported_protocols>>]
-
-  * Value type is <<number,number>>
-
-The minimum TLS version allowed for the encrypted connections.
-The value must be one of the following: 1.1 for TLS 1.1, 1.2 for TLS 1.2, 1.3 for TLS 1.3
+[cols="<,<",options="header",]
+|=======================================================================
+|Setting|Replaced by
+| cipher_suites |<<plugins-{type}s-{plugin}-ssl_cipher_suites>>
+| ssl |<<plugins-{type}s-{plugin}-ssl_enabled>>
+| ssl_peer_metadata |<<plugins-{type}s-{plugin}-enrich>>
+| ssl_verify_mode |<<plugins-{type}s-{plugin}-ssl_client_authentication>>
+| tls_max_version |<<plugins-{type}s-{plugin}-ssl_supported_protocols>>
+| tls_min_version |<<plugins-{type}s-{plugin}-ssl_supported_protocols>>
+|=======================================================================
 
 
 [id="plugins-{type}s-{plugin}-common-options"]

data/lib/logstash/inputs/beats.rb

@@ -7,7 +7,6 @@ require "logstash/util"
 require "logstash-input-beats_jars"
 require "logstash/plugin_mixins/ecs_compatibility_support"
 require 'logstash/plugin_mixins/plugin_factory_support'
-require "logstash/plugin_mixins/normalize_config_support"
 require 'logstash/plugin_mixins/event_support/event_factory_adapter'
 require_relative "beats/patch"
 
@@ -51,7 +50,6 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   require "logstash/inputs/beats/decoded_event_transform"
   require "logstash/inputs/beats/raw_event_transform"
   require "logstash/inputs/beats/message_listener"
-  require "logstash/inputs/beats/tls"
 
   java_import 'org.logstash.netty.SslContextBuilder'
 
@@ -62,8 +60,6 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
 
   include LogStash::PluginMixins::PluginFactorySupport
 
-  include LogStash::PluginMixins::NormalizeConfigSupport
-
   config_name "beats"
 
   default :codec, "plain"
@@ -74,11 +70,6 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   # The port to listen on.
   config :port, :validate => :number, :required => true
 
-  # Events are by default sent in plain text. You can
-  # enable encryption by setting `ssl` to true and configuring
-  # the `ssl_certificate` and `ssl_key` options.
-  config :ssl, :validate => :boolean, :default => false, :deprecated => "Use 'ssl_enabled' instead."
-
   # SSL certificate to use.
   config :ssl_certificate, :validate => :path
 
@@ -97,8 +88,8 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
 
   # Validate client certificates against these authorities. 
   # You can define multiple files or paths. All the certificates will
-  # be read and added to the trust store. You need to configure the `ssl_verify_mode`
-  # to `peer` or `force_peer` to enable the verification.
+  # be read and added to the trust store. You need to configure the `ssl_client_authentication`
+  # to `optional` or `required` to enable the client verification.
   # 
   config :ssl_certificate_authorities, :validate => :array, :default => []
 
@@ -110,21 +101,6 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   # This option needs to be used with `ssl_certificate_authorities` and a defined list of CAs.
   config :ssl_client_authentication, :validate => %w[none optional required], :default => 'none'
 
-  # By default the server doesn't do any client verification.
-  # 
-  # `peer` will make the server ask the client to provide a certificate. 
-  # If the client provides a certificate, it will be validated.
-  #
-  # `force_peer` will make the server ask the client to provide a certificate.
-  # If the client doesn't provide a certificate, the connection will be closed.
-  #
-  # This option needs to be used with `ssl_certificate_authorities` and a defined list of CAs.
-  config :ssl_verify_mode, :validate => ["none", "peer", "force_peer"], :default => "none", :deprecated => "Set 'ssl_client_authentication' instead."
-
-  # Enables storing client certificate information in event's metadata. You need 
-  # to configure the `ssl_verify_mode` to `peer` or `force_peer` to enable this.
-  config :ssl_peer_metadata, :validate => :boolean, :default => false, :deprecated => "use `enrich` option to configure which enrichments to perform"
-
   config :include_codec_tag, :validate => :boolean, :default => true, :deprecated => "use `enrich` option to configure which enrichments to perform"
 
   # Time in milliseconds for an incomplete ssl handshake to timeout
@@ -148,21 +124,18 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   # Flag to determine whether to add host information (provided by the beat in the 'hostname' field) to the event
   config :add_hostname, :validate => :boolean, :default => false, :deprecated => 'This option will be removed in the future as beats determine the event schema'
 
-  # The list of ciphers suite to use, listed by priorities.
-  config :cipher_suites, :validate => :array, :default => [], :deprecated => "Set 'ssl_cipher_suites' instead."
-
-  # The minimum TLS version allowed for the encrypted connections. The value must be one of the following:
-  # 1.0 for TLS 1.0, 1.1 for TLS 1.1, 1.2 for TLS 1.2
-  config :tls_min_version, :validate => :number, :default => TLS.min.version, :deprecated => "Set 'ssl_supported_protocols' instead."
-
-  # The maximum TLS version allowed for the encrypted connections. The value must be the one of the following:
-  # 1.0 for TLS 1.0, 1.1 for TLS 1.1, 1.2 for TLS 1.2
-  config :tls_max_version, :validate => :number, :default => TLS.max.version, :deprecated => "Set 'ssl_supported_protocols' instead."
+  # removed options
+  config :ssl,                :obsolete => "Use 'ssl_enabled' instead."
+  config :ssl_peer_metadata,  :obsolete => "Use 'enrich' instead."
+  config :ssl_verify_mode,    :obsolete => "Use 'ssl_client_authentication' instead."
+  config :cipher_suites,      :obsolete => "Use 'ssl_cipher_suites' instead."
+  config :tls_min_version,    :obsolete => "Use 'ssl_supported_protocols' instead."
+  config :tls_max_version,    :obsolete => "Use 'ssl_supported_protocols' instead."
 
   ENRICH_DEFAULTS = {
     'source_metadata'   => true,
     'codec_metadata'    => true,
-    'ssl_peer_metadata' => false,
+    'ssl_peer_metadata' => false, # adds client certificate information in event's metadata
   }.freeze
 
   ENRICH_ALL = ENRICH_DEFAULTS.keys.freeze
@@ -174,29 +147,16 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
 
   attr_reader :field_hostname, :field_hostip
   attr_reader :field_tls_protocol_version, :field_tls_peer_subject, :field_tls_cipher
+  attr_reader :include_ssl_peer_metadata
   attr_reader :include_source_metadata
 
-  NON_PREFIXED_SSL_CONFIGS = Set[
-    'tls_min_version',
-    'tls_max_version',
-    'cipher_suites',
-  ].freeze
-
   SSL_CLIENT_AUTH_NONE = 'none'.freeze
   SSL_CLIENT_AUTH_OPTIONAL = 'optional'.freeze
   SSL_CLIENT_AUTH_REQUIRED = 'required'.freeze
 
-  SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP = {
-    'none' => SSL_CLIENT_AUTH_NONE,
-    'peer' => SSL_CLIENT_AUTH_OPTIONAL,
-    'force_peer' => SSL_CLIENT_AUTH_REQUIRED
-  }.freeze
-
   private_constant :SSL_CLIENT_AUTH_NONE
   private_constant :SSL_CLIENT_AUTH_OPTIONAL
   private_constant :SSL_CLIENT_AUTH_REQUIRED
-  private_constant :NON_PREFIXED_SSL_CONFIGS
-  private_constant :SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP
 
   def register
     # For Logstash 2.4 we need to make sure that the logger is correctly set for the
@@ -208,15 +168,13 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
       LogStash::Logger.setup_log4j(@logger)
     end
 
-    setup_ssl_params!
-
     validate_ssl_config!
 
     active_enrichments = resolve_enriches
 
     @include_source_metadata = active_enrichments.include?('source_metadata')
+    @include_ssl_peer_metadata = active_enrichments.include?('ssl_peer_metadata')
     @include_codec_tag = original_params.include?('include_codec_tag') ? params['include_codec_tag'] : active_enrichments.include?('codec_metadata')
-    @ssl_peer_metadata = original_params.include?('ssl_peer_metadata') ? params['ssl_peer_metadata'] : active_enrichments.include?('ssl_peer_metadata')
 
     # intentionally ask users to provide codec when they want to use the codec metadata
     # second layer enrich is also a controller, provide enrich => ['codec_metadata' or/with 'source_metadata'] with codec if you override event original
@@ -247,7 +205,7 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   end # def register
 
   def create_server
-    server = org.logstash.beats.Server.new(@id, @host, @port, @client_inactivity_timeout, @event_loop_threads, @executor_threads)
+    server = org.logstash.beats.Server.new(@host, @port, @client_inactivity_timeout, @event_loop_threads, @executor_threads)
     server.setSslHandlerProvider(new_ssl_handshake_provider(new_ssl_context_builder)) if @ssl_enabled
     server
   end
@@ -275,9 +233,7 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
       return client_authentication_optional? || client_authentication_required?
     end
 
-    # Keep backward compatibility with the deprecated `ssl_verify_mode` until it's not removed.
-    # When it's explicitly set (or both settings are absent), it should use the ssl_certificate_authorities
-    # to enable/disable the client authentication. (even if ssl_verify_mode => none)
+    # also uses the ssl_certificate_authorities to enable/disable the client authentication
     certificate_authorities_configured?
   end
 
@@ -286,7 +242,7 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   end
 
   def client_authentication_metadata?
-    @ssl_enabled && @ssl_peer_metadata && ssl_configured? && client_authentication_enabled?
+    @ssl_enabled && @include_ssl_peer_metadata && ssl_configured? && client_authentication_enabled?
   end
 
   def client_authentication_required?
@@ -312,10 +268,10 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   private
 
   def validate_ssl_config!
-    ssl_config_name = original_params.include?('ssl') ? 'ssl' : 'ssl_enabled'
+    ssl_config_name = 'ssl_enabled'
 
     unless @ssl_enabled
-      ignored_ssl_settings = original_params.select { |k| k != 'ssl_enabled' && k.start_with?('ssl_') || NON_PREFIXED_SSL_CONFIGS.include?(k) }
+      ignored_ssl_settings = original_params.select { |k| k != 'ssl_enabled' && k.start_with?('ssl_') }
       @logger.warn("Configured SSL settings are not used when `#{ssl_config_name}` is set to `false`: #{ignored_ssl_settings.keys}") if ignored_ssl_settings.any?
       return
     end
@@ -329,13 +285,11 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
     end
 
     if require_certificate_authorities? && !certificate_authorities_configured?
-      config_name, config_value = provided_client_authentication_config
-      configuration_error "ssl_certificate_authorities => is a required setting when #{config_name} => '#{config_value}' is configured"
+      configuration_error "ssl_certificate_authorities => is a required setting when `ssl_client_authentication => '#{@ssl_client_authentication}'` is configured"
     end
 
     if client_authentication_metadata? && !require_certificate_authorities?
-      config_name, optional, required = provided_client_authentication_config([SSL_CLIENT_AUTH_OPTIONAL, SSL_CLIENT_AUTH_REQUIRED])
-      configuration_error "Configuring ssl_peer_metadata => true requires #{config_name} => to be configured with '#{optional}' or '#{required}'"
+      configuration_error "Configuring `enrich => [ssl_peer_metadata]` requires `ssl_client_authentication` to be configured with '#{SSL_CLIENT_AUTH_OPTIONAL}' or '#{SSL_CLIENT_AUTH_REQUIRED}'"
     end
 
     if original_params.include?('ssl_client_authentication') && certificate_authorities_configured? && !require_certificate_authorities?
@@ -343,43 +297,6 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
     end
   end
 
-  def provided_client_authentication_config(values = [@ssl_client_authentication])
-    if original_params.include?('ssl_verify_mode')
-      ['ssl_verify_mode', *values.map { |v| SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP.key(v) }]
-    else
-      ['ssl_client_authentication', *values]
-    end
-  end
-
-  def setup_ssl_params!
-    @ssl_enabled = normalize_config(:ssl_enabled) do |normalizer|
-      normalizer.with_deprecated_alias(:ssl)
-    end
-
-    @ssl_cipher_suites = normalize_config(:ssl_cipher_suites) do |normalizer|
-      normalizer.with_deprecated_alias(:cipher_suites)
-    end
-
-    @ssl_supported_protocols = normalize_config(:ssl_supported_protocols) do |normalizer|
-      normalizer.with_deprecated_mapping(:tls_min_version, :tls_max_version) do |tls_min_version, tls_max_version|
-        TLS.get_supported(tls_min_version..tls_max_version).map(&:name)
-      end
-    end
-
-    @ssl_client_authentication = normalize_config(:ssl_client_authentication) do |normalizer|
-      normalizer.with_deprecated_mapping(:ssl_verify_mode) do |ssl_verify_mode|
-        normalized_value = SSL_VERIFY_MODE_TO_CLIENT_AUTHENTICATION_MAP[ssl_verify_mode.downcase]
-        fail(LogStash::ConfigurationError, "Unsupported value #{ssl_verify_mode} for deprecated option `ssl_verify_mode`") unless normalized_value
-        normalized_value
-      end
-    end
-
-    params['ssl_enabled'] = @ssl_enabled unless @ssl_enabled.nil?
-    params['ssl_cipher_suites'] = @ssl_cipher_suites unless @ssl_cipher_suites.nil?
-    params['ssl_supported_protocols'] = @ssl_supported_protocols unless @ssl_supported_protocols.nil?
-    params['ssl_client_authentication'] = @ssl_client_authentication unless @ssl_client_authentication.nil?
-  end
-
   def new_ssl_handshake_provider(ssl_context_builder)
     begin
       org.logstash.netty.SslHandlerProvider.new(ssl_context_builder.build_context, @ssl_handshake_timeout)
@@ -414,7 +331,6 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
     return SslContextBuilder::SslClientVerifyMode::OPTIONAL if client_authentication_optional?
     return SslContextBuilder::SslClientVerifyMode::REQUIRED if client_authentication_required?
 
-    # Backward compatibility with the deprecated `ssl_verify_mode` and the current `none` overrides
     if !original_params.include?('ssl_client_authentication') && certificate_authorities_configured?
       return SslContextBuilder::SslClientVerifyMode::REQUIRED
     end
@@ -444,9 +360,8 @@ class LogStash::Inputs::Beats < LogStash::Inputs::Base
   end
 
   def resolve_enriches
-    deprecated_flags_provided = %w(ssl_peer_metadata include_codec_tag) & original_params.keys
-    if deprecated_flags_provided.any? && original_params.include?('enrich')
-      raise LogStash::ConfigurationError, "both `enrich` and (deprecated) #{deprecated_flags_provided.join(',')} were provided; use only `enrich`"
+    if original_params.include?('include_codec_tag') && original_params.include?('enrich')
+      raise LogStash::ConfigurationError, "both `enrich` and (deprecated) `include_codec_tag` were provided; use only `enrich`"
     end
 
     aliases_provided = ENRICH_ALIASES & (@enrich || [])

data/lib/logstash-input-beats_jars.rb

@@ -1,12 +1,11 @@
 # AUTOGENERATED BY THE GRADLE SCRIPT. DO NOT EDIT.
 
 require 'jar_dependencies'
-require_jar('io.netty', 'netty-handler', '4.1.135.Final')
+require_jar('io.netty', 'netty-buffer', '4.1.115.Final')
+require_jar('io.netty', 'netty-codec', '4.1.115.Final')
+require_jar('io.netty', 'netty-common', '4.1.115.Final')
+require_jar('io.netty', 'netty-transport', '4.1.115.Final')
+require_jar('io.netty', 'netty-handler', '4.1.115.Final')
+require_jar('io.netty', 'netty-transport-native-unix-common', '4.1.115.Final')
 require_jar('org.javassist', 'javassist', '3.24.0-GA')
-require_jar('io.netty', 'netty-transport-native-unix-common', '4.1.135.Final')
-require_jar('io.netty', 'netty-codec', '4.1.135.Final')
-require_jar('io.netty', 'netty-transport', '4.1.135.Final')
-require_jar('io.netty', 'netty-resolver', '4.1.135.Final')
-require_jar('io.netty', 'netty-buffer', '4.1.135.Final')
-require_jar('io.netty', 'netty-common', '4.1.135.Final')
-require_jar('org.logstash.beats', 'logstash-input-beats', '6.9.10')
+require_jar('org.logstash.beats', 'logstash-input-beats', '7.0.0')

data/lib/tasks/test.rake

@@ -4,9 +4,9 @@ VENDOR_PATH = File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "ve
 
 #TODO: Figure out better means to keep this version in sync
 if OS_PLATFORM == "linux"
-  FILEBEAT_URL = "https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.19.2-linux-x86_64.tar.gz"
+  FILEBEAT_URL = "https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.6.0-linux-x86_64.tar.gz"
 elsif OS_PLATFORM == "darwin"
-  FILEBEAT_URL = "https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.19.2-linux-arm64.tar.gz"
+  FILEBEAT_URL = "https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.6.0-darwin-x86_64.tar.gz"
 end
 
 require "fileutils"

data/logstash-input-beats.gemspec

@@ -26,10 +26,10 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "concurrent-ruby", "~> 1.0"
   s.add_runtime_dependency "thread_safe", "~> 0.3.5"
   s.add_runtime_dependency "logstash-codec-multiline", ">= 2.0.5"
+  s.add_runtime_dependency 'jar-dependencies', '~> 0.3', '>= 0.3.4'
   s.add_runtime_dependency 'logstash-mixin-ecs_compatibility_support', '~>1.3'
   s.add_runtime_dependency 'logstash-mixin-event_support', '~>1.0'
   s.add_runtime_dependency 'logstash-mixin-plugin_factory_support', '~>1.0'
-  s.add_runtime_dependency 'logstash-mixin-normalize_config_support', '~>1.0'
 
   s.add_development_dependency "flores", "~>0.0.6"
   s.add_development_dependency "rspec"