logstash-input-elasticsearch 4.23.1 → 5.0.0

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-elasticsearch
 version: !ruby/object:Gem::Version
-  version: 4.23.1
+  version: 5.0.0
 platform: ruby
 authors:
 - Elastic
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-17 00:00:00.000000000 Z
+date: 2024-12-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: logstash-core-plugin-api
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -19,6 +19,7 @@ dependencies:
     - - "<="
       - !ruby/object:Gem::Version
         version: '2.99'
+  name: logstash-core-plugin-api
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -30,12 +31,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.99'
 - !ruby/object:Gem::Dependency
-  name: logstash-mixin-ecs_compatibility_support
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
+  name: logstash-mixin-ecs_compatibility_support
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -44,12 +45,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.3'
 - !ruby/object:Gem::Dependency
-  name: logstash-mixin-event_support
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+  name: logstash-mixin-event_support
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -58,12 +59,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
-  name: logstash-mixin-validator_support
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+  name: logstash-mixin-validator_support
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -72,12 +73,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
-  name: logstash-mixin-scheduler
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+  name: logstash-mixin-scheduler
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -86,15 +87,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
-  name: elasticsearch
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: 7.17.9
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '9'
+  name: elasticsearch
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -102,16 +100,13 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 7.17.9
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '9'
 - !ruby/object:Gem::Dependency
-  name: logstash-mixin-ca_trusted_fingerprint_support
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+  name: logstash-mixin-ca_trusted_fingerprint_support
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -120,12 +115,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
-  name: logstash-mixin-normalize_config_support
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+  name: logstash-mixin-normalize_config_support
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -134,12 +129,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
-  name: tzinfo
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+  name: tzinfo
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -148,12 +143,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: tzinfo-data
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+  name: tzinfo-data
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -162,12 +157,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: manticore
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.7.1
+  name: manticore
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -176,12 +171,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 0.7.1
 - !ruby/object:Gem::Dependency
-  name: logstash-codec-plain
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+  name: logstash-codec-plain
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -190,12 +185,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: logstash-devutils
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+  name: logstash-devutils
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -204,12 +199,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: timecop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+  name: timecop
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -218,12 +213,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: cabin
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.6'
+  name: cabin
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -232,12 +227,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0.6'
 - !ruby/object:Gem::Dependency
-  name: webrick
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+  name: webrick
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -246,12 +241,12 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: rufus-scheduler
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 3.0.9
+  name: rufus-scheduler
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -277,35 +272,27 @@ files:
 - lib/logstash/helpers/loggable_try.rb
 - lib/logstash/inputs/elasticsearch.rb
 - lib/logstash/inputs/elasticsearch/aggregation.rb
-- lib/logstash/inputs/elasticsearch/cursor_tracker.rb
-- lib/logstash/inputs/elasticsearch/esql.rb
 - lib/logstash/inputs/elasticsearch/paginated_search.rb
 - lib/logstash/inputs/elasticsearch/patches/_elasticsearch_transport_connections_selector.rb
 - lib/logstash/inputs/elasticsearch/patches/_elasticsearch_transport_http_manticore.rb
 - logstash-input-elasticsearch.gemspec
 - spec/es_helper.rb
-- spec/fixtures/test_certs/GENERATED_AT
 - spec/fixtures/test_certs/ca.crt
 - spec/fixtures/test_certs/ca.der.sha256
 - spec/fixtures/test_certs/ca.key
-- spec/fixtures/test_certs/es.chain.crt
 - spec/fixtures/test_certs/es.crt
 - spec/fixtures/test_certs/es.key
-- spec/fixtures/test_certs/renew.sh
-- spec/inputs/cursor_tracker_spec.rb
-- spec/inputs/elasticsearch_esql_spec.rb
 - spec/inputs/elasticsearch_spec.rb
 - spec/inputs/elasticsearch_ssl_spec.rb
-- spec/inputs/integration/elasticsearch_esql_spec.rb
 - spec/inputs/integration/elasticsearch_spec.rb
 - spec/inputs/paginated_search_spec.rb
-- version
-homepage: https://elastic.co/logstash
+homepage: http://www.elastic.co/guide/en/logstash/current/index.html
 licenses:
 - Apache License (2.0)
 metadata:
   logstash_plugin: 'true'
   logstash_group: input
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -320,23 +307,18 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.3
+rubygems_version: 3.3.26
+signing_key:
 specification_version: 4
 summary: Reads query results from an Elasticsearch cluster
 test_files:
 - spec/es_helper.rb
-- spec/fixtures/test_certs/GENERATED_AT
 - spec/fixtures/test_certs/ca.crt
 - spec/fixtures/test_certs/ca.der.sha256
 - spec/fixtures/test_certs/ca.key
-- spec/fixtures/test_certs/es.chain.crt
 - spec/fixtures/test_certs/es.crt
 - spec/fixtures/test_certs/es.key
-- spec/fixtures/test_certs/renew.sh
-- spec/inputs/cursor_tracker_spec.rb
-- spec/inputs/elasticsearch_esql_spec.rb
 - spec/inputs/elasticsearch_spec.rb
 - spec/inputs/elasticsearch_ssl_spec.rb
-- spec/inputs/integration/elasticsearch_esql_spec.rb
 - spec/inputs/integration/elasticsearch_spec.rb
 - spec/inputs/paginated_search_spec.rb

data/lib/logstash/inputs/elasticsearch/cursor_tracker.rb

@@ -1,58 +0,0 @@
-require 'fileutils'
-
-module LogStash; module Inputs; class Elasticsearch
-  class CursorTracker
-    include LogStash::Util::Loggable
-
-    attr_reader :last_value
-
-    def initialize(last_run_metadata_path:, tracking_field:, tracking_field_seed:)
-      @last_run_metadata_path = last_run_metadata_path
-      @last_value_hashmap = Java::java.util.concurrent.ConcurrentHashMap.new
-      @last_value = IO.read(@last_run_metadata_path) rescue nil || tracking_field_seed
-      @tracking_field = tracking_field
-      logger.info "Starting value for cursor field \"#{@tracking_field}\": #{@last_value}"
-      @mutex = Mutex.new
-    end
-
-    def checkpoint_cursor(intermediate: true)
-      @mutex.synchronize do
-        if intermediate
-          # in intermediate checkpoints pick the smallest
-          converge_last_value {|v1, v2| v1 < v2 ? v1 : v2}
-        else
-          # in the last search of a PIT choose the largest
-          converge_last_value {|v1, v2| v1 > v2 ? v1 : v2}
-          @last_value_hashmap.clear
-        end
-        IO.write(@last_run_metadata_path, @last_value)
-      end
-    end
-
-    def converge_last_value(&block)
-      return if @last_value_hashmap.empty?
-      new_last_value = @last_value_hashmap.reduceValues(1000, &block)
-      logger.debug? && logger.debug("converge_last_value: got #{@last_value_hashmap.values.inspect}. won: #{new_last_value}")
-      return if new_last_value == @last_value
-      @last_value = new_last_value
-      logger.info "New cursor value for field \"#{@tracking_field}\" is: #{new_last_value}"
-    end
-
-    def record_last_value(event)
-      value = event.get(@tracking_field)
-      logger.trace? && logger.trace("storing last_value if #{@tracking_field} for #{Thread.current.object_id}: #{value}")
-      @last_value_hashmap.put(Thread.current.object_id, value)
-    end
-
-    def inject_cursor(query_json)
-      # ":present" means "now - 30s" to avoid grabbing partially visible data in the PIT
-      result = query_json.gsub(":last_value", @last_value.to_s).gsub(":present", now_minus_30s)
-      logger.debug("inject_cursor: injected values for ':last_value' and ':present'", :query => result)
-      result
-    end
-
-    def now_minus_30s
-      Java::java.time.Instant.now.minusSeconds(30).to_s
-    end
-  end
-end; end; end

data/lib/logstash/inputs/elasticsearch/esql.rb

@@ -1,153 +0,0 @@
-require 'logstash/helpers/loggable_try'
-
-module LogStash
-  module Inputs
-    class Elasticsearch
-      class Esql
-        include LogStash::Util::Loggable
-
-        ESQL_JOB = "ES|QL job"
-
-        ESQL_PARSERS_BY_TYPE = Hash.new(lambda { |x| x }).merge(
-          'date' => ->(value) { value && LogStash::Timestamp.new(value) },
-          )
-
-        # Initialize the ESQL query executor
-        # @param client [Elasticsearch::Client] The Elasticsearch client instance
-        # @param plugin [LogStash::Inputs::Elasticsearch] The parent plugin instance
-        def initialize(client, plugin)
-          @client = client
-          @event_decorator = plugin.method(:decorate_event)
-          @retries = plugin.params["retries"]
-
-          target_field = plugin.params["target"]
-          if target_field
-            def self.apply_target(path); "[#{target_field}][#{path}]"; end
-          else
-            def self.apply_target(path); path; end
-          end
-
-          @query = plugin.params["query"]
-          unless @query.include?('METADATA')
-            logger.info("`METADATA` not found the query. `_id`, `_version` and `_index` will not be available in the result", {:query => @query})
-          end
-          logger.debug("ES|QL executor initialized with", {:query => @query})
-        end
-
-        # Execute the ESQL query and process results
-        # @param output_queue [Queue] The queue to push processed events to
-        # @param query A query (to obey interface definition)
-        def do_run(output_queue, query)
-          logger.info("ES|QL executor has started")
-          response = retryable(ESQL_JOB) do
-            @client.esql.query({ body: { query: @query }, format: 'json', drop_null_columns: true })
-          end
-          # retriable already printed error details
-          return if response == false
-
-          if response&.headers&.dig("warning")
-            logger.warn("ES|QL executor received warning", {:warning_message => response.headers["warning"]})
-          end
-          columns = response['columns']&.freeze
-          values = response['values']&.freeze
-          logger.debug("ES|QL query response size: #{values&.size}")
-
-          process_response(columns, values, output_queue) if columns && values
-        end
-
-        # Execute a retryable operation with proper error handling
-        # @param job_name [String] Name of the job for logging purposes
-        # @yield The block to execute
-        # @return [Boolean] true if successful, false otherwise
-        def retryable(job_name, &block)
-          stud_try = ::LogStash::Helpers::LoggableTry.new(logger, job_name)
-          stud_try.try((@retries + 1).times) { yield }
-        rescue => e
-          error_details = {:message => e.message, :cause => e.cause}
-          error_details[:backtrace] = e.backtrace if logger.debug?
-          logger.error("#{job_name} failed with ", error_details)
-          false
-        end
-
-        private
-
-        # Process the ESQL response and push events to the output queue
-        # @param columns [Array[Hash]] The ESQL query response columns
-        # @param values [Array[Array]] The ESQL query response hits
-        # @param output_queue [Queue] The queue to push processed events to
-        def process_response(columns, values, output_queue)
-          column_specs = columns.map { |column| ColumnSpec.new(column) }
-          sub_element_mark_map = mark_sub_elements(column_specs)
-          multi_fields = sub_element_mark_map.filter_map { |key, val| key.name if val == true }
-          logger.warn("Multi-fields found in ES|QL result and they will not be available in the event. Please use `RENAME` command if you want to include them.", { :detected_multi_fields => multi_fields }) if multi_fields.any?
-
-          values.each do |row|
-            event = column_specs.zip(row).each_with_object(LogStash::Event.new) do |(column, value), event|
-              # `unless value.nil?` is a part of `drop_null_columns` that if some of columns' values are not `nil`, `nil` values appear
-              # we should continuously filter out them to achieve full `drop_null_columns` on each individual row (ideal `LIMIT 1` result)
-              # we also exclude sub-elements of main field
-              if value && sub_element_mark_map[column] == false
-                field_reference = apply_target(column.field_reference)
-                event.set(field_reference, ESQL_PARSERS_BY_TYPE[column.type].call(value))
-              end
-            end
-            @event_decorator.call(event)
-            output_queue << event
-          rescue => e
-            # if event creation fails with whatever reason, inform user and tag with failure and return entry as it is
-            logger.warn("Event creation error, ", message: e.message, exception: e.class, data: { "columns" => columns, "values" => [row] })
-            failed_event = LogStash::Event.new("columns" => columns, "values" => [row], "tags" => ['_elasticsearch_input_failure'])
-            output_queue << failed_event
-          end
-        end
-
-        # Determines whether each column in a collection is a nested sub-element (example "user.age")
-        # of another column in the same collection (example "user").
-        #
-        # @param columns [Array<ColumnSpec>] An array of objects with a `name` attribute representing field paths.
-        # @return [Hash<ColumnSpec, Boolean>] A hash mapping each column to `true` if it is a sub-element of another field, `false` otherwise.
-        # Time complexity: (O(NlogN+N*K)) where K is the number of conflict depth
-        #   without (`prefix_set`) memoization, it would be O(N^2)
-        def mark_sub_elements(columns)
-          # Sort columns by name length (ascending)
-          sorted_columns = columns.sort_by { |c| c.name.length }
-          prefix_set = Set.new # memoization set
-
-          sorted_columns.each_with_object({}) do |column, memo|
-            # Split the column name into parts (e.g., "user.profile.age" → ["user", "profile", "age"])
-            parts = column.name.split('.')
-
-            # Generate all possible parent prefixes (e.g., "user", "user.profile")
-            # and check if any parent prefix exists in the set
-            parent_prefixes = (0...parts.size - 1).map { |i| parts[0..i].join('.') }
-            memo[column] = parent_prefixes.any? { |prefix| prefix_set.include?(prefix) }
-            prefix_set.add(column.name)
-          end
-        end
-      end
-
-      # Class representing a column specification in the ESQL response['columns']
-      # The class's main purpose is to provide a structure for the event key
-      # columns is an array with `name` and `type` pair (example: `{"name"=>"@timestamp", "type"=>"date"}`)
-      # @attr_reader :name [String] The name of the column
-      # @attr_reader :type [String] The type of the column
-      class ColumnSpec
-        attr_reader :name, :type
-
-        def initialize(spec)
-          @name = isolate(spec.fetch('name'))
-          @type = isolate(spec.fetch('type'))
-        end
-
-        def field_reference
-          @_field_reference ||= '[' + name.gsub('.', '][') + ']'
-        end
-
-        private
-        def isolate(value)
-          value.frozen? ? value : value.clone.freeze
-        end
-      end
-    end
-  end
-end

data/spec/fixtures/test_certs/GENERATED_AT

@@ -1 +0,0 @@
-2026-01-23T17:38:25+01:00

data/spec/fixtures/test_certs/es.chain.crt

@@ -1,38 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDIzCCAgugAwIBAgIBATANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylFbGFz
-dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNjAxMjMx
-NjM4MjVaFw0yNzAxMjMxNjM4MjVaMA0xCzAJBgNVBAMTAmVzMIIBIjANBgkqhkiG
-9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZLZvLSWDK7Ul+AaBnjU81dsfaow8zOjCC5V
-V21nXpYzQJoQbuWcvGYxwL7ZDs2ca4Wc8BVCj1NDduHuP7U+QIlUdQpl8kh5a0Zz
-36pcFw7UyF51/AzWixJrht/Azzkb5cpZtE22ZK0KhS4oCsjJmTN0EABAsGhDI9/c
-MjNrUC7iP0dvfOuzAPp7ufY83h98jKKXUYV24snbbvmqoWI6GQQNSG/sEo1+1UGH
-/z07/mVKoBAa5DVoNGvxN0fCE7vW7hkhT8+frJcsYFatAbnf6ql0KzEa8lN9u0gR
-hQNM3zcKKsjEMomBzVBc4SV3KXO0d/jGdDtlqsm2oXqlTMdtGwIDAQABo2cwZTAY
-BgNVHREEETAPgg1lbGFzdGljc2VhcmNoMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFQU
-K+6Cg2kExRj1xSDzEi4kkgKXMB8GA1UdIwQYMBaAFMgkye5+2l+TE0I6RsXRHjGB
-wpBGMA0GCSqGSIb3DQEBCwUAA4IBAQCDFHoe8ntx/D69gb8uVQhUDI2ERb0Hocbh
-BpQVidsKEv220zmZW3O9PX0aN4j3e4HUeRNSdLmtN+sXJ1xCMjHlzA5z5wYJOk2y
-4B/eCOzHoHfvR+l5NUSemZ5mk8V+gThGydPmLZBN3afjzd3NJ7NVaCA8cyKwe2jr
-AMrIdGL5usoBSdbd7Ww0nWhLhqxmmV79+orCwAPJxkzsgFDK+vfIw4VHERXNoIPe
-WKVBGpUCFPSfosLo9fSziNDXL71CrWZlPXt3Otip4QKQV5sZI2zxm1JtHdHX6Ul1
-X7xkcUR5cOF0InxefGl9VHIZTYC5kSzAz95WV068j2Jxgu28GRP5
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDFTCCAf2gAwIBAgIBATANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylFbGFz
-dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNjAxMjMx
-NjM4MjVaFw0yNzAxMjMxNjM4MjVaMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlm
-aWNhdGUgVG9vbCBBdXRvZ2VuZXJhdGVkIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
-AQ8AMIIBCgKCAQEArUe66xG4Y2zO13gRC+rBwyvxe+c01pqV6ukw6isIbJIQWs1/
-QfEMhUwYwKs6/UXxK+VwardcA2zYwngXbGGEtms+mpUfH5CdJnrqW7lHz1BVK4yH
-90IzGE0GU4D90OW/L4QkGX0fv3VQbL8KGFKBoF04pXIaSGMStFN4wirutHtQboYv
-99X4kbLjVSIuubUpA/v9dUP1TNl8ar+HKUWRM96ijHkFTF3FR0NnZyt44gP5qC0h
-i4lUiR6Uo9D6WMFjeRYFF7GolCy/I1SzWBmmOnNhQLO5VxcNG4ldhBcapZeGwE98
-m/5lxLIwgFR9ZP8bXdxZTWLC58/LQ2NqOjA9mwIDAQABozIwMDAPBgNVHRMBAf8E
-BTADAQH/MB0GA1UdDgQWBBTIJMnuftpfkxNCOkbF0R4xgcKQRjANBgkqhkiG9w0B
-AQsFAAOCAQEAgZPz/e29AepHZu8uuO6+75b6Uf88m8x5m7XL13m9+vTTSqLvCiBw
-JCf5caO73iOx8AlTT2iSlKPAS/7ogik5anZziqweHmBakb+HNQcUB4Vv4VBo5Ai3
-SdOm28uu4EznVLUILPUHl4FQGxhn6ba1tLEWgxlD/ynBtfcmh9UFtBqIawrpAArv
-TKwGBSkcSxh/yOIo+qbyBh9EyxxlGW/Z08m9qjNqHATDxCelcTsQLhCHkvNShR4j
-v1sFw5XQ8H3zQU6w4WzV81A3K8erIU8WnvdisXLk0T1VB5KURy4+UDyw44tOAPD2
-vBq3gYLgcVEMYVfOWCzDy7LS49leXRzAOA==
------END CERTIFICATE-----

data/spec/fixtures/test_certs/renew.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-cd "$(dirname "$0")"
-
-openssl x509 -x509toreq -in ca.crt -copy_extensions copyall -signkey ca.key -out ca.csr
-openssl x509 -req -copy_extensions copyall -days 365 -in ca.csr -set_serial 0x01 -signkey ca.key -out ca.crt && rm ca.csr
-openssl x509 -in ca.crt -outform der | sha256sum | awk '{print $1}' > ca.der.sha256
-
-openssl x509 -x509toreq -in es.crt -copy_extensions copyall -signkey es.key -out es.csr
-openssl x509 -req -copy_extensions copyall -days 365 -in es.csr -set_serial 0x01 -CA ca.crt -CAkey ca.key -out es.crt && rm es.csr
-cat es.crt ca.crt > es.chain.crt
-
-# output ISO8601 timestamp to file
-date -Iseconds > GENERATED_AT

data/spec/inputs/cursor_tracker_spec.rb

@@ -1,72 +0,0 @@
-# encoding: utf-8
-require "logstash/devutils/rspec/spec_helper"
-require "logstash/devutils/rspec/shared_examples"
-require "logstash/inputs/elasticsearch"
-require "logstash/inputs/elasticsearch/cursor_tracker"
-
-describe LogStash::Inputs::Elasticsearch::CursorTracker do
-
-  let(:last_run_metadata_path) { Tempfile.new('cursor_tracker_testing').path }
-  let(:tracking_field_seed) { "1980-01-01T23:59:59.999999999Z" }
-  let(:options) do
-    {
-      :last_run_metadata_path => last_run_metadata_path,
-      :tracking_field => "my_field",
-      :tracking_field_seed => tracking_field_seed
-    }
-  end
-
-  subject { described_class.new(**options) }
-
-  it "creating a class works" do
-    expect(subject).to be_a described_class
-  end
-
-  describe "checkpoint_cursor" do
-    before(:each) do
-      subject.checkpoint_cursor(intermediate: false) # store seed value
-      [
-        Thread.new(subject) {|subject| subject.record_last_value(LogStash::Event.new("my_field" => "2025-01-03T23:59:59.999999999Z")) },
-        Thread.new(subject) {|subject| subject.record_last_value(LogStash::Event.new("my_field" => "2025-01-01T23:59:59.999999999Z")) },
-        Thread.new(subject) {|subject| subject.record_last_value(LogStash::Event.new("my_field" => "2025-01-02T23:59:59.999999999Z")) },
-      ].each(&:join)
-    end
-    context "when doing intermediate checkpoint" do
-      it "persists the smallest value" do
-        subject.checkpoint_cursor(intermediate: true)
-        expect(IO.read(last_run_metadata_path)).to eq("2025-01-01T23:59:59.999999999Z")
-      end
-    end
-    context "when doing non-intermediate checkpoint" do
-      it "persists the largest value" do
-        subject.checkpoint_cursor(intermediate: false)
-        expect(IO.read(last_run_metadata_path)).to eq("2025-01-03T23:59:59.999999999Z")
-      end
-    end
-  end
-
-  describe "inject_cursor" do
-    let(:new_value) { "2025-01-03T23:59:59.999999999Z" }
-    let(:fake_now) { "2026-09-19T23:59:59.999999999Z" }
-
-    let(:query) do
-      %q[
-      { "query": { "range": { "event.ingested": { "gt": :last_value, "lt": :present}}}, "sort": [ { "event.ingested": {"order": "asc", "format": "strict_date_optional_time_nanos", "numeric_type" : "date_nanos" } } ] }
-      ]
-    end
-
-    before(:each) do
-      subject.record_last_value(LogStash::Event.new("my_field" => new_value))
-      subject.checkpoint_cursor(intermediate: false)
-      allow(subject).to receive(:now_minus_30s).and_return(fake_now)
-    end
-
-    it "injects the value of the cursor into json query if it contains :last_value" do
-      expect(subject.inject_cursor(query)).to match(/#{new_value}/)
-    end
-
-    it "injects current time into json query if it contains :present" do
-      expect(subject.inject_cursor(query)).to match(/#{fake_now}/)
-    end
-  end
-end