logstash-input-elasticsearch 5.2.1 → 5.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c6cb55dd7365bae4a363382b6fb927e54a94489347fa50eb212164b157c090b
-  data.tar.gz: b19f9d63c887a46a13106dedba5cdac1f0715ed2beb8db622ede6b8f762890cf
+  metadata.gz: 90dc46d1bcadf70173792a9c2319925ea5e78bd3e6322e7c323de178afb72fa4
+  data.tar.gz: 21548a5935b0aa5b153b6e1bc00c7f9f3f6ade7f6546a0beb0ce7cc6cef5a984
 SHA512:
-  metadata.gz: 1b5da3cb2c9de33cb94d9cc140cafe118f86de372f9eb7c7e77c2ec47356ee6d17f530a2c74e44111bf94e460b956ad5b55b20dc0467aa24b92a1b12accbe012
-  data.tar.gz: 69307789e59c91e4c763bdc8ad1a4ef4c5090f6e8c3749587790652b44562ab16f54062e57a479965860cdfb619547ca54273d0850ea1cfed4753470712d1fe6
+  metadata.gz: 59e8a03c25d8ee9a1a02014b75d1096b81250b85c7f6bd7e78114764534d9ad244d5d758e974c84bc20d9aa0c8fad669a3ef636b17037426c30f2705d74083d2
+  data.tar.gz: 8b986365b25b8884e3aae581b37ce35f9190e50bf3ce4d17263887c31721efe16f16b97dcf2571dcb446991f7ea4406c6011a1d1dbd3afd7f3e07ec0c4b9b743

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 5.3.0
+  - Drop a support for Logstash 7.x by requiring elasticsearch gem >= 8. Logstash 8+ continues to work as before [#252](https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/252)
+
+## 5.2.2
+  - [DOC] Note that `search_after` requires permissions on underlying indices/data streams, not aliases [#251](https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/251)
+
 ## 5.2.1
   - Added support for encoded and non encoded api-key formats on plugin configuration [#237](https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/237)
 

data/docs/index.asciidoc

@@ -120,10 +120,10 @@ Examples include:
 
 The Elasticsearch input plugin provides the <<plugins-{type}s-{plugin}-tracking_field>> and <<plugins-{type}s-{plugin}-tracking_field_seed>> options.
 When <<plugins-{type}s-{plugin}-tracking_field>> is set, the plugin records the value of that field for the last document retrieved in a run into
-a file. 
+a file.
 (The file location defaults to <<plugins-{type}s-{plugin}-last_run_metadata_path>>.)
 
-You can then inject this value in the query using the placeholder `:last_value`. 
+You can then inject this value in the query using the placeholder `:last_value`.
 The value will be injected into the query before execution, and then updated after the query completes if new data was found.
 
 This feature works best when:
@@ -706,6 +706,8 @@ The query requires at least one `sort` field, as described in the <<plugins-{typ
 
 `scroll` uses {ref}/paginate-search-results.html#scroll-search-results[scroll] API to search, which is no longer recommended.
 
+NOTE: When using `search_after`, including using `auto` on  Elasticsearch 8+, permissions to read data aliases alone will not work: permissions are also needed on the underlying indices or data streams.
+
 [id="plugins-{type}s-{plugin}-size"]
 ===== `size`
 

data/lib/logstash/inputs/elasticsearch.rb

@@ -13,6 +13,7 @@ require "logstash/plugin_mixins/normalize_config_support"
 require "base64"
 
 require "elasticsearch"
+require "elastic/transport/transport/http/manticore"
 require "manticore"
 
 # .Compatibility Note
@@ -350,7 +351,7 @@ class LogStash::Inputs::Elasticsearch < LogStash::Inputs::Base
     @client_options = {
       :hosts => hosts,
       :transport_options => transport_options,
-      :transport_class => get_transport_client_class,
+      :transport_class => ::Elastic::Transport::Transport::HTTP::Manticore,
       :ssl => ssl_options
     }
 
@@ -728,20 +729,6 @@ class LogStash::Inputs::Elasticsearch < LogStash::Inputs::Base
     last_run_metadata_path
   end
 
-  def get_transport_client_class
-    # LS-core includes `elasticsearch` gem. The gem is composed of two separate gems: `elasticsearch-api` and `elasticsearch-transport`
-    # And now `elasticsearch-transport` is old, instead we have `elastic-transport`.
-    # LS-core updated `elasticsearch` > 8: https://github.com/elastic/logstash/pull/17161
-    # Following source bits are for the compatibility to support both `elasticsearch-transport` and `elastic-transport` gems
-    require "elasticsearch/transport/transport/http/manticore"
-    require_relative "elasticsearch/patches/_elasticsearch_transport_http_manticore"
-    require_relative "elasticsearch/patches/_elasticsearch_transport_connections_selector"
-    ::Elasticsearch::Transport::Transport::HTTP::Manticore
-  rescue ::LoadError
-    require "elastic/transport/transport/http/manticore"
-    ::Elastic::Transport::Transport::HTTP::Manticore
-  end
-
   def validate_ls_version_for_esql_support!
     if Gem::Version.create(LOGSTASH_VERSION) < Gem::Version.create(LS_ESQL_SUPPORT_VERSION)
       fail("Current version of Logstash does not include Elasticsearch client which supports ES|QL. Please upgrade Logstash to at least #{LS_ESQL_SUPPORT_VERSION}")

data/logstash-input-elasticsearch.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-input-elasticsearch'
-  s.version         = '5.2.1'
+  s.version         = ::File.read('version').split("\n").first
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Reads query results from an Elasticsearch cluster"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
@@ -26,7 +26,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "logstash-mixin-validator_support", '~> 1.0'
   s.add_runtime_dependency "logstash-mixin-scheduler", '~> 1.0'
 
-  s.add_runtime_dependency 'elasticsearch', '>= 7.17.9', '< 9'
+  s.add_runtime_dependency 'elasticsearch', '>= 8', '< 10'
   s.add_runtime_dependency 'logstash-mixin-ca_trusted_fingerprint_support', '~> 1.0'
   s.add_runtime_dependency 'logstash-mixin-normalize_config_support', '~>1.0'
 
@@ -39,7 +39,4 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'timecop'
   s.add_development_dependency 'cabin', ['~> 0.6']
   s.add_development_dependency 'webrick'
-
-  # 3.8.0 has breaking changes WRT to joining, which break our specs
-  s.add_development_dependency 'rufus-scheduler', '~> 3.0.9'
 end

data/spec/fixtures/test_certs/GENERATED_AT

@@ -1 +1 @@
-2024-12-26T22:27:15+00:00
+2026-01-21T16:16:02+01:00

data/spec/fixtures/test_certs/ca.crt

@@ -1,7 +1,7 @@
 -----BEGIN CERTIFICATE-----
 MIIDFTCCAf2gAwIBAgIBATANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylFbGFz
-dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNDEyMjYy
-MjI3MTVaFw0yNTEyMjYyMjI3MTVaMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlm
+dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNjAxMjEx
+NTE2MDJaFw0yNzAxMjExNTE2MDJaMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlm
 aWNhdGUgVG9vbCBBdXRvZ2VuZXJhdGVkIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
 AQ8AMIIBCgKCAQEArUe66xG4Y2zO13gRC+rBwyvxe+c01pqV6ukw6isIbJIQWs1/
 QfEMhUwYwKs6/UXxK+VwardcA2zYwngXbGGEtms+mpUfH5CdJnrqW7lHz1BVK4yH
@@ -10,10 +10,10 @@ QfEMhUwYwKs6/UXxK+VwardcA2zYwngXbGGEtms+mpUfH5CdJnrqW7lHz1BVK4yH
 i4lUiR6Uo9D6WMFjeRYFF7GolCy/I1SzWBmmOnNhQLO5VxcNG4ldhBcapZeGwE98
 m/5lxLIwgFR9ZP8bXdxZTWLC58/LQ2NqOjA9mwIDAQABozIwMDAPBgNVHRMBAf8E
 BTADAQH/MB0GA1UdDgQWBBTIJMnuftpfkxNCOkbF0R4xgcKQRjANBgkqhkiG9w0B
-AQsFAAOCAQEAhfg/cmXc4Uh90yiXU8jOW8saQjTsq4ZMDQiLfJsNmNNYmHFN0vhv
-lJRI1STdy7+GpjS5QbrMjQIxWSS8X8xysE4Rt81IrWmLuao35TRFyoiE1seBQ5sz
-p/BxZUe57JvWi9dyzv2df4UfWFdGBhzdr80odZmz4i5VIv6qCKJKsGikcuLpepmp
-E/UKnKHeR/dFWsxzA9P2OzHTUNBMOOA2PyAUL49pwoChwJeOWN/zAgwMWLbuHFG0
-IN0u8swAmeH98QdvzbhiOatGNpqfTNvQEDc19yVjfXKpBVZQ79WtronYSqrbrUa1
-T2zD8bIVP7CdddD/UmpT1SSKh4PJxudy5Q==
+AQsFAAOCAQEAYoiQ5m/wtwsiEDr173OouhEWmL9zGPZ0Oi8XAJACilyHos++U15M
+uer+s/Glxm0wrf7VcD7JAKWOp3Pm/P3A5DqmYgO52FXEAucvXPdZNbi1RskzGi2N
+jgjrZXC2EVsvBo05iPfPL0hPdvY1Ax00ILFQOgaamAyMJG4W/n597nzWWKPboDT3
+S2NVlWHMht53XQprAdmolcnBg799mkYloJ5N7HFJXwTN/rw0U/WUj5JVMkOf0ECp
+y1Z+0K6s/gIA4muDzCWS6qpJa0CJfrPloXceTJdLpaYX+HFmL0prTwCo8wtjKGHp
+0GSbZob3aT2qWSxU/9od5FhjnFjCheki6Q==
 -----END CERTIFICATE-----

data/spec/fixtures/test_certs/ca.der.sha256

@@ -1 +1 @@
-b1e955819b0d14f64f863adb103c248ddacf2e17bea48d04ee4b57c64814ccc4
+516ffaaddd40a9dfd5962eacc76933af9a00cdaea70a2ea0bb19c13f38ac4cc6

data/spec/fixtures/test_certs/es.chain.crt

@@ -1,7 +1,7 @@
 -----BEGIN CERTIFICATE-----
 MIIDIzCCAgugAwIBAgIBATANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylFbGFz
-dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNDEyMjYy
-MjI3MTVaFw0yNTEyMjYyMjI3MTVaMA0xCzAJBgNVBAMTAmVzMIIBIjANBgkqhkiG
+dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNjAxMjEx
+NTE2MDJaFw0yNzAxMjExNTE2MDJaMA0xCzAJBgNVBAMTAmVzMIIBIjANBgkqhkiG
 9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZLZvLSWDK7Ul+AaBnjU81dsfaow8zOjCC5V
 V21nXpYzQJoQbuWcvGYxwL7ZDs2ca4Wc8BVCj1NDduHuP7U+QIlUdQpl8kh5a0Zz
 36pcFw7UyF51/AzWixJrht/Azzkb5cpZtE22ZK0KhS4oCsjJmTN0EABAsGhDI9/c
@@ -10,17 +10,17 @@ MjNrUC7iP0dvfOuzAPp7ufY83h98jKKXUYV24snbbvmqoWI6GQQNSG/sEo1+1UGH
 hQNM3zcKKsjEMomBzVBc4SV3KXO0d/jGdDtlqsm2oXqlTMdtGwIDAQABo2cwZTAY
 BgNVHREEETAPgg1lbGFzdGljc2VhcmNoMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFQU
 K+6Cg2kExRj1xSDzEi4kkgKXMB8GA1UdIwQYMBaAFMgkye5+2l+TE0I6RsXRHjGB
-wpBGMA0GCSqGSIb3DQEBCwUAA4IBAQB6cZ7IrDzcAoOZgAt9RlOe2yzQeH+alttp
-CSQVINjJotS1WvmtqjBB6ArqLpXIGU89TZsktNe/NQJzgYSaMnlIuHVLFdxJYmwU
-T1cP6VC/brmqP/dd5y7VWE7Lp+Wd5CxKl/WY+9chmgc+a1fW/lnPEJJ6pca1Bo8b
-byIL0yY2IUv4R2eh1IyQl9oGH1GOPLgO7cY04eajxYcOVA2eDSItoyDtrJfkFP/P
-UXtC1JAkvWKuujFEiBj0AannhroWlp3gvChhBwCuCAU0KXD6g8BE8tn6oT1+FW7J
-avSfHxAe+VHtYhF8sJ8jrdm0d7E4GKS9UR/pkLAL1JuRdJ1VkPx3
+wpBGMA0GCSqGSIb3DQEBCwUAA4IBAQAE/PyIBt4Y3Ihg3F00c3rw4++b639iIP10
+eeZ29UUNGjKceS7iaQgpN+JCVRHz3K3cCbh4rczCX9fH/u60bXVMUesrtEOcNN54
+dzqIgTXEE3BygaQC29+BoG+JOa0aoYzHS64O+SeRXd+Fhc36c2ZTM1hG2Tt22CsP
+tPH51dlFWo9d5QpsRRsQBC0RmOP1EnBPl55veIbtKELRNqF8tklindfYk71caBpo
+Oo2iaRbUfAP7bsbsdlnLcvLmIKiKWyCIsQBWdxJTKZNjqzGcYpGAPsw4Mo9QHI03
+P4gSoSvW4MZiL0BnWMeRplyt74JBPJhPTesMLpTZvBtOeIURciCo
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
 MIIDFTCCAf2gAwIBAgIBATANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylFbGFz
-dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNDEyMjYy
-MjI3MTVaFw0yNTEyMjYyMjI3MTVaMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlm
+dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNjAxMjEx
+NTE2MDJaFw0yNzAxMjExNTE2MDJaMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlm
 aWNhdGUgVG9vbCBBdXRvZ2VuZXJhdGVkIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
 AQ8AMIIBCgKCAQEArUe66xG4Y2zO13gRC+rBwyvxe+c01pqV6ukw6isIbJIQWs1/
 QfEMhUwYwKs6/UXxK+VwardcA2zYwngXbGGEtms+mpUfH5CdJnrqW7lHz1BVK4yH
@@ -29,10 +29,10 @@ QfEMhUwYwKs6/UXxK+VwardcA2zYwngXbGGEtms+mpUfH5CdJnrqW7lHz1BVK4yH
 i4lUiR6Uo9D6WMFjeRYFF7GolCy/I1SzWBmmOnNhQLO5VxcNG4ldhBcapZeGwE98
 m/5lxLIwgFR9ZP8bXdxZTWLC58/LQ2NqOjA9mwIDAQABozIwMDAPBgNVHRMBAf8E
 BTADAQH/MB0GA1UdDgQWBBTIJMnuftpfkxNCOkbF0R4xgcKQRjANBgkqhkiG9w0B
-AQsFAAOCAQEAhfg/cmXc4Uh90yiXU8jOW8saQjTsq4ZMDQiLfJsNmNNYmHFN0vhv
-lJRI1STdy7+GpjS5QbrMjQIxWSS8X8xysE4Rt81IrWmLuao35TRFyoiE1seBQ5sz
-p/BxZUe57JvWi9dyzv2df4UfWFdGBhzdr80odZmz4i5VIv6qCKJKsGikcuLpepmp
-E/UKnKHeR/dFWsxzA9P2OzHTUNBMOOA2PyAUL49pwoChwJeOWN/zAgwMWLbuHFG0
-IN0u8swAmeH98QdvzbhiOatGNpqfTNvQEDc19yVjfXKpBVZQ79WtronYSqrbrUa1
-T2zD8bIVP7CdddD/UmpT1SSKh4PJxudy5Q==
+AQsFAAOCAQEAYoiQ5m/wtwsiEDr173OouhEWmL9zGPZ0Oi8XAJACilyHos++U15M
+uer+s/Glxm0wrf7VcD7JAKWOp3Pm/P3A5DqmYgO52FXEAucvXPdZNbi1RskzGi2N
+jgjrZXC2EVsvBo05iPfPL0hPdvY1Ax00ILFQOgaamAyMJG4W/n597nzWWKPboDT3
+S2NVlWHMht53XQprAdmolcnBg799mkYloJ5N7HFJXwTN/rw0U/WUj5JVMkOf0ECp
+y1Z+0K6s/gIA4muDzCWS6qpJa0CJfrPloXceTJdLpaYX+HFmL0prTwCo8wtjKGHp
+0GSbZob3aT2qWSxU/9od5FhjnFjCheki6Q==
 -----END CERTIFICATE-----

data/spec/fixtures/test_certs/es.crt

@@ -1,7 +1,7 @@
 -----BEGIN CERTIFICATE-----
 MIIDIzCCAgugAwIBAgIBATANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylFbGFz
-dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNDEyMjYy
-MjI3MTVaFw0yNTEyMjYyMjI3MTVaMA0xCzAJBgNVBAMTAmVzMIIBIjANBgkqhkiG
+dGljIENlcnRpZmljYXRlIFRvb2wgQXV0b2dlbmVyYXRlZCBDQTAeFw0yNjAxMjEx
+NTE2MDJaFw0yNzAxMjExNTE2MDJaMA0xCzAJBgNVBAMTAmVzMIIBIjANBgkqhkiG
 9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZLZvLSWDK7Ul+AaBnjU81dsfaow8zOjCC5V
 V21nXpYzQJoQbuWcvGYxwL7ZDs2ca4Wc8BVCj1NDduHuP7U+QIlUdQpl8kh5a0Zz
 36pcFw7UyF51/AzWixJrht/Azzkb5cpZtE22ZK0KhS4oCsjJmTN0EABAsGhDI9/c
@@ -10,10 +10,10 @@ MjNrUC7iP0dvfOuzAPp7ufY83h98jKKXUYV24snbbvmqoWI6GQQNSG/sEo1+1UGH
 hQNM3zcKKsjEMomBzVBc4SV3KXO0d/jGdDtlqsm2oXqlTMdtGwIDAQABo2cwZTAY
 BgNVHREEETAPgg1lbGFzdGljc2VhcmNoMAkGA1UdEwQCMAAwHQYDVR0OBBYEFFQU
 K+6Cg2kExRj1xSDzEi4kkgKXMB8GA1UdIwQYMBaAFMgkye5+2l+TE0I6RsXRHjGB
-wpBGMA0GCSqGSIb3DQEBCwUAA4IBAQB6cZ7IrDzcAoOZgAt9RlOe2yzQeH+alttp
-CSQVINjJotS1WvmtqjBB6ArqLpXIGU89TZsktNe/NQJzgYSaMnlIuHVLFdxJYmwU
-T1cP6VC/brmqP/dd5y7VWE7Lp+Wd5CxKl/WY+9chmgc+a1fW/lnPEJJ6pca1Bo8b
-byIL0yY2IUv4R2eh1IyQl9oGH1GOPLgO7cY04eajxYcOVA2eDSItoyDtrJfkFP/P
-UXtC1JAkvWKuujFEiBj0AannhroWlp3gvChhBwCuCAU0KXD6g8BE8tn6oT1+FW7J
-avSfHxAe+VHtYhF8sJ8jrdm0d7E4GKS9UR/pkLAL1JuRdJ1VkPx3
+wpBGMA0GCSqGSIb3DQEBCwUAA4IBAQAE/PyIBt4Y3Ihg3F00c3rw4++b639iIP10
+eeZ29UUNGjKceS7iaQgpN+JCVRHz3K3cCbh4rczCX9fH/u60bXVMUesrtEOcNN54
+dzqIgTXEE3BygaQC29+BoG+JOa0aoYzHS64O+SeRXd+Fhc36c2ZTM1hG2Tt22CsP
+tPH51dlFWo9d5QpsRRsQBC0RmOP1EnBPl55veIbtKELRNqF8tklindfYk71caBpo
+Oo2iaRbUfAP7bsbsdlnLcvLmIKiKWyCIsQBWdxJTKZNjqzGcYpGAPsw4Mo9QHI03
+P4gSoSvW4MZiL0BnWMeRplyt74JBPJhPTesMLpTZvBtOeIURciCo
 -----END CERTIFICATE-----

data/spec/inputs/elasticsearch_spec.rb

@@ -18,16 +18,9 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
   let(:plugin) { described_class.new(config) }
   let(:queue) { Queue.new }
   let(:build_flavor) { "default" }
-  let(:es_version) { "7.5.0" }
+  let(:es_version) { "8.19.10" }
   let(:cluster_info) { {"version" => {"number" => es_version, "build_flavor" => build_flavor}, "tagline" => "You Know, for Search"} }
 
-  def elastic_ruby_v8_client_available?
-    Elasticsearch::Transport
-    false
-  rescue NameError # NameError: uninitialized constant Elasticsearch::Transport if Elastic Ruby client is not available
-    true
-  end
-
   before(:each) do
     Elasticsearch::Client.send(:define_method, :ping) { } # define no-action ping method
     allow_any_instance_of(Elasticsearch::Client).to receive(:info).and_return(cluster_info)
@@ -36,7 +29,8 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
   let(:base_config) do
     {
         'hosts' => ["localhost"],
-        'query' => '{ "query": { "match": { "city_name": "Okinawa" } }, "fields": ["message"] }'
+        'query' => '{ "query": { "match": { "city_name": "Okinawa" } }, "fields": ["message"] }',
+        'search_api' => 'scroll'
     }
   end
 
@@ -55,13 +49,13 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
       it "does not set header Elastic-Api-Version" do
         plugin.register
         client = plugin.send(:client)
-        expect( extract_transport(client).options[:transport_options][:headers] ).not_to match hash_including("Elastic-Api-Version" => "2023-10-31")
+        expect( client.transport.options[:transport_options][:headers] ).not_to match hash_including("Elastic-Api-Version" => "2023-10-31")
       end
 
       it "sets an x-elastic-product-origin header identifying this as an internal plugin request" do
         plugin.register
         client = plugin.send(:client)
-        expect( extract_transport(client).options[:transport_options][:headers] ).to match hash_including("x-elastic-product-origin"=>"logstash-input-elasticsearch")
+        expect( client.transport.options[:transport_options][:headers] ).to match hash_including("x-elastic-product-origin"=>"logstash-input-elasticsearch")
       end
     end
 
@@ -99,11 +93,7 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
 
         before do
           allow(Elasticsearch::Client).to receive(:new).and_return(es_client)
-          if elastic_ruby_v8_client_available?
-            allow(es_client).to receive(:info).and_raise(Elastic::Transport::Transport::Errors::BadRequest.new)
-          else
-            allow(es_client).to receive(:info).and_raise(Elasticsearch::Transport::Transport::Errors::BadRequest.new)
-          end
+          allow(es_client).to receive(:info).and_raise(Elastic::Transport::Transport::Errors::BadRequest.new)
         end
 
         it "raises an exception" do
@@ -116,13 +106,13 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
           expect_any_instance_of(Elasticsearch::Client).to receive(:info).and_return(true)
           plugin.register
           client = plugin.send(:client)
-          expect( extract_transport(client).options[:transport_options][:headers] ).to match hash_including("Elastic-Api-Version" => "2023-10-31")
+          expect( client.transport.options[:transport_options][:headers] ).to match hash_including("Elastic-Api-Version" => "2023-10-31")
         end
 
         it "sets an x-elastic-product-origin header identifying this as an internal plugin request" do
           plugin.register
           client = plugin.send(:client)
-          expect( extract_transport(client).options[:transport_options][:headers] ).to match hash_including("x-elastic-product-origin"=>"logstash-input-elasticsearch")
+          expect( client.transport.options[:transport_options][:headers] ).to match hash_including("x-elastic-product-origin"=>"logstash-input-elasticsearch")
         end
       end
 
@@ -138,7 +128,7 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
         it "sets custom headers" do
           plugin.register
           client = plugin.send(:client)
-          expect( extract_transport(client).options[:transport_options][:headers] ).to match hash_including(config["custom_headers"])
+          expect( client.transport.options[:transport_options][:headers] ).to match hash_including(config["custom_headers"])
         end
       end
     end
@@ -190,11 +180,12 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
         "_type" => "logs",
         "_id" => "C5b2xLQwTZa76jBmHIbwHQ",
         "_score" => 1.0,
-        "_source" => { "message" => ["ohayo"] }
+        "_source" => { "message" => ["ohayo"] },
+        "sort" => [1]
       }
       allow(@esclient).to receive(:search) { { "hits" => { "hits" => [hit] } } }
-      allow(@esclient).to receive(:scroll) { { "hits" => { "hits" => [hit] } } }
-      allow(@esclient).to receive(:clear_scroll).and_return(nil)
+      allow(@esclient).to receive(:open_point_in_time).and_return({"id" => "test-pit-id"})
+      allow(@esclient).to receive(:close_point_in_time).and_return(nil)
       allow(@esclient).to receive(:ping)
       allow(@esclient).to receive(:info).and_return(cluster_info)
     end
@@ -210,7 +201,8 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
     let(:config) do
       {
           'hosts' => ["localhost"],
-          'query' => '{ "query": { "match": { "city_name": "Okinawa" } }, "fields": ["message"] }'
+          'query' => '{ "query": { "match": { "city_name": "Okinawa" } }, "fields": ["message"] }',
+          'search_api' => 'scroll'
       }
     end
 
@@ -269,7 +261,8 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
         {
             'hosts' => ["localhost"],
             'query' => '{ "query": { "match": { "city_name": "Okinawa" } }, "fields": ["message"] }',
-            'target' => "[@metadata][_source]"
+            'target' => "[@metadata][_source]",
+            'search_api' => 'scroll'
         }
       end
 
@@ -293,7 +286,8 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
           'query' => "#{LogStash::Json.dump(query)}",
           'slices' => slices,
           'docinfo' => true, # include ids
-          'docinfo_target' => '[@metadata]'
+          'docinfo_target' => '[@metadata]',
+          'search_api' => 'scroll'
       }
     end
     let(:query) do
@@ -753,13 +747,7 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
       it "should set host(s)" do
         plugin.register
         client = plugin.send(:client)
-        target_field = :@seeds
-        begin
-          Elasticsearch::Transport::Client
-        rescue
-          target_field = :@hosts
-        end
-        expect( client.transport.instance_variable_get(target_field) ).to eql [{
+        expect( client.transport.instance_variable_get(:@hosts) ).to eql [{
                                                                               :scheme => "https",
                                                                               :host => "ac31ebb90241773157043c34fd26fd46.us-central1.gcp.cloud.es.io",
                                                                               :port => 9243,
@@ -791,7 +779,7 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
       it "should set authorization" do
         plugin.register
         client = plugin.send(:client)
-        auth_header = extract_transport(client).options[:transport_options][:headers]['Authorization']
+        auth_header = client.transport.options[:transport_options][:headers]['Authorization']
 
         expect( auth_header ).to eql "Basic #{Base64.encode64('elastic:my-passwd-00').rstrip}"
       end
@@ -831,7 +819,7 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
           it "correctly sets the Authorization header" do
             plugin.register
             client = plugin.send(:client)
-            auth_header = extract_transport(client).options[:transport_options][:headers]['Authorization']
+            auth_header = client.transport.options[:transport_options][:headers]['Authorization']
 
             expect(auth_header).to eql("ApiKey #{encoded_api_key}")
           end
@@ -871,7 +859,7 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
       it "should set proxy" do
         plugin.register
         client = plugin.send(:client)
-        proxy = extract_transport(client).options[:transport_options][:proxy]
+        proxy = client.transport.options[:transport_options][:proxy]
 
         expect( proxy ).to eql "http://localhost:1234"
       end
@@ -883,7 +871,7 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
           plugin.register
           client = plugin.send(:client)
 
-          expect( extract_transport(client).options[:transport_options] ).to_not include(:proxy)
+          expect( client.transport.options[:transport_options] ).to_not include(:proxy)
         end
       end
     end
@@ -911,15 +899,15 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
                     "cluster_name": "docker-cluster",
                     "cluster_uuid": "DyR1hN03QvuCWXRy3jtb0g",
                     "version": {
-                        "number": "7.13.1",
+                        "number": "8.13.1",
                         "build_flavor": "default",
                         "build_type": "docker",
                         "build_hash": "9a7758028e4ea59bcab41c12004603c5a7dd84a9",
-                        "build_date": "2021-05-28T17:40:59.346932922Z",
+                        "build_date": "2024-05-28T17:40:59.346932922Z",
                         "build_snapshot": false,
-                        "lucene_version": "8.8.2",
-                        "minimum_wire_compatibility_version": "6.8.0",
-                        "minimum_index_compatibility_version": "6.0.0-beta1"
+                        "lucene_version": "9.10.0",
+                        "minimum_wire_compatibility_version": "7.17.0",
+                        "minimum_index_compatibility_version": "7.0.0"
                     },
                     "tagline": "You Know, for Search"
                 }
@@ -1020,8 +1008,6 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
         let(:plugin) { described_class.new(config) }
         let(:event)  { LogStash::Event.new({}) }
 
-        # elasticsearch-ruby 7.17.9 initialize two user agent headers, `user-agent` and `User-Agent`
-        # hence, fail this header size test case
         xit "client should sent the expect user-agent" do
           plugin.register
 
@@ -1220,6 +1206,7 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
     end
 
     describe "scroll" do
+      let(:config) { super().merge({ "search_api" => "scroll" }) }
       let(:search_response) do
         {
           "_scroll_id" => "cXVlcnlUaGVuRmV0Y2g",
@@ -1379,11 +1366,6 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
     end
   end
 
-  # @note can be removed once we depends on elasticsearch gem >= 6.x
-  def extract_transport(client) # on 7.x client.transport is a ES::Transport::Client
-    client.transport.respond_to?(:transport) ? client.transport.transport : client.transport
-  end
-
   describe "#ESQL" do
     let(:config) do
       {

data/spec/inputs/elasticsearch_ssl_spec.rb

@@ -14,7 +14,7 @@ describe "SSL options" do
   before do
     allow(es_client_double).to receive(:close)
     allow(es_client_double).to receive(:ping).with(any_args).and_return(double("pong").as_null_object)
-    allow(es_client_double).to receive(:info).and_return({"version" => {"number" => "7.5.0", "build_flavor" => "default"},
+    allow(es_client_double).to receive(:info).and_return({"version" => {"number" => "8.19.0", "build_flavor" => "default"},
                                                           "tagline" => "You Know, for Search"})
     allow(Elasticsearch::Client).to receive(:new).and_return(es_client_double)
   end

data/spec/inputs/integration/elasticsearch_spec.rb

@@ -77,11 +77,7 @@ describe LogStash::Inputs::Elasticsearch do
       it_behaves_like 'an elasticsearch index plugin'
 
       let(:unauth_exception_class) do
-        begin
-          Elasticsearch::Transport::Transport::Errors::Unauthorized
-        rescue
-          Elastic::Transport::Transport::Errors::Unauthorized
-        end
+        Elastic::Transport::Transport::Errors::Unauthorized
       end
 
       context "incorrect auth credentials" do

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-elasticsearch
 version: !ruby/object:Gem::Version
-  version: 5.2.1
+  version: 5.3.0
 platform: ruby
 authors:
 - Elastic
 bindir: bin
 cert_chain: []
-date: 2025-09-23 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api
@@ -91,20 +91,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.17.9
+        version: '8'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '9'
+        version: '10'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 7.17.9
+        version: '8'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '9'
+        version: '10'
 - !ruby/object:Gem::Dependency
   name: logstash-mixin-ca_trusted_fingerprint_support
   requirement: !ruby/object:Gem::Requirement
@@ -245,20 +245,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: rufus-scheduler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 3.0.9
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 3.0.9
 description: This gem is a Logstash plugin required to be installed on top of the
   Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This
   gem is not a stand-alone program
@@ -280,8 +266,6 @@ files:
 - lib/logstash/inputs/elasticsearch/cursor_tracker.rb
 - lib/logstash/inputs/elasticsearch/esql.rb
 - lib/logstash/inputs/elasticsearch/paginated_search.rb
-- lib/logstash/inputs/elasticsearch/patches/_elasticsearch_transport_connections_selector.rb
-- lib/logstash/inputs/elasticsearch/patches/_elasticsearch_transport_http_manticore.rb
 - logstash-input-elasticsearch.gemspec
 - spec/es_helper.rb
 - spec/fixtures/test_certs/GENERATED_AT
@@ -319,7 +303,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.3
+rubygems_version: 3.7.2
 specification_version: 4
 summary: Reads query results from an Elasticsearch cluster
 test_files:

data/lib/logstash/inputs/elasticsearch/patches/_elasticsearch_transport_connections_selector.rb

@@ -1,51 +0,0 @@
-require 'elasticsearch'
-require 'elasticsearch/transport/transport/connections/selector'
-
-if Gem.loaded_specs['elasticsearch-transport'].version < Gem::Version.new("7.2.0")
-  # elasticsearch-transport versions prior to 7.2.0 suffered of a race condition on accessing
-  # the connection pool. This issue was fixed (in 7.2.0) with
-  # https://github.com/elastic/elasticsearch-ruby/commit/15f9d78591a6e8823948494d94b15b0ca38819d1
-  #
-  # This plugin, at the moment, is using elasticsearch >= 5.0.5
-  # When this requirement ceases, this patch could be removed.
-  module Elasticsearch
-    module Transport
-      module Transport
-        module Connections
-          module Selector
-
-            # "Round-robin" selector strategy (default).
-            #
-            class RoundRobin
-              include Base
-
-              # @option arguments [Connections::Collection] :connections Collection with connections.
-              #
-              def initialize(arguments = {})
-                super
-                @mutex = Mutex.new
-                @current = nil
-              end
-
-              # Returns the next connection from the collection, rotating them in round-robin fashion.
-              #
-              # @return [Connections::Connection]
-              #
-              def select(options={})
-                @mutex.synchronize do
-                  conns = connections
-                  if @current && (@current < conns.size-1)
-                    @current += 1
-                  else
-                    @current = 0
-                  end
-                  conns[@current]
-                end
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/logstash/inputs/elasticsearch/patches/_elasticsearch_transport_http_manticore.rb

@@ -1,43 +0,0 @@
-# encoding: utf-8
-require "elasticsearch"
-require "elasticsearch/transport/transport/http/manticore"
-
-es_client_version = Gem.loaded_specs['elasticsearch-transport'].version
-if es_client_version >= Gem::Version.new('7.2') && es_client_version < Gem::Version.new('7.16')
-  # elasticsearch-transport 7.2.0 - 7.14.0 had a bug where setting http headers
-  #   ES::Client.new ..., transport_options: { headers: { 'Authorization' => ... } }
-  # would be lost https://github.com/elastic/elasticsearch-ruby/issues/1428
-  #
-  # NOTE: needs to be idempotent as filter ES plugin might apply the same patch!
-  #
-  # @private
-  module Elasticsearch
-    module Transport
-      module Transport
-        module HTTP
-          class Manticore
-
-            def apply_headers(request_options, options)
-              headers = (options && options[:headers]) || {}
-              headers[CONTENT_TYPE_STR] = find_value(headers, CONTENT_TYPE_REGEX) || DEFAULT_CONTENT_TYPE
-
-              # this code is necessary to grab the correct user-agent header
-              # when this method is invoked with apply_headers(@request_options, options)
-              # from https://github.com/elastic/elasticsearch-ruby/blob/v7.14.0/elasticsearch-transport/lib/elasticsearch/transport/transport/http/manticore.rb#L113-L114
-              transport_user_agent = nil
-              if (options && options[:transport_options] && options[:transport_options][:headers])
-                transport_headers = options[:transport_options][:headers]
-                transport_user_agent = find_value(transport_headers, USER_AGENT_REGEX)
-              end
-
-              headers[USER_AGENT_STR] = transport_user_agent || find_value(headers, USER_AGENT_REGEX) || user_agent_header
-              headers[ACCEPT_ENCODING] = GZIP if use_compression?
-              (request_options[:headers] ||= {}).merge!(headers) # this line was changed
-            end
-
-          end
-        end
-      end
-    end
-  end
-end