logstash-input-elasticsearch 5.3.1 → 5.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9727073ca11cfa69a6f7c7b2f697ddf5867cef0bba4d4e4516eb32aad0dfcd0
-  data.tar.gz: f48cdc3e58b58bf3d06e56edb7887b61f8a7d3b9ea01492cae2ba300d91c9a0a
+  metadata.gz: f16f7eb70ca4239c5d779c5fa8c77d0778ab48277c7f6ca4003d20894d0d7108
+  data.tar.gz: 59baf110729b3f8e353087dda028b6e6dc7c6973449307756729d451ddc4192e
 SHA512:
-  metadata.gz: 7f0266cbad4a06a7c65bf33dcc4bf79a58a5fd43da7ad7ee007298f9492a23dd939c73dff55eb1880ee6a4f88299946f8b5f113a8267e529cbafb00d417e4ccc
-  data.tar.gz: 8ae4f0721c282efa2f3384047d94aa0494adf17feb8a6061563fd65b99d6a040ebf0654d36a0f67ab41668e438d087f9473adc30a539f04eec0dc4eb9d984bb5
+  metadata.gz: 5450236e4c130d4a7737520de8571d9364327703c8b715ed3aa6de638f604e83c0062ebc2d1f36fecbb7d11d6e29931f8e713008ae89529f843d048c8f82227d
+  data.tar.gz: 1e5fdda8c6feafa77d40eda3940155995fba96b1c6d925b74e3392e246eb893a46dc38912335011cc9bd9235a4bf9ad68a0378b8799e48947ea98f68c1cb2207

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 5.3.2
+  - Support Elastic Cloud API keys in the `api_key` option, which now accepts an `id:api_key` pair, its base64-encoded form, or an `essu_` Cloud API key, and rejects an unrecognized format at startup [#274](https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/274)
+
 ## 5.3.1
   - Fix serverless request failure caused by conflicting `compatible-with` and `Elastic-Api-Version` headers when using elasticsearch-ruby v9 [#269](https://github.com/logstash-plugins/logstash-input-elasticsearch/pull/269)
 

data/docs/index.asciidoc

@@ -404,10 +404,12 @@ input plugins.
 
 Authenticate using Elasticsearch API key. Note that this option also requires enabling the <<plugins-{type}s-{plugin}-ssl_enabled>> option.
 
-Format is `id:api_key` where `id` and `api_key` are as returned by the
+The format is `id:api_key`, where `id` and `api_key` are as returned by the
 Elasticsearch
 {ref}/security-api-create-api-key.html[Create
-API key API].
+API key API]. The base64-encoded form of that pair is also accepted, as is an
+https://www.elastic.co/docs/deploy-manage/api-keys/elastic-cloud-api-keys[Elastic Cloud API key]
+(prefixed with `essu_`), which is used as-is.
 
 [id="plugins-{type}s-{plugin}-ca_trusted_fingerprint"]
 ===== `ca_trusted_fingerprint`

data/lib/logstash/inputs/elasticsearch.rb

@@ -216,7 +216,8 @@ class LogStash::Inputs::Elasticsearch < LogStash::Inputs::Base
   config :cloud_auth, :validate => :password
 
   # Authenticate using Elasticsearch API key.
-  # format is id:api_key (as returned by https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key])
+  # Format is either the `id:api_key` pair (as returned by https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key]),
+  # its base64-encoded form, or an https://www.elastic.co/docs/deploy-manage/api-keys/elastic-cloud-api-keys[Elastic Cloud API key] (prefixed with `essu_`) can be used.
   config :api_key, :validate => :password
 
   # Set the address of a forward HTTP proxy.
@@ -542,10 +543,32 @@ class LogStash::Inputs::Elasticsearch < LogStash::Inputs::Base
   def setup_api_key(api_key)
     return {} unless (api_key&.value)
 
-    token = base64?(api_key.value) ? api_key.value : Base64.strict_encode64(api_key.value)
+    token = resolve_api_key(api_key.value)
     { 'Authorization' => "ApiKey #{token}" }
   end
 
+  # Resolves the `api_key` value into the credential used in the
+  # `Authorization: ApiKey` header. An already base64-encoded key and an Elastic
+  # Cloud API key are used as-is; a raw `id:api_key` pair is base64-encoded. An
+  # unrecognized value is rejected so a malformed key surfaces at startup rather
+  # than as a later authentication failure.
+  def resolve_api_key(key_value)
+    if base64?(key_value) || cloud_api_key?(key_value)
+      key_value
+    elsif key_value.match?(/\A[^:]+:[^:]+\z/)
+      Base64.strict_encode64(key_value)
+    else
+      raise LogStash::ConfigurationError, "Invalid api_key format. Expected a base64-encoded key, an 'id:api_key' pair, or a Cloud API key (essu_ prefix)."
+    end
+  end
+
+  # Elastic Cloud API keys (such as the unified Serverless keys) are opaque
+  # tokens prefixed with `essu_` that Elasticsearch accepts verbatim in the
+  # `Authorization: ApiKey` header, with no base64 encoding.
+  def cloud_api_key?(string)
+    string.match?(/\Aessu_.+/)
+  end
+
   def base64?(string)
     string == Base64.strict_encode64(Base64.strict_decode64(string))
   rescue ArgumentError

data/spec/inputs/elasticsearch_spec.rb

@@ -835,6 +835,28 @@ describe LogStash::Inputs::Elasticsearch, :ecs_compatibility_support do
           it_behaves_like "a plugin that sets the ApiKey authorization header"
         end
 
+        context "with an Elastic Cloud API key (essu_ prefix)" do
+          # The suffix is intentionally not canonical base64: a Cloud key is opaque
+          # and must be forwarded verbatim regardless of its payload encoding.
+          let(:api_key_value) { "essu_VFZGblZreFhTekJ4ZDB4M2NHUnZRMEU2YzNWd1pYSnpaV055WlhRPQ==AAAAAAAA" }
+
+          it "sets the Authorization header verbatim without re-encoding" do
+            plugin.register
+            client = plugin.send(:client)
+            auth_header = client.transport.options[:transport_options][:headers]['Authorization']
+
+            expect(auth_header).to eql("ApiKey #{api_key_value}")
+          end
+        end
+
+        context "with an unrecognized api_key format" do
+          let(:api_key_value) { "not-a-valid-key" }
+
+          it "fails registration with a configuration error" do
+            expect { plugin.register }.to raise_error(LogStash::ConfigurationError, /Invalid api_key format/)
+          end
+        end
+
         context 'user also set' do
           let(:config) { super().merge({ 'api_key' => 'foo:bar', 'user' => 'another' }) }
 

data/version

@@ -1 +1 @@
-5.3.1
+5.3.2

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-elasticsearch
 version: !ruby/object:Gem::Version
-  version: 5.3.1
+  version: 5.3.2
 platform: ruby
 authors:
 - Elastic
 bindir: bin
 cert_chain: []
-date: 2026-06-18 00:00:00.000000000 Z
+date: 2026-07-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api