logstash-input-elasticsearch_compat 0.1.0-java

data/docs/index.asciidoc

@@ -0,0 +1,295 @@
+:plugin: elasticsearch_compat
+:type: input
+:default_codec: plain
+
+///////////////////////////////////////////
+START - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+:version: %VERSION%
+:release_date: %RELEASE_DATE%
+:changelog_url: %CHANGELOG_URL%
+:include_path: ../../../../logstash/docs/include
+///////////////////////////////////////////
+END - GENERATED VARIABLES, DO NOT EDIT!
+///////////////////////////////////////////
+
+[id="plugins-{type}s-{plugin}"]
+
+=== Elasticsearch compat input plugin
+
+include::{include_path}/plugin_header.asciidoc[]
+
+==== Description
+
+Receives Elasticsearch Bulk API requests and emits one Logstash event per `index` or `create`
+action. Point a client that normally writes to Elasticsearch, such as the OpenTelemetry
+Collector `elasticsearch` exporter (tested with its default settings), at Logstash instead.
+
+This plugin is a protocol-compatible receiver, not an Elasticsearch node.
+
+===== Routes
+
+* `POST` or `PUT` `/_bulk` and `/{index}/_bulk`. On `/{index}/_bulk`, `{index}` is used only for
+  actions without `_index`.
+* `GET /` and `HEAD /` return a minimal identity response for client version detection. It
+  reports version `8.19.0` as a fixed compatibility placeholder (it keeps the OTel exporter on its
+  most widely compatible metrics format).
+* Anything else: `404`; wrong methods: `405`.
+
+===== Events
+
+Event fields are the source document. Routing metadata (`action`, `index`, and `id`, `routing`,
+`pipeline` when supplied) is stored at `metadata_target`
+(default `[@metadata][elasticsearch_compat]`). `@metadata` is not written by outputs; copy what
+downstream consumers need.
+
+A numeric or digit-string `@timestamp` is read as epoch milliseconds, as Elasticsearch reads it
+(the OTel exporter sends this form), with nanosecond precision.
+
+===== Acknowledgments
+
+* An item's `201` means the event was accepted by the Logstash queue, not that an output
+  delivered it.
+* `update` and `delete` are not supported: each gets an item-level `400`.
+* A malformed body gets `400` and nothing from it is queued.
+* If queuing fails mid-request: items already queued are `201`, the failing item `500`, the rest
+  `503`. Clients retry these, so duplicates are possible.
+
+===== Compression
+
+Compressed request bodies (`gzip`, `deflate`, `x-gzip`, `x-deflate`) are always accepted;
+`max_content_length` applies after decompression. Other encodings get `415`. Responses are
+compressed (level 3, no size threshold) when the client accepts it, unless
+`compression_enabled => false`.
+
+===== Credentials
+
+`Authorization` headers are accepted and ignored; no request ever gets `401` or `403`. Restrict
+access with TLS client certificates (`ssl_client_authentication`) or at the network layer.
+
+===== Monitoring
+
+This input adds counters to its entry in the Logstash node stats API
+(`GET /_node/stats/pipelines/<id>`): `bulk_requests`, `bulk_requests_rejected_overload` (`429`),
+`bulk_requests_rejected_too_large` (`413`), `bulk_requests_rejected_unsupported_encoding`
+(`415`), `bulk_requests_rejected_bad_request` (`400`), `bulk_items_failed`, and
+`queue_submit_failures`. They are updated per request and visible within about a second. Disable
+with `enable_metric => false`.
+
+[id="plugins-{type}s-{plugin}-options"]
+==== Elasticsearch compat input configuration options
+
+[cols="<,<,<",options="header",]
+|=======================================================================
+|Setting |Input type|Required
+| <<plugins-{type}s-{plugin}-compression_enabled>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-host>> |<<string,string>>|No
+| <<plugins-{type}s-{plugin}-max_content_length>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-max_pending_requests>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-metadata_target>> |<<string,string>>|No
+| <<plugins-{type}s-{plugin}-port>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-ssl_certificate>> |a valid filesystem path|No
+| <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-ssl_cipher_suites>> |<<array,array>>|No
+| <<plugins-{type}s-{plugin}-ssl_client_authentication>> |<<string,string>>, one of `["none", "optional", "required"]`|No
+| <<plugins-{type}s-{plugin}-ssl_enabled>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-ssl_handshake_timeout>> |<<number,number>>|No
+| <<plugins-{type}s-{plugin}-ssl_key>> |a valid filesystem path|No
+| <<plugins-{type}s-{plugin}-ssl_key_passphrase>> |<<password,password>>|No
+| <<plugins-{type}s-{plugin}-ssl_keystore_password>> |<<password,password>>|No
+| <<plugins-{type}s-{plugin}-ssl_keystore_path>> |a valid filesystem path|No
+| <<plugins-{type}s-{plugin}-ssl_keystore_type>> |<<string,string>>, one of `["pkcs12", "jks"]`|No
+| <<plugins-{type}s-{plugin}-ssl_supported_protocols>> |<<string,string>>|No
+| <<plugins-{type}s-{plugin}-ssl_truststore_password>> |<<password,password>>|No
+| <<plugins-{type}s-{plugin}-ssl_truststore_path>> |a valid filesystem path|No
+| <<plugins-{type}s-{plugin}-threads>> |<<number,number>>|No
+|=======================================================================
+
+Also see <<plugins-{type}s-{plugin}-common-options>> for a list of options supported by all
+input plugins.
+
+&nbsp;
+
+[id="plugins-{type}s-{plugin}-compression_enabled"]
+===== `compression_enabled`
+
+* Value type is <<boolean,boolean>>
+* Default value is `true`
+
+Compress responses when the client accepts gzip or deflate. Compressed requests are always
+accepted regardless of this setting.
+
+[id="plugins-{type}s-{plugin}-host"]
+===== `host`
+
+* Value type is <<string,string>>
+* Default value is `"0.0.0.0"`
+
+The address to listen on.
+
+[id="plugins-{type}s-{plugin}-max_content_length"]
+===== `max_content_length`
+
+* Value type is <<number,number>>
+* Default value is `104857600` (100 MB)
+
+Maximum request body size in bytes, after decompression. Larger requests get `413`.
+
+[id="plugins-{type}s-{plugin}-max_pending_requests"]
+===== `max_pending_requests`
+
+* Value type is <<number,number>>
+* Default value is `200`
+
+Requests waiting for a worker thread. Beyond this, new requests get `429` (retryable) before
+anything is queued.
+
+[id="plugins-{type}s-{plugin}-metadata_target"]
+===== `metadata_target`
+
+* Value type is <<string,string>>
+* Default value is `"[@metadata][elasticsearch_compat]"`
+
+Field where routing metadata is stored.
+
+[id="plugins-{type}s-{plugin}-port"]
+===== `port`
+
+* Value type is <<number,number>>
+* Default value is `9200`
+
+The port to listen on.
+
+[id="plugins-{type}s-{plugin}-ssl_certificate"]
+===== `ssl_certificate`
+
+* Value type is <<path,path>>
+* There is no default value for this setting.
+
+PEM certificate (chain). Requires `ssl_key`. Use either this or `ssl_keystore_path`.
+
+[id="plugins-{type}s-{plugin}-ssl_certificate_authorities"]
+===== `ssl_certificate_authorities`
+
+* Value type is <<array,array>>
+* Default value is `[]`
+
+PEM certificate authorities that client certificates are checked against. Requires
+`ssl_client_authentication` `optional` or `required`. Use either this or `ssl_truststore_path`.
+
+[id="plugins-{type}s-{plugin}-ssl_cipher_suites"]
+===== `ssl_cipher_suites`
+
+* Value type is a list of <<string,string>>
+* Default value is a modern list (TLS 1.3 suites and ECDHE AES-GCM/ChaCha20, then ECDHE AES-CBC),
+  limited to those the JVM supports — the same as `logstash-input-http`.
+
+Cipher suites to enable, in order of preference.
+
+[id="plugins-{type}s-{plugin}-ssl_client_authentication"]
+===== `ssl_client_authentication`
+
+* Value can be any of: `none`, `optional`, `required`
+* Default value is `"none"`
+
+Whether to request (`optional`) or require (`required`) a client certificate. Needs
+`ssl_certificate_authorities`, `ssl_truststore_path`, or a keystore that also holds trusted
+certificates.
+
+[id="plugins-{type}s-{plugin}-ssl_enabled"]
+===== `ssl_enabled`
+
+* Value type is <<boolean,boolean>>
+* Default value is `false`
+
+Serve HTTPS. Requires `ssl_certificate` and `ssl_key`, or `ssl_keystore_path`. Other `ssl_*`
+settings with `ssl_enabled => false` are ignored with a warning.
+
+[id="plugins-{type}s-{plugin}-ssl_handshake_timeout"]
+===== `ssl_handshake_timeout`
+
+* Value type is <<number,number>>
+* Default value is `10000`
+
+Time in milliseconds for an incomplete TLS handshake before the connection is closed.
+
+[id="plugins-{type}s-{plugin}-ssl_key"]
+===== `ssl_key`
+
+* Value type is <<path,path>>
+* There is no default value for this setting.
+
+PEM private key in PKCS#8 format (convert PKCS#1 with
+`openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pkcs8.pem`). Requires `ssl_certificate`.
+
+[id="plugins-{type}s-{plugin}-ssl_key_passphrase"]
+===== `ssl_key_passphrase`
+
+* Value type is <<password,password>>
+* There is no default value for this setting.
+
+Passphrase of an encrypted `ssl_key`.
+
+[id="plugins-{type}s-{plugin}-ssl_keystore_password"]
+===== `ssl_keystore_password`
+
+* Value type is <<password,password>>
+* There is no default value for this setting.
+
+Keystore password.
+
+[id="plugins-{type}s-{plugin}-ssl_keystore_path"]
+===== `ssl_keystore_path`
+
+* Value type is <<path,path>>
+* There is no default value for this setting.
+
+PKCS12 or JKS keystore with the server key and certificate. Use either this or `ssl_certificate`.
+
+[id="plugins-{type}s-{plugin}-ssl_keystore_type"]
+===== `ssl_keystore_type`
+
+* Value can be any of: `pkcs12`, `jks`
+* There is no default value; when unset, `.p12`/`.pfx`/`.pkcs12` files are PKCS12 and others JKS.
+
+Keystore format.
+
+[id="plugins-{type}s-{plugin}-ssl_supported_protocols"]
+===== `ssl_supported_protocols`
+
+* Value type is <<string,string>>
+* Allowed values are: `'TLSv1.1'`, `'TLSv1.2'`, `'TLSv1.3'`
+* Default value is `['TLSv1.2', 'TLSv1.3']`
+
+TLS versions to accept. The JVM disables `TLSv1.1` by default.
+
+[id="plugins-{type}s-{plugin}-ssl_truststore_password"]
+===== `ssl_truststore_password`
+
+* Value type is <<password,password>>
+* There is no default value for this setting.
+
+Truststore password.
+
+[id="plugins-{type}s-{plugin}-ssl_truststore_path"]
+===== `ssl_truststore_path`
+
+* Value type is <<path,path>>
+* There is no default value for this setting.
+
+PKCS12 or JKS truststore with the certificates client certificates are checked against. Requires
+`ssl_client_authentication` `optional` or `required`. Use either this or
+`ssl_certificate_authorities`.
+
+[id="plugins-{type}s-{plugin}-threads"]
+===== `threads`
+
+* Value type is <<number,number>>
+* Default value is the number of CPU cores
+
+Worker threads that parse requests and queue events.
+
+[id="plugins-{type}s-{plugin}-common-options"]
+include::{include_path}/{type}.asciidoc[]
+
+:default_codec!:

data/lib/logstash/inputs/elasticsearch_compat/batch_handler.rb

@@ -0,0 +1,66 @@
+# encoding: utf-8
+require "java"
+
+module LogStash
+  module ElasticsearchCompat
+    # Implements the Java BatchHandler: called once per request from a worker thread.
+    # Pushes one event per operation, in order, and records each known outcome.
+    # Entries left nil are reported by Java as NOT_ATTEMPTED (503, safe to retry).
+    class BatchHandler
+      include Java::OrgLogstashPluginsInputsEscompat::BatchHandler
+
+      ItemOutcome = Java::OrgLogstashPluginsInputsEscompatBulk::ItemOutcome
+      QUEUED = ItemOutcome::QUEUED
+      SUBMIT_FAILED = ItemOutcome::SUBMIT_FAILED
+
+      # @param sink [#call] called with (document, metadata); builds and queues one event.
+      #   Raising means the outcome is unknown.
+      # @param logger [#error]
+      # @param after_submit [#call, nil] called once after each request's submission (metrics)
+      def initialize(sink, logger, after_submit = nil)
+        @sink = sink
+        @logger = logger
+        @after_submit = after_submit
+        @stopping = java.util.concurrent.atomic.AtomicBoolean.new(false)
+      end
+
+      # After this, operations not yet started are left NOT_ATTEMPTED.
+      def stop!
+        @stopping.set(true)
+      end
+
+      def submit(ops, results)
+        submit_all(ops, results)
+      ensure
+        begin
+          @after_submit.call if @after_submit
+        rescue StandardError, java.lang.Exception
+          # metrics must never affect ingestion
+        end
+      end
+
+      private
+
+      def submit_all(ops, results)
+        n = ops.size
+        i = 0
+        while i < n
+          return if @stopping.get
+          op = ops.get(i)
+          begin
+            @sink.call(op.document, op.metadata)
+          rescue StandardError, java.lang.Exception => e
+            results[i] = SUBMIT_FAILED
+            # Never log the document (constitution VI).
+            @logger.error("elasticsearch_compat: failed to queue event; remaining items in the " \
+                          "request were not attempted", :exception => e.class.name, :message => e.message)
+            return
+          end
+          results[i] = QUEUED
+          i += 1
+        end
+        nil
+      end
+    end
+  end
+end

data/lib/logstash/inputs/elasticsearch_compat/metrics_publisher.rb

@@ -0,0 +1,50 @@
+# encoding: utf-8
+
+module LogStash
+  module ElasticsearchCompat
+    # Publishes the Java RequestCounters into this input's Logstash metrics as gauges of
+    # cumulative values (research R6): after each request that reaches Ruby, and every second so
+    # refused requests (which never reach Ruby) still show up. Gauges are idempotent, so
+    # concurrent publishes need no locking. With enable_metric => false, `metric` is Logstash's
+    # null metric and nothing is reported.
+    class MetricsPublisher
+      INTERVAL_SECONDS = 1
+
+      # @param metric [#gauge] the plugin's namespaced metric
+      # @param counters [#snapshot] Java RequestCounters
+      def initialize(metric, counters)
+        @metric = metric
+        @counters = counters
+        @thread = nil
+        @running = java.util.concurrent.atomic.AtomicBoolean.new(false)
+      end
+
+      def publish
+        @counters.snapshot.each { |key, value| @metric.gauge(key.to_sym, value) }
+      end
+
+      def start
+        return unless @running.compare_and_set(false, true)
+        @thread = Thread.new do
+          Thread.current.name = "escompat-metrics" if Thread.current.respond_to?(:name=)
+          while @running.get
+            begin
+              publish
+            rescue StandardError, java.lang.Exception
+              # metrics must never affect ingestion
+            end
+            sleep INTERVAL_SECONDS
+          end
+        end
+      end
+
+      def stop
+        @running.set(false)
+        thread = @thread
+        thread.wakeup rescue nil if thread
+        thread.join(5) if thread
+        publish rescue nil
+      end
+    end
+  end
+end

data/lib/logstash/inputs/elasticsearch_compat/ssl_validation.rb

@@ -0,0 +1,64 @@
+# encoding: utf-8
+
+module LogStash
+  module ElasticsearchCompat
+    # TLS setting rules identical to logstash-input-http's validate_ssl_settings!, including its
+    # messages (contracts/plugin-config.md rules 1-6). Pure: no Logstash dependency, so it can be
+    # specified with plain JRuby.
+    module SslValidation
+      OPTIONAL = "optional".freeze
+      REQUIRED = "required".freeze
+
+      # @param s [Hash] setting name (String) => value, as configured
+      # @param explicit [Array<String>] names the user actually set (for the warning)
+      # @return [Hash] { errors: [String] (first rule only, as logstash-input-http raises), warnings: [String] }
+      def self.check(s, explicit)
+        unless s["ssl_enabled"]
+          ignored = explicit.select { |k| k != "ssl_enabled" && k.start_with?("ssl_") }
+          warnings = ignored.empty? ? [] :
+            ["Configured SSL settings are not used when `ssl_enabled` is set to `false`: #{ignored}"]
+          return { errors: [], warnings: warnings }
+        end
+        { errors: Array(first_error(s)), warnings: [] }
+      end
+
+      def self.first_error(s)
+        cert = present?(s["ssl_certificate"])
+        key = present?(s["ssl_key"])
+        keystore = present?(s["ssl_keystore_path"])
+        truststore = present?(s["ssl_truststore_path"])
+        cas = Array(s["ssl_certificate_authorities"]).any?
+        client_auth = s["ssl_client_authentication"].to_s.downcase
+
+        return "Using an `ssl_certificate` requires an `ssl_key`" if cert && !key
+        return "An `ssl_certificate` is required when using an `ssl_key`" if key && !cert
+        unless cert || keystore
+          return "Either an `ssl_certificate` or `ssl_keystore_path` is required when SSL is enabled `ssl_enabled => true`"
+        end
+        return "Use either an `ssl_certificate` or an `ssl_keystore_path`" if cert && keystore
+        return "Use either an `ssl_certificate_authorities` or an `ssl_truststore_path`" if cas && truststore
+
+        if client_auth == OPTIONAL || client_auth == REQUIRED
+          unless cas || truststore || keystore
+            return "Using `ssl_client_authentication` set to `#{OPTIONAL}` or `#{REQUIRED}`, requires the " \
+                   "configuration of `ssl_certificate_authorities` or `ssl_truststore_path`"
+          end
+        else
+          if truststore
+            return "The configuration of `ssl_truststore_path` requires setting `ssl_client_authentication` " \
+                   "to `#{OPTIONAL}` or '#{REQUIRED}'"
+          end
+          if cas
+            return "The configuration of `ssl_certificate_authorities` requires setting " \
+                   "`ssl_client_authentication` to `#{OPTIONAL}` or '#{REQUIRED}'"
+          end
+        end
+        nil
+      end
+
+      def self.present?(v)
+        !(v.nil? || v.to_s.empty?)
+      end
+    end
+  end
+end

data/lib/logstash/inputs/elasticsearch_compat.rb

@@ -0,0 +1,149 @@
+# encoding: utf-8
+require "logstash/inputs/base"
+require "logstash/namespace"
+require "logstash-input-elasticsearch_compat_jars"
+require "logstash/inputs/elasticsearch_compat/batch_handler"
+require "logstash/inputs/elasticsearch_compat/ssl_validation"
+require "logstash/inputs/elasticsearch_compat/metrics_publisher"
+
+# Receives Elasticsearch Bulk API requests (POST /_bulk) and emits one event per
+# index/create action. Items are acknowledged only after the event is accepted by
+# the Logstash queue. update/delete get item-level errors. Credentials are accepted
+# and ignored.
+class LogStash::Inputs::ElasticsearchCompat < LogStash::Inputs::Base
+  config_name "elasticsearch_compat"
+
+  # Bulk bodies are parsed by the Java backend, not by a codec.
+  default :codec, "plain"
+
+  # Listen address.
+  config :host, :validate => :string, :default => "0.0.0.0"
+
+  # Listen port.
+  config :port, :validate => :number, :default => 9200
+
+  # Worker threads that parse requests and push events.
+  config :threads, :validate => :number, :default => ::LogStash::Config::CpuCoreStrategy.maximum
+
+  # Requests waiting for a worker; beyond this, new requests get 429.
+  config :max_pending_requests, :validate => :number, :default => 200
+
+  # Maximum request body size in bytes; larger bodies get 413.
+  config :max_content_length, :validate => :number, :default => 100 * 1024 * 1024
+
+  # Where routing metadata (action, index, id, routing, pipeline) is stored.
+  config :metadata_target, :validate => :string, :default => "[@metadata][elasticsearch_compat]"
+
+  # Compress responses when the client accepts gzip or deflate (level 3, like Elasticsearch's
+  # http.compression). Compressed request bodies are always accepted.
+  config :compression_enabled, :validate => :boolean, :default => true
+
+  # TLS: same settings, defaults and rules as logstash-input-http.
+  config :ssl_enabled, :validate => :boolean, :default => false
+  config :ssl_certificate, :validate => :path
+  config :ssl_key, :validate => :path
+  config :ssl_key_passphrase, :validate => :password
+  config :ssl_keystore_path, :validate => :path
+  config :ssl_keystore_password, :validate => :password
+  config :ssl_keystore_type, :validate => %w[pkcs12 jks]
+  config :ssl_certificate_authorities, :validate => :array, :default => []
+  config :ssl_truststore_path, :validate => :path
+  config :ssl_truststore_password, :validate => :password
+  config :ssl_client_authentication, :validate => %w[none optional required], :default => "none"
+  config :ssl_supported_protocols, :validate => %w[TLSv1.1 TLSv1.2 TLSv1.3], :default => %w[TLSv1.2 TLSv1.3],
+         :list => true
+  config :ssl_cipher_suites,
+         :validate => Java::OrgLogstashPluginsInputsEscompatServerTls::SslContextFactory.supportedCiphers.to_a,
+         :default => Java::OrgLogstashPluginsInputsEscompatServerTls::SslContextFactory.defaultCiphers.to_a,
+         :list => true
+  config :ssl_handshake_timeout, :validate => :number, :default => 10000
+
+  def register
+    [[:threads, @threads], [:max_pending_requests, @max_pending_requests],
+     [:max_content_length, @max_content_length]].each do |name, value|
+      raise LogStash::ConfigurationError, "#{name} must be > 0" unless value > 0
+    end
+    if @max_content_length > java.lang.Integer::MAX_VALUE
+      raise LogStash::ConfigurationError, "max_content_length must be <= #{java.lang.Integer::MAX_VALUE}"
+    end
+
+    raise LogStash::ConfigurationError, "ssl_handshake_timeout must be > 0" unless @ssl_handshake_timeout > 0
+
+    counters = Java::OrgLogstashPluginsInputsEscompatServer::RequestCounters.new
+    @metrics_publisher = LogStash::ElasticsearchCompat::MetricsPublisher.new(metric, counters)
+    @batch_handler = LogStash::ElasticsearchCompat::BatchHandler.new(
+      method(:push_event), logger, @metrics_publisher.method(:publish))
+
+    config = Java::OrgLogstashPluginsInputsEscompat::ServerConfig.builder
+      .name("escompat-#{id}").host(@host).port(@port).threads(@threads)
+      .maxPendingRequests(@max_pending_requests).maxContentLength(@max_content_length)
+      .compressionEnabled(@compression_enabled).counters(counters)
+      .sslContext(build_ssl_context).sslHandshakeTimeoutMillis(@ssl_handshake_timeout)
+      .build
+    @server = Java::OrgLogstashPluginsInputsEscompatServer::EsCompatServer.new(config, @batch_handler)
+  end
+
+  def run(queue)
+    @queue = queue
+    logger.info("Starting elasticsearch_compat input", :address => "#{@host}:#{@port}", :ssl_enabled => @ssl_enabled)
+    @metrics_publisher.start
+    @server.run
+  end
+
+  def stop
+    @batch_handler.stop! if @batch_handler
+    @server.close if @server
+    @metrics_publisher.stop if @metrics_publisher
+  rescue => e
+    logger.debug("error while stopping elasticsearch_compat input", :exception => e.class.name)
+  end
+
+  def close
+    @server.close if @server
+    @metrics_publisher.stop if @metrics_publisher
+  rescue => e
+    logger.debug("error while closing elasticsearch_compat input", :exception => e.class.name)
+  end
+
+  private
+
+  # Validates like logstash-input-http, then builds the SslContext (nil when TLS is off).
+  def build_ssl_context
+    settings = {
+      "ssl_enabled" => @ssl_enabled, "ssl_certificate" => @ssl_certificate, "ssl_key" => @ssl_key,
+      "ssl_keystore_path" => @ssl_keystore_path, "ssl_truststore_path" => @ssl_truststore_path,
+      "ssl_certificate_authorities" => @ssl_certificate_authorities,
+      "ssl_client_authentication" => @ssl_client_authentication
+    }
+    explicit = original_params.keys.select { |k| k.start_with?("ssl_") }
+    result = LogStash::ElasticsearchCompat::SslValidation.check(settings, explicit)
+    result[:warnings].each { |w| logger.warn(w) }
+    raise LogStash::ConfigurationError, result[:errors].first if result[:errors].any?
+    return nil unless @ssl_enabled
+
+    tls = Java::OrgLogstashPluginsInputsEscompatServerTls::TlsSettings.new(
+      @ssl_certificate, @ssl_key, secret(@ssl_key_passphrase),
+      @ssl_keystore_path, secret(@ssl_keystore_password), @ssl_keystore_type,
+      @ssl_certificate_authorities, @ssl_truststore_path, secret(@ssl_truststore_password),
+      @ssl_client_authentication, @ssl_supported_protocols, @ssl_cipher_suites)
+    Java::OrgLogstashPluginsInputsEscompatServerTls::SslContextFactory.build(tls)
+  rescue java.lang.IllegalArgumentException => e
+    logger.error("SSL configuration invalid", :message => e.message)
+    raise LogStash::ConfigurationError, e.message
+  rescue java.lang.Exception => e
+    logger.error("SSL configuration failed", :exception => e.class.name, :message => e.message)
+    raise LogStash::ConfigurationError, e.message
+  end
+
+  def secret(password)
+    password.nil? ? nil : password.value
+  end
+
+  # Called from Java worker threads via the batch handler.
+  def push_event(document, metadata)
+    event = LogStash::Event.new(document)
+    event.set(@metadata_target, metadata)
+    decorate(event)
+    @queue << event
+  end
+end

data/lib/logstash-input-elasticsearch_compat_jars.rb

@@ -0,0 +1,5 @@
+# encoding: utf-8
+require "jar_dependencies"
+
+require_jar("org.logstash.plugins.inputs", "logstash-input-elasticsearch_compat",
+            File.read(File.expand_path("../VERSION", __dir__)).strip)

data/logstash-input-elasticsearch_compat.gemspec

@@ -0,0 +1,24 @@
+Gem::Specification.new do |s|
+  s.name          = "logstash-input-elasticsearch_compat"
+  s.version       = File.read(File.expand_path("VERSION", __dir__)).strip
+  s.licenses      = ["Apache-2.0"]
+  s.summary       = "Receives Elasticsearch Bulk API requests and emits Logstash events"
+  s.description   = "This gem is a Logstash plugin required to be installed on top of the " \
+                    "Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. " \
+                    "This gem is not a stand-alone program."
+  s.authors       = ["J. M. Becker"]
+  s.homepage      = "https://github.com/techzilla/logstash-input-elasticsearch_compat"
+  s.require_paths = ["lib", "vendor/jar-dependencies"]
+  s.platform      = "java"
+  s.required_ruby_version = ">= 3.1" # JRuby 9.4+, as bundled across Logstash 9.x
+
+  s.files = Dir["lib/**/*", "vendor/jar-dependencies/**/*.jar", "docs/**/*", "*.gemspec", "*.md",
+                "VERSION", "LICENSE", "NOTICE.TXT"]
+
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "input" }
+
+  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
+  s.add_runtime_dependency "logstash-codec-plain", "~> 3.1"
+
+  s.add_development_dependency "rspec", "~> 3.13"
+end