logstash-output-elasticsearch 10.4.1-java → 10.6.1-java
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +12 -0
- data/docs/index.asciidoc +81 -41
- data/lib/logstash/outputs/elasticsearch.rb +45 -0
- data/lib/logstash/outputs/elasticsearch/common.rb +36 -21
- data/lib/logstash/outputs/elasticsearch/common_configs.rb +3 -3
- data/lib/logstash/outputs/elasticsearch/http_client_builder.rb +11 -1
- data/lib/logstash/outputs/elasticsearch/ilm.rb +1 -1
- data/lib/logstash/outputs/elasticsearch/template_manager.rb +12 -9
- data/lib/logstash/outputs/elasticsearch/{elasticsearch-template-es2x.json → templates/ecs-disabled/elasticsearch-2x.json} +0 -0
- data/lib/logstash/outputs/elasticsearch/{elasticsearch-template-es5x.json → templates/ecs-disabled/elasticsearch-5x.json} +0 -0
- data/lib/logstash/outputs/elasticsearch/{elasticsearch-template-es6x.json → templates/ecs-disabled/elasticsearch-6x.json} +0 -0
- data/lib/logstash/outputs/elasticsearch/{elasticsearch-template-es7x.json → templates/ecs-disabled/elasticsearch-7x.json} +0 -0
- data/lib/logstash/outputs/elasticsearch/{elasticsearch-template-es8x.json → templates/ecs-disabled/elasticsearch-8x.json} +0 -0
- data/lib/logstash/outputs/elasticsearch/templates/ecs-v1/elasticsearch-6x.json +2950 -0
- data/lib/logstash/outputs/elasticsearch/templates/ecs-v1/elasticsearch-7x.json +2948 -0
- data/logstash-output-elasticsearch.gemspec +2 -1
- data/spec/integration/outputs/ilm_spec.rb +2 -2
- data/spec/unit/outputs/elasticsearch/template_manager_spec.rb +9 -3
- data/spec/unit/outputs/elasticsearch_spec.rb +86 -2
- data/spec/unit/outputs/error_whitelist_spec.rb +1 -1
- metadata +23 -7
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 712190af3d33e9433c9f6b6dd8efa85406b28e1dddaf344bcaa1c5769708bd44
|
4
|
+
data.tar.gz: 860e97c8f49c09bb0659939211843cc2799e69feccfb58d4584144a067e6b43f
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 2aa2d08a6bdf2248091afb58fe46d79f5144a07ff2512aa6ba3511242037da6577cefae0e0da7278bab13e1382abda215dee081154eec79d75604f8f4a054386
|
7
|
+
data.tar.gz: ebeb646959ce0baf384036dfd34c035a13f88deded066d9557c3d13770dfeb37a241385ab4612f702a4e850fb835903cddc81ed28445e799a2f9d8ce81b50e0c
|
data/CHANGELOG.md
CHANGED
@@ -1,3 +1,15 @@
|
|
1
|
+
## 10.6.1
|
2
|
+
- Fixed an issue introduced in 10.6.0 that broke Logstash Core's monitoring feature when this plugin is run in Logstash 7.7-7.8. [#953](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/953)
|
3
|
+
|
4
|
+
## 10.6.0
|
5
|
+
- Added `ecs_compatiblity` mode, for managing ECS-compatable templates [#952](https://github.com/logstash-plugins/logstash-output-elasticsearch/issue/952)
|
6
|
+
|
7
|
+
## 10.5.1
|
8
|
+
- [DOC] Removed outdated compatibility notices, reworked cloud notice, and fixed formatting for `hosts` examples [#938](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/938)
|
9
|
+
|
10
|
+
## 10.5.0
|
11
|
+
- Added api_key support [#934](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/934)
|
12
|
+
|
1
13
|
## 10.4.1
|
2
14
|
- [DOC] Added note about `_type` setting change from `doc` to `_doc` [#884](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/884)
|
3
15
|
|
data/docs/index.asciidoc
CHANGED
@@ -21,6 +21,21 @@ include::{include_path}/plugin_header.asciidoc[]
|
|
21
21
|
|
22
22
|
==== Description
|
23
23
|
|
24
|
+
If you plan to use the Kibana web interface to analyze data transformed by
|
25
|
+
Logstash, use the Elasticsearch output plugin to get your data into
|
26
|
+
Elasticsearch.
|
27
|
+
|
28
|
+
This output only speaks the HTTP protocol as it is the preferred protocol for
|
29
|
+
interacting with Elasticsearch. In previous versions it was possible to
|
30
|
+
communicate with Elasticsearch through the transport protocol, which is now
|
31
|
+
reserved for internal cluster communication between nodes
|
32
|
+
https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-transport.html[communication between nodes].
|
33
|
+
Using the https://www.elastic.co/guide/en/elasticsearch/reference/current/java-clients.html[transport protocol]
|
34
|
+
to communicate with the cluster has been deprecated in Elasticsearch 7.0.0 and
|
35
|
+
will be removed in 8.0.0
|
36
|
+
|
37
|
+
You can learn more about Elasticsearch at <https://www.elastic.co/products/elasticsearch>
|
38
|
+
|
24
39
|
.Compatibility Note
|
25
40
|
[NOTE]
|
26
41
|
================================================================================
|
@@ -36,47 +51,26 @@ ensure your template uses the `_doc` document-type before
|
|
36
51
|
connecting to Elasticsearch 7.x.
|
37
52
|
================================================================================
|
38
53
|
|
39
|
-
|
40
|
-
[NOTE]
|
41
|
-
================================================================================
|
42
|
-
Starting with Elasticsearch 5.3, there's an {ref}/modules-http.html[HTTP setting]
|
43
|
-
called `http.content_type.required`. If this option is set to `true`, and you
|
44
|
-
are using Logstash 2.4 through 5.2, you need to update the Elasticsearch output
|
45
|
-
plugin to version 6.2.5 or higher.
|
54
|
+
===== Hosted {es} Service on Elastic Cloud
|
46
55
|
|
47
|
-
|
48
|
-
|
49
|
-
If you plan to use the Kibana web
|
50
|
-
interface, use the Elasticsearch output plugin to get your log data into
|
51
|
-
Elasticsearch.
|
52
|
-
|
53
|
-
TIP: You can run Elasticsearch on your own hardware, or use our
|
56
|
+
You can run Elasticsearch on your own hardware, or use our
|
54
57
|
https://www.elastic.co/cloud/elasticsearch-service[hosted {es} Service] on
|
55
|
-
Elastic Cloud. The Elasticsearch Service is available on
|
56
|
-
{ess-trial}[Try the {es} Service for free].
|
57
|
-
|
58
|
-
This output only speaks the HTTP protocol. HTTP is the preferred protocol for interacting with Elasticsearch as of Logstash 2.0.
|
59
|
-
We strongly encourage the use of HTTP over the node protocol for a number of reasons. HTTP is only marginally slower,
|
60
|
-
yet far easier to administer and work with. When using the HTTP protocol one may upgrade Elasticsearch versions without having
|
61
|
-
to upgrade Logstash in lock-step.
|
62
|
-
|
63
|
-
You can learn more about Elasticsearch at <https://www.elastic.co/products/elasticsearch>
|
64
|
-
|
65
|
-
==== Template management for Elasticsearch 5.x
|
66
|
-
|
67
|
-
Index template for this version (Logstash 5.0) has been changed to reflect Elasticsearch's mapping changes in version 5.0.
|
68
|
-
Most importantly, the subfield for string multi-fields has changed from `.raw` to `.keyword` to match ES default
|
69
|
-
behavior.
|
58
|
+
Elastic Cloud. The Elasticsearch Service is available on AWS, Google Cloud
|
59
|
+
Platform, and Microsoft Azure. {ess-trial}[Try the {es} Service for free].
|
70
60
|
|
71
|
-
|
61
|
+
==== Compatibility with the Elastic Common Schema (ECS)
|
72
62
|
|
73
|
-
This
|
63
|
+
This plugin will persist events to Elasticsearch in the shape produced by
|
64
|
+
your pipeline, and _cannot_ be used to re-shape the event structure into a
|
65
|
+
shape that complies with ECS. To produce events that fully comply with ECS,
|
66
|
+
you will need to populate ECS-defined fields throughout your pipeline
|
67
|
+
definition.
|
74
68
|
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
69
|
+
However, the Elasticsearch Index Templates it manages can be configured to
|
70
|
+
be ECS-compatible by setting <<plugins-{type}s-{plugin}-ecs_compatibility>>.
|
71
|
+
By having an ECS-compatible template in place, we can ensure that Elasticsearch
|
72
|
+
is prepared to create and index fields in a way that is compatible with ECS,
|
73
|
+
and will correctly reject events with fields that conflict and cannot be coerced.
|
80
74
|
|
81
75
|
==== Writing to different indices: best practices
|
82
76
|
|
@@ -87,7 +81,7 @@ when using `ilm_rollover_alias`.
|
|
87
81
|
|
88
82
|
================================================================================
|
89
83
|
|
90
|
-
If you're sending events to the same Elasticsearch cluster but you're targeting different indices you can:
|
84
|
+
If you're sending events to the same Elasticsearch cluster, but you're targeting different indices you can:
|
91
85
|
|
92
86
|
* use different Elasticsearch outputs, each one with a different value for the `index` parameter
|
93
87
|
* use one Elasticsearch output and use the dynamic variable substitution for the `index` parameter
|
@@ -232,6 +226,9 @@ Elasticsearch] to take advantage of response compression when using this plugin
|
|
232
226
|
For requests compression, regardless of the Elasticsearch version, users have to enable `http_compression`
|
233
227
|
setting in their Logstash config file.
|
234
228
|
|
229
|
+
==== Authentication
|
230
|
+
|
231
|
+
Authentication to a secure Elasticsearch cluster is possible using one of the `user`/`password`, `cloud_auth` or `api_key` options.
|
235
232
|
|
236
233
|
[id="plugins-{type}s-{plugin}-options"]
|
237
234
|
==== Elasticsearch Output Configuration Options
|
@@ -242,6 +239,7 @@ This plugin supports the following configuration options plus the < |
|
242
239
|
|=======================================================================
|
243
240
|
|Setting |Input type|Required
|
244
241
|
| <<plugins-{type}s-{plugin}-action>> |<<string,string>>|No
|
242
|
+
| <<plugins-{type}s-{plugin}-api_key>> |<<password,password>>|No
|
245
243
|
| <<plugins-{type}s-{plugin}-bulk_path>> |<<string,string>>|No
|
246
244
|
| <<plugins-{type}s-{plugin}-cacert>> |a valid filesystem path|No
|
247
245
|
| <<plugins-{type}s-{plugin}-cloud_auth>> |<<password,password>>|No
|
@@ -250,6 +248,7 @@ This plugin supports the following configuration options plus the < |
|
250
248
|
| <<plugins-{type}s-{plugin}-doc_as_upsert>> |<<boolean,boolean>>|No
|
251
249
|
| <<plugins-{type}s-{plugin}-document_id>> |<<string,string>>|No
|
252
250
|
| <<plugins-{type}s-{plugin}-document_type>> |<<string,string>>|No
|
251
|
+
| <<plugins-{type}s-{plugin}-ecs_compatibility>> | <<string,string>>|No
|
253
252
|
| <<plugins-{type}s-{plugin}-failure_type_logging_whitelist>> |<<array,array>>|No
|
254
253
|
| <<plugins-{type}s-{plugin}-healthcheck_path>> |<<string,string>>|No
|
255
254
|
| <<plugins-{type}s-{plugin}-hosts>> |<<uri,uri>>|No
|
@@ -324,6 +323,16 @@ The Elasticsearch action to perform. Valid actions are:
|
|
324
323
|
|
325
324
|
For more details on actions, check out the http://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html[Elasticsearch bulk API documentation]
|
326
325
|
|
326
|
+
[id="plugins-{type}s-{plugin}-api_key"]
|
327
|
+
===== `api_key`
|
328
|
+
|
329
|
+
* Value type is <<password,password>>
|
330
|
+
* There is no default value for this setting.
|
331
|
+
|
332
|
+
Authenticate using Elasticsearch API key. Note that this option also requires enabling the `ssl` option.
|
333
|
+
|
334
|
+
Format is `id:api_key` where `id` and `api_key` are as returned by the Elasticsearch https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key API].
|
335
|
+
|
327
336
|
[id="plugins-{type}s-{plugin}-bulk_path"]
|
328
337
|
===== `bulk_path`
|
329
338
|
|
@@ -399,6 +408,25 @@ If you don't set a value for this option:
|
|
399
408
|
- for elasticsearch clusters 6.x: the value of 'doc' will be used;
|
400
409
|
- for elasticsearch clusters 5.x and below: the event's 'type' field will be used, if the field is not present the value of 'doc' will be used.
|
401
410
|
|
411
|
+
[id="plugins-{type}s-{plugin}-ecs_compatibility"]
|
412
|
+
===== `ecs_compatibility`
|
413
|
+
|
414
|
+
* Value type is <<string,string>>
|
415
|
+
* Supported values are:
|
416
|
+
** `disabled`: does not provide ECS-compatible templates
|
417
|
+
** `v1`: provides defaults that are compatible with v1 of the Elastic Common Schema
|
418
|
+
* Default value depends on which version of Logstash is running:
|
419
|
+
** When Logstash provides a `pipeline.ecs_compatibility` setting, its value is used as the default
|
420
|
+
** Otherwise, the default value is `disabled`.
|
421
|
+
|
422
|
+
Controls this plugin's compatibility with the https://www.elastic.co/guide/en/ecs/current/index.html[Elastic Common Schema (ECS)],
|
423
|
+
including the installation of ECS-compatible index templates.
|
424
|
+
The value of this setting affects the _default_ values of:
|
425
|
+
|
426
|
+
* <<plugins-{type}s-{plugin}-index>>
|
427
|
+
* <<plugins-{type}s-{plugin}-template_name>>
|
428
|
+
* <<plugins-{type}s-{plugin}-ilm_rollover_alias>>
|
429
|
+
|
402
430
|
[id="plugins-{type}s-{plugin}-failure_type_logging_whitelist"]
|
403
431
|
===== `failure_type_logging_whitelist`
|
404
432
|
|
@@ -439,11 +467,15 @@ If you have custom firewall rules you may need to change this
|
|
439
467
|
|
440
468
|
Sets the host(s) of the remote instance. If given an array it will load balance requests across the hosts specified in the `hosts` parameter.
|
441
469
|
Remember the `http` protocol uses the http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-http.html#modules-http[http] address (eg. 9200, not 9300).
|
470
|
+
|
471
|
+
Examples:
|
472
|
+
|
442
473
|
`"127.0.0.1"`
|
443
474
|
`["127.0.0.1:9200","127.0.0.2:9200"]`
|
444
475
|
`["http://127.0.0.1"]`
|
445
476
|
`["https://127.0.0.1:9200"]`
|
446
477
|
`["https://127.0.0.1:9200/mypath"]` (If using a proxy on a subpath)
|
478
|
+
|
447
479
|
It is important to exclude http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html[dedicated master nodes] from the `hosts` list
|
448
480
|
to prevent LS from sending bulk requests to the master nodes. So this parameter should only reference either data or client nodes in Elasticsearch.
|
449
481
|
|
@@ -502,7 +534,9 @@ NOTE: If this setting is specified, the policy must already exist in Elasticsear
|
|
502
534
|
===== `ilm_rollover_alias`
|
503
535
|
|
504
536
|
* Value type is <<string,string>>
|
505
|
-
* Default value is
|
537
|
+
* Default value depends on whether <<plugins-{type}s-{plugin}-ecs_compatibility>> is enabled:
|
538
|
+
** ECS Compatibility disabled: `logstash`
|
539
|
+
** ECS Compatibility enabled: `ecs-logstash`
|
506
540
|
|
507
541
|
The rollover alias is the alias where indices managed using Index Lifecycle Management will be written to.
|
508
542
|
|
@@ -516,7 +550,9 @@ NOTE: `ilm_rollover_alias` does NOT support dynamic variable substitution as `in
|
|
516
550
|
===== `index`
|
517
551
|
|
518
552
|
* Value type is <<string,string>>
|
519
|
-
* Default value
|
553
|
+
* Default value depends on whether <<plugins-{type}s-{plugin}-ecs_compatibility>> is enabled:
|
554
|
+
** ECS Compatibility disabled: `"logstash-%{+yyyy.MM.dd}"`
|
555
|
+
** ECS Compatibility enabled: `"ecs-logstash-%{+yyyy.MM.dd}"`
|
520
556
|
|
521
557
|
The index to write events to. This can be dynamic using the `%{foo}` syntax.
|
522
558
|
The default value will partition your indices by day so you can more easily
|
@@ -550,7 +586,8 @@ Set the keystore password
|
|
550
586
|
* Default value is `true`
|
551
587
|
|
552
588
|
From Logstash 1.3 onwards, a template is applied to Elasticsearch during
|
553
|
-
Logstash's startup if one with the name
|
589
|
+
Logstash's startup if one with the name <<plugins-{type}s-{plugin}-template_name>>
|
590
|
+
does not already exist.
|
554
591
|
By default, the contents of this template is the default template for
|
555
592
|
`logstash-%{+YYYY.MM.dd}` which always matches indices based on the pattern
|
556
593
|
`logstash-*`. Should you require support for other index names, or would like
|
@@ -801,7 +838,10 @@ If not set, the included template will be used.
|
|
801
838
|
===== `template_name`
|
802
839
|
|
803
840
|
* Value type is <<string,string>>
|
804
|
-
* Default value is
|
841
|
+
* Default value depends on whether <<plugins-{type}s-{plugin}-ecs_compatibility>> is enabled:
|
842
|
+
** ECS Compatibility disabled: `logstash`
|
843
|
+
** ECS Compatibility enabled: `ecs-logstash`
|
844
|
+
|
805
845
|
|
806
846
|
This configuration option defines how the template is named inside Elasticsearch.
|
807
847
|
Note that if you have used the template management features and subsequently
|
@@ -92,6 +92,8 @@ class LogStash::Outputs::ElasticSearch < LogStash::Outputs::Base
|
|
92
92
|
require "logstash/outputs/elasticsearch/common"
|
93
93
|
require "logstash/outputs/elasticsearch/ilm"
|
94
94
|
|
95
|
+
require 'logstash/plugin_mixins/ecs_compatibility_support'
|
96
|
+
|
95
97
|
# Protocol agnostic (i.e. non-http, non-java specific) configs go here
|
96
98
|
include(LogStash::Outputs::ElasticSearch::CommonConfigs)
|
97
99
|
|
@@ -101,6 +103,9 @@ class LogStash::Outputs::ElasticSearch < LogStash::Outputs::Base
|
|
101
103
|
# Methods for ILM support
|
102
104
|
include(LogStash::Outputs::ElasticSearch::Ilm)
|
103
105
|
|
106
|
+
# ecs_compatibility option, provided by Logstash core or the support adapter.
|
107
|
+
include(LogStash::PluginMixins::ECSCompatibilitySupport)
|
108
|
+
|
104
109
|
config_name "elasticsearch"
|
105
110
|
|
106
111
|
# The Elasticsearch action to perform. Valid actions are:
|
@@ -122,6 +127,10 @@ class LogStash::Outputs::ElasticSearch < LogStash::Outputs::Base
|
|
122
127
|
# Password to authenticate to a secure Elasticsearch cluster
|
123
128
|
config :password, :validate => :password
|
124
129
|
|
130
|
+
# Authenticate using Elasticsearch API key.
|
131
|
+
# format is id:api_key (as returned by https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key])
|
132
|
+
config :api_key, :validate => :password
|
133
|
+
|
125
134
|
# Cloud authentication string ("<username>:<password>" format) is an alternative for the `user`/`password` configuration.
|
126
135
|
#
|
127
136
|
# For more details, check out the https://www.elastic.co/guide/en/logstash/current/connecting-to-cloud.html#_cloud_auth[cloud documentation]
|
@@ -238,6 +247,34 @@ class LogStash::Outputs::ElasticSearch < LogStash::Outputs::Base
|
|
238
247
|
# Custom Headers to send on each request to elasticsearch nodes
|
239
248
|
config :custom_headers, :validate => :hash, :default => {}
|
240
249
|
|
250
|
+
def initialize(*params)
|
251
|
+
super
|
252
|
+
setup_ecs_compatibility_related_defaults
|
253
|
+
end
|
254
|
+
|
255
|
+
def setup_ecs_compatibility_related_defaults
|
256
|
+
case ecs_compatibility
|
257
|
+
when :disabled
|
258
|
+
@default_index = "logstash-%{+yyyy.MM.dd}"
|
259
|
+
@default_ilm_rollover_alias = "logstash"
|
260
|
+
@default_template_name = 'logstash'
|
261
|
+
when :v1
|
262
|
+
@default_index = "ecs-logstash-%{+yyyy.MM.dd}"
|
263
|
+
@default_ilm_rollover_alias = "ecs-logstash"
|
264
|
+
@default_template_name = 'ecs-logstash'
|
265
|
+
else
|
266
|
+
fail("unsupported ECS Compatibility `#{ecs_compatibility}`")
|
267
|
+
end
|
268
|
+
|
269
|
+
@index ||= default_index
|
270
|
+
@ilm_rollover_alias ||= default_ilm_rollover_alias
|
271
|
+
@template_name ||= default_template_name
|
272
|
+
end
|
273
|
+
|
274
|
+
attr_reader :default_index
|
275
|
+
attr_reader :default_ilm_rollover_alias
|
276
|
+
attr_reader :default_template_name
|
277
|
+
|
241
278
|
# @override to handle proxy => '' as if none was set
|
242
279
|
def config_init(params)
|
243
280
|
proxy = params['proxy']
|
@@ -255,6 +292,14 @@ class LogStash::Outputs::ElasticSearch < LogStash::Outputs::Base
|
|
255
292
|
end
|
256
293
|
|
257
294
|
def build_client
|
295
|
+
# the following 3 options validation & setup methods are called inside build_client
|
296
|
+
# because they must be executed prior to building the client and logstash
|
297
|
+
# monitoring and management rely on directly calling build_client
|
298
|
+
# see https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/934#pullrequestreview-396203307
|
299
|
+
validate_authentication
|
300
|
+
fill_hosts_from_cloud_id
|
301
|
+
setup_hosts
|
302
|
+
|
258
303
|
params["metric"] = metric
|
259
304
|
if @proxy.eql?('')
|
260
305
|
@logger.warn "Supplied proxy setting (proxy => '') has no effect"
|
@@ -20,10 +20,6 @@ module LogStash; module Outputs; class ElasticSearch;
|
|
20
20
|
@stopping = Concurrent::AtomicBoolean.new(false)
|
21
21
|
# To support BWC, we check if DLQ exists in core (< 5.4). If it doesn't, we use nil to resort to previous behavior.
|
22
22
|
@dlq_writer = dlq_enabled? ? execution_context.dlq_writer : nil
|
23
|
-
|
24
|
-
fill_hosts_from_cloud_id
|
25
|
-
fill_user_password_from_cloud_auth
|
26
|
-
setup_hosts # properly sets @hosts
|
27
23
|
build_client
|
28
24
|
setup_after_successful_connection
|
29
25
|
check_action_validity
|
@@ -64,8 +60,15 @@ module LogStash; module Outputs; class ElasticSearch;
|
|
64
60
|
!!maximum_seen_major_version
|
65
61
|
end
|
66
62
|
|
67
|
-
|
68
|
-
|
63
|
+
##
|
64
|
+
# WARNING: This method is overridden in a subclass in Logstash Core 7.7-7.8's monitoring,
|
65
|
+
# where a `client` argument is both required and ignored. In later versions of
|
66
|
+
# Logstash Core it is optional and ignored, but to make it optional here would
|
67
|
+
# allow us to accidentally break compatibility with Logstashes where it was required.
|
68
|
+
# @param noop_required_client [nil]: required `nil` for legacy reasons.
|
69
|
+
# @return [Boolean]
|
70
|
+
def use_event_type?(noop_required_client)
|
71
|
+
maximum_seen_major_version < 8
|
69
72
|
end
|
70
73
|
|
71
74
|
# Convert the event into a 3-tuple of action, params, and event
|
@@ -78,7 +81,7 @@ module LogStash; module Outputs; class ElasticSearch;
|
|
78
81
|
routing_field_name => @routing ? event.sprintf(@routing) : nil
|
79
82
|
}
|
80
83
|
|
81
|
-
params[:_type] = get_event_type(event) if use_event_type?(
|
84
|
+
params[:_type] = get_event_type(event) if use_event_type?(nil)
|
82
85
|
|
83
86
|
if @pipeline
|
84
87
|
params[:pipeline] = event.sprintf(@pipeline)
|
@@ -112,6 +115,28 @@ module LogStash; module Outputs; class ElasticSearch;
|
|
112
115
|
[action, params, event]
|
113
116
|
end
|
114
117
|
|
118
|
+
def validate_authentication
|
119
|
+
authn_options = 0
|
120
|
+
authn_options += 1 if @cloud_auth
|
121
|
+
authn_options += 1 if (@api_key && @api_key.value)
|
122
|
+
authn_options += 1 if (@user || (@password && @password.value))
|
123
|
+
|
124
|
+
if authn_options > 1
|
125
|
+
raise LogStash::ConfigurationError, 'Multiple authentication options are specified, please only use one of user/password, cloud_auth or api_key'
|
126
|
+
end
|
127
|
+
|
128
|
+
if @api_key && @api_key.value && @ssl != true
|
129
|
+
raise(LogStash::ConfigurationError, "Using api_key authentication requires SSL/TLS secured communication using the `ssl => true` option")
|
130
|
+
end
|
131
|
+
|
132
|
+
if @cloud_auth
|
133
|
+
@user, @password = parse_user_password_from_cloud_auth(@cloud_auth)
|
134
|
+
# params is the plugin global params hash which will be passed to HttpClientBuilder.build
|
135
|
+
params['user'], params['password'] = @user, @password
|
136
|
+
end
|
137
|
+
end
|
138
|
+
private :validate_authentication
|
139
|
+
|
115
140
|
def setup_hosts
|
116
141
|
@hosts = Array(@hosts)
|
117
142
|
if @hosts.empty?
|
@@ -135,16 +160,6 @@ module LogStash; module Outputs; class ElasticSearch;
|
|
135
160
|
@hosts = parse_host_uri_from_cloud_id(@cloud_id)
|
136
161
|
end
|
137
162
|
|
138
|
-
def fill_user_password_from_cloud_auth
|
139
|
-
return unless @cloud_auth
|
140
|
-
|
141
|
-
if @user || @password
|
142
|
-
raise LogStash::ConfigurationError, 'Both cloud_auth and user/password specified, please only use one.'
|
143
|
-
end
|
144
|
-
@user, @password = parse_user_password_from_cloud_auth(@cloud_auth)
|
145
|
-
params['user'], params['password'] = @user, @password
|
146
|
-
end
|
147
|
-
|
148
163
|
def parse_host_uri_from_cloud_id(cloud_id)
|
149
164
|
begin # might not be available on older LS
|
150
165
|
require 'logstash/util/cloud_setting_id'
|
@@ -339,11 +354,11 @@ module LogStash; module Outputs; class ElasticSearch;
|
|
339
354
|
type = if @document_type
|
340
355
|
event.sprintf(@document_type)
|
341
356
|
else
|
342
|
-
if
|
357
|
+
if maximum_seen_major_version < 6
|
343
358
|
event.get("type") || DEFAULT_EVENT_TYPE_ES6
|
344
|
-
elsif
|
359
|
+
elsif maximum_seen_major_version == 6
|
345
360
|
DEFAULT_EVENT_TYPE_ES6
|
346
|
-
elsif
|
361
|
+
elsif maximum_seen_major_version == 7
|
347
362
|
DEFAULT_EVENT_TYPE_ES7
|
348
363
|
else
|
349
364
|
nil
|
@@ -428,7 +443,7 @@ module LogStash; module Outputs; class ElasticSearch;
|
|
428
443
|
end
|
429
444
|
|
430
445
|
def default_index?(index)
|
431
|
-
@index ==
|
446
|
+
@index == @default_index
|
432
447
|
end
|
433
448
|
|
434
449
|
def dlq_enabled?
|
@@ -17,7 +17,7 @@ module LogStash; module Outputs; class ElasticSearch
|
|
17
17
|
# For weekly indexes ISO 8601 format is recommended, eg. logstash-%{+xxxx.ww}.
|
18
18
|
# LS uses Joda to format the index pattern from event timestamp.
|
19
19
|
# Joda formats are defined http://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html[here].
|
20
|
-
mod.config :index, :validate => :string
|
20
|
+
mod.config :index, :validate => :string
|
21
21
|
|
22
22
|
mod.config :document_type,
|
23
23
|
:validate => :string,
|
@@ -44,7 +44,7 @@ module LogStash; module Outputs; class ElasticSearch
|
|
44
44
|
# `curl -XDELETE <http://localhost:9200/_template/OldTemplateName?pretty>`
|
45
45
|
#
|
46
46
|
# where `OldTemplateName` is whatever the former setting was.
|
47
|
-
mod.config :template_name, :validate => :string
|
47
|
+
mod.config :template_name, :validate => :string
|
48
48
|
|
49
49
|
# You can set the path to your own template here, if you so desire.
|
50
50
|
# If not set, the included template will be used.
|
@@ -153,7 +153,7 @@ module LogStash; module Outputs; class ElasticSearch
|
|
153
153
|
mod.config :ilm_enabled, :validate => [true, false, 'true', 'false', 'auto'], :default => 'auto'
|
154
154
|
|
155
155
|
# Rollover alias used for indexing data. If rollover alias doesn't exist, Logstash will create it and map it to the relevant index
|
156
|
-
mod.config :ilm_rollover_alias, :validate => :string
|
156
|
+
mod.config :ilm_rollover_alias, :validate => :string
|
157
157
|
|
158
158
|
# appends “{now/d}-000001” by default for new index creation, subsequent rollover indices will increment based on this pattern i.e. “000002”
|
159
159
|
# {now/d} is date math, and will insert the appropriate value automatically.
|