logstash-output-elasticsearch 11.22.16-java → 11.22.17-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 879ff0b99e2d13691ade229384790bc4372e083396cbb777587b2463d8fa05c1
-  data.tar.gz: c2cc01a0602371c908857832bbf712d2297d0383ffb45e893af2c44e97cd4121
+  metadata.gz: d4bb66bdcf7a4f0d3557d0999e3c3737a1a75d8cb7fa26830339cf6e0e28b82d
+  data.tar.gz: 12bfde3746577a042a3ec3962f39b76e530a65a7cf34e856146e8b3fc2933495
 SHA512:
-  metadata.gz: b3411e69c6aa2798b92cde0d242b8952a79b438c9e4875a40aaf39017c5120978c24378fff986f0d65f6a2b7dad7be6c69b65760b096bae443307448e7be6a59
-  data.tar.gz: cbbbcb50f322e298a05e1d381344555137431cb45e34de65e26d2318c3db28ecb3945921fec036f2fb30ffedd6313ce5b9256160a9d8a4025f69243cfddd80ab
+  metadata.gz: 95d48b93014a46d8412add41d4e753ee1c0ef091f86ad2138825802bbaf416c5865abd7d8afa7df825361f2db010d0f5b189df4274991d02f4f67325ddab56fc
+  data.tar.gz: 607b5b63bc6a41067bd0d4a9c2f627dbb9ea007b43f6d69f8ec53e2d1e8177b9b37be0b76249e0cc310d0da541c981ac753db9cb1cece249404a7c33b8c92618

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 11.22.17
+  - Support base64-encoded and Elastic Cloud (`essu_`-prefixed) API keys in the `api_key` option; reject unrecognized formats at startup. [#1278](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/1278)
+
 ## 11.22.16
  - Fix serverless compatibility: guard against nil params in pool requests and strip unsupported template settings (number_of_shards, number_of_replicas) on serverless
 

data/docs/index.asciidoc

@@ -458,8 +458,12 @@ For more details on actions, check out the {ref}/docs-bulk.html[Elasticsearch bu
 Authenticate using Elasticsearch API key.
 Note that this option also requires SSL/TLS, which can be enabled by supplying a <<plugins-{type}s-{plugin}-cloud_id>>, a list of HTTPS <<plugins-{type}s-{plugin}-hosts>>, or by setting <<plugins-{type}s-{plugin}-ssl,`ssl_enabled => true`>>.
 
-Format is `id:api_key` where `id` and `api_key` are as returned by the
-Elasticsearch {ref}/security-api-create-api-key.html[Create API key API].
+The format is `id:api_key`, where `id` and `api_key` are as returned by the
+Elasticsearch
+{ref}/security-api-create-api-key.html[Create
+API key API]. The base64-encoded form of that pair is also accepted, as is an
+https://www.elastic.co/docs/deploy-manage/api-keys/elastic-cloud-api-keys[Elastic Cloud API key]
+(prefixed with `essu_`), which is used as-is.
 
 [id="plugins-{type}s-{plugin}-bulk_path"]
 ===== `bulk_path`

data/lib/logstash/outputs/elasticsearch/http_client_builder.rb

@@ -188,9 +188,38 @@ module LogStash; module Outputs; class ElasticSearch;
     def self.setup_api_key(logger, params)
       api_key = params["api_key"]
 
-      return {} unless (api_key && api_key.value)
+      return {} unless (api_key&.value)
 
-      { "Authorization" => "ApiKey " + Base64.strict_encode64(api_key.value) }
+      token = resolve_api_key(api_key.value)
+      { "Authorization" => "ApiKey #{token}" }
+    end
+
+    # Resolves the `api_key` value into the credential used in the
+    # `Authorization: ApiKey` header. An already base64-encoded key and an Elastic
+    # Cloud API key are used as-is; a raw `id:api_key` pair is base64-encoded. An
+    # unrecognized value is rejected so a malformed key surfaces at startup rather
+    # than as a later authentication failure.
+    def self.resolve_api_key(key_value)
+      if base64?(key_value) || cloud_api_key?(key_value)
+        key_value
+      elsif key_value.match?(/\A[^:]+:[^:]+\z/)
+        Base64.strict_encode64(key_value)
+      else
+        raise LogStash::ConfigurationError, "Invalid api_key format. Expected a base64-encoded key, an 'id:api_key' pair, or a Cloud API key (essu_ prefix)."
+      end
+    end
+
+    # Elastic Cloud API keys (such as the unified Serverless keys) are opaque
+    # tokens prefixed with `essu_` that Elasticsearch accepts verbatim in the
+    # `Authorization: ApiKey` header, with no base64 encoding.
+    def self.cloud_api_key?(string)
+      string.match?(/\Aessu_.+/)
+    end
+
+    def self.base64?(string)
+      string == Base64.strict_encode64(Base64.strict_decode64(string))
+    rescue ArgumentError
+      false
     end
 
     private

data/lib/logstash/plugin_mixins/elasticsearch/api_configs.rb

@@ -16,7 +16,8 @@ module LogStash; module PluginMixins; module ElasticSearch
         :password => { :validate => :password },
 
         # Authenticate using Elasticsearch API key.
-        # format is id:api_key (as returned by https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key])
+        # Format is either the `id:api_key` pair (as returned by https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html[Create API key]),
+        # its base64-encoded form, or an https://www.elastic.co/docs/deploy-manage/api-keys/elastic-cloud-api-keys[Elastic Cloud API key] (prefixed with `essu_`) can be used.
         :api_key => { :validate => :password },
 
         # Cloud authentication string ("<username>:<password>" format) is an alternative for the `user`/`password` configuration.

data/spec/unit/outputs/elasticsearch_spec.rb

@@ -1618,6 +1618,32 @@ describe LogStash::Outputs::ElasticSearch do
       end; end
     end
 
+    context "with an already base64-encoded API key" do
+      let(:api_key) { Base64.strict_encode64("some_id:some_api_key") }
+      let(:options) { { "ssl_enabled" => true, "api_key" => ::LogStash::Util::Password.new(api_key) } }
+      let(:base64_api_key) { "ApiKey #{api_key}" }
+
+      it_behaves_like 'secure api-key authenticated client'
+    end
+
+    context "with an Elastic Cloud API key (essu_ prefix)" do
+      let(:api_key) { "essu_VFZGblZreFhTekJ4ZDB4M2NHUnZRMEU2YzNWd1pYSnpaV055WlhRPQ==AAAAAAAA" }
+      let(:options) { { "ssl_enabled" => true, "api_key" => ::LogStash::Util::Password.new(api_key) } }
+
+      it "sets the Authorization header verbatim without re-encoding" do
+        expect(manticore_options[:headers]).to eq({ "Authorization" => "ApiKey #{api_key}" })
+      end
+    end
+
+    context "with an unrecognized api_key format" do
+      let(:do_register) { false }
+      let(:options) { { "ssl_enabled" => true, "api_key" => ::LogStash::Util::Password.new("not-a-valid-key") } }
+
+      it "fails registration with a configuration error" do
+        expect { subject.register }.to raise_error(LogStash::ConfigurationError, /Invalid api_key format/)
+      end
+    end
+
     context "when set without ssl_enabled => true" do
       let(:do_register) { false } # this is what we want to test, so we disable the before(:each) call
       let(:options) { { "api_key" => api_key } }

data/version

@@ -1 +1 @@
-11.22.16
+11.22.17

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: logstash-output-elasticsearch
 version: !ruby/object:Gem::Version
-  version: 11.22.16
+  version: 11.22.17
 platform: java
 authors:
 - Elastic
 bindir: bin
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-07-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: manticore