logstash-output-elasticsearch 9.4.0-java → 10.0.1-java
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +8 -2
- data/docs/index.asciidoc +11 -22
- data/lib/logstash/outputs/elasticsearch/common_configs.rb +1 -5
- data/logstash-output-elasticsearch.gemspec +1 -1
- data/spec/integration/outputs/compressed_indexing_spec.rb +1 -3
- data/spec/integration/outputs/ilm_spec.rb +1 -1
- data/spec/integration/outputs/index_spec.rb +4 -5
- data/spec/integration/outputs/parent_spec.rb +1 -77
- data/spec/unit/outputs/elasticsearch_spec.rb +0 -19
- metadata +1 -1
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 5437ab2d215d988d230d11363dddb6759fca10691dc89c4bb6fb64ee9963e125
|
4
|
+
data.tar.gz: 9815fd0ac531dd9d345045a4fbcd912c8a552f49abcccb01c5ec97e223ef907b
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 5f9273bdbcc946ee9fa7b646aa8a924432e618f2b5cfa5def541ffed237e7b365fd68a36b486cc6d30f049e3d1f7a40d31322fbcfca03c60be6fe2c38ff7020d
|
7
|
+
data.tar.gz: d607546d21651f80d4f0207d2e967ef03520a7faa40be4cc66507e972a6bf5b7763e9a701d2b9d5e98f3587a9bc4a9bca509789f545908d6b2fa01be1be4dd72
|
data/CHANGELOG.md
CHANGED
@@ -1,5 +1,11 @@
|
|
1
|
-
##
|
2
|
-
-
|
1
|
+
## 10.0.1
|
2
|
+
- Reverted `document_type` obsoletion [#844](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/844)
|
3
|
+
|
4
|
+
## 10.0.0 (yanked due to issues with document_type obsoletion)
|
5
|
+
- Changed deprecated `document_type` option to obsolete [#824](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/824)
|
6
|
+
- Remove support for parent child (still support join data type) since we don't support multiple document types any more
|
7
|
+
- Removed obsolete `flush_size` and `idle_flush_time`
|
8
|
+
- Added 'auto' setting for ILM with default of 'auto' [#838](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/838)
|
3
9
|
|
4
10
|
## 9.3.2
|
5
11
|
- Fixed sniffing support for 7.x [#827](https://github.com/logstash-plugins/logstash-output-elasticsearch/pull/827)
|
data/docs/index.asciidoc
CHANGED
@@ -105,20 +105,11 @@ This feature requires an Elasticsearch instance of 6.6.0 or higher with at least
|
|
105
105
|
|
106
106
|
Logstash can use {ref}/index-lifecycle-management.html[Index Lifecycle Management] to automate the management of indices over time.
|
107
107
|
|
108
|
-
The use of Index Lifecycle Management is controlled by the `ilm_enabled` setting.
|
109
|
-
|
108
|
+
The use of Index Lifecycle Management is controlled by the `ilm_enabled` setting. By default, this is will
|
109
|
+
automatically detect whether the Elasticsearch instance supports ILM, and will use it if it is available. `ilm_enabled`
|
110
|
+
can also be set to `true` or `false` to override the automatic detection, or disable ILM.
|
110
111
|
|
111
|
-
|
112
|
-
The `ilm_enabled` flag can be set to `true`, `false` (default) or `auto`.
|
113
|
-
|
114
|
-
Setting `ilm_enabled` to `auto` will automatically detect whether the
|
115
|
-
Elasticsearch instance is version `7.0.0` and above and has Index Lifecycle Management enabled, and will enable its usage if so.
|
116
|
-
|
117
|
-
Setting `ilm_enabled` to `true` will enable the Index Lifecycle Management feature if it is available on the
|
118
|
-
Elasticsearch cluster - the plugin will not start if `ilm_enabled` is set to `true` and the Elasticsearch cluster does
|
119
|
-
not support ILM.
|
120
|
-
|
121
|
-
Enabling ILM support will overwrite the index settings and adjust the Logstash template to write the necessary settings for the template
|
112
|
+
This will overwrite the index settings and adjust the Logstash template to write the necessary settings for the template
|
122
113
|
to support index lifecycle management, including the index policy and rollover alias to be used.
|
123
114
|
|
124
115
|
Logstash will create a rollover alias for the indices to be written to, including a pattern for how the actual indices will be named, and unless an ILM policy that already exists has been specified,
|
@@ -135,10 +126,9 @@ See config below for an example:
|
|
135
126
|
[source,ruby]
|
136
127
|
output {
|
137
128
|
elasticsearch {
|
138
|
-
|
139
|
-
|
140
|
-
|
141
|
-
ilm_policy => "custom_policy"
|
129
|
+
ilm_rollover_alias: "custom"
|
130
|
+
ilm_pattern: "000001"
|
131
|
+
ilm_policy: "custom_policy"
|
142
132
|
}
|
143
133
|
}
|
144
134
|
|
@@ -378,16 +368,15 @@ Enable gzip compression on requests. Note that response compression is on by def
|
|
378
368
|
===== `ilm_enabled`
|
379
369
|
|
380
370
|
* Value can be any of: `true`, `false`, `auto`
|
381
|
-
* Default value is `
|
371
|
+
* Default value is `auto`
|
382
372
|
|
383
|
-
The default setting of `
|
373
|
+
The default setting of `auto` will automatically enable the Index Lifecycle Management feature, if the Elasticsearch
|
374
|
+
cluster is running Elasticsearch version `7.0.0` or higher with the ILM feature enabled, and disable it otherwise.
|
384
375
|
|
376
|
+
Setting this flag to `false` will disable the Index Lifecycle Management feature, even if the Elasticsearch cluster supports ILM.
|
385
377
|
Setting this flag to `true` will enable Index Lifecycle Management feature, if the Elasticsearch cluster supports it. This is required
|
386
378
|
to enable Index Lifecycle Management on a version of Elasticsearch earlier than version `7.0.0`.
|
387
379
|
|
388
|
-
Setting this flag to `auto` will automatically enable the Index Lifecycle Management feature, if the Elasticsearch
|
389
|
-
cluster is running Elasticsearch version `7.0.0` or higher with the ILM feature enabled, and disable it otherwise.
|
390
|
-
|
391
380
|
NOTE: This feature requires a Basic License or above to be installed on an Elasticsearch cluster version 6.6.0 or later
|
392
381
|
|
393
382
|
[id="plugins-{type}s-{plugin}-ilm_pattern"]
|
@@ -97,10 +97,6 @@ module LogStash; module Outputs; class ElasticSearch
|
|
97
97
|
# Any special characters present in the URLs here MUST be URL escaped! This means `#` should be put in as `%23` for instance.
|
98
98
|
mod.config :hosts, :validate => :uri, :default => [::LogStash::Util::SafeURI.new("//127.0.0.1")], :list => true
|
99
99
|
|
100
|
-
mod.config :flush_size, :validate => :number, :obsolete => "This setting is no longer available as we now try to restrict bulk requests to sane sizes. See the 'Batch Sizes' section of the docs. If you think you still need to restrict payloads based on the number, not size, of events, please open a ticket."
|
101
|
-
|
102
|
-
mod.config :idle_flush_time, :validate => :number, :obsolete => "This settings is no longer valid. This was a no-op now as every pipeline batch is flushed synchronously obviating the need for this option."
|
103
|
-
|
104
100
|
# Set upsert content for update mode.s
|
105
101
|
# Create a new document with this parameter as json string if `document_id` doesn't exists
|
106
102
|
mod.config :upsert, :validate => :string, :default => ""
|
@@ -147,7 +143,7 @@ module LogStash; module Outputs; class ElasticSearch
|
|
147
143
|
# ILM configurations (beta)
|
148
144
|
# -----
|
149
145
|
# Flag for enabling Index Lifecycle Management integration.
|
150
|
-
mod.config :ilm_enabled, :validate => [true, false, 'true', 'false', 'auto'], :default =>
|
146
|
+
mod.config :ilm_enabled, :validate => [true, false, 'true', 'false', 'auto'], :default => 'auto'
|
151
147
|
|
152
148
|
# Rollover alias used for indexing data. If rollover alias doesn't exist, Logstash will create it and map it to the relevant index
|
153
149
|
mod.config :ilm_rollover_alias, :validate => :string, :default => DEFAULT_ROLLOVER_ALIAS
|
@@ -1,6 +1,6 @@
|
|
1
1
|
Gem::Specification.new do |s|
|
2
2
|
s.name = 'logstash-output-elasticsearch'
|
3
|
-
s.version = '
|
3
|
+
s.version = '10.0.1'
|
4
4
|
s.licenses = ['apache-2.0']
|
5
5
|
s.summary = "Stores logs in Elasticsearch"
|
6
6
|
s.description = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
|
@@ -12,7 +12,7 @@ if ESHelper.es_version_satisfies?(">= 5")
|
|
12
12
|
describe "indexing with http_compression turned on", :integration => true do
|
13
13
|
let(:event) { LogStash::Event.new("message" => "Hello World!", "type" => type) }
|
14
14
|
let(:index) { 10.times.collect { rand(10).to_s }.join("") }
|
15
|
-
let(:type) {
|
15
|
+
let(:type) { ESHelper.es_version_satisfies?("< 7") ? "doc" : "_doc" }
|
16
16
|
let(:event_count) { 10000 + rand(500) }
|
17
17
|
let(:events) { event_count.times.map { event }.to_a }
|
18
18
|
let(:config) {
|
@@ -50,8 +50,6 @@ if ESHelper.es_version_satisfies?(">= 5")
|
|
50
50
|
result = LogStash::Json.load(response.body)
|
51
51
|
result["hits"]["hits"].each do |doc|
|
52
52
|
if ESHelper.es_version_satisfies?(">= 6")
|
53
|
-
expect(doc["_type"]).to eq(doc_type)
|
54
|
-
else
|
55
53
|
expect(doc["_type"]).to eq(type)
|
56
54
|
end
|
57
55
|
expect(doc["_index"]).to eq(index)
|
@@ -486,7 +486,7 @@ if ESHelper.es_version_satisfies?(">= 6.6")
|
|
486
486
|
|
487
487
|
if ESHelper.es_version_satisfies?(">=7.0")
|
488
488
|
context 'when Elasticsearch is version 7 or above' do
|
489
|
-
it_behaves_like 'an ILM
|
489
|
+
it_behaves_like 'an ILM enabled Logstash'
|
490
490
|
end
|
491
491
|
end
|
492
492
|
|
@@ -12,7 +12,8 @@ describe "TARGET_BULK_BYTES", :integration => true do
|
|
12
12
|
}
|
13
13
|
}
|
14
14
|
let(:index) { 10.times.collect { rand(10).to_s }.join("") }
|
15
|
-
let(:type) {
|
15
|
+
let(:type) { ESHelper.es_version_satisfies?("< 7") ? "doc" : "_doc" }
|
16
|
+
|
16
17
|
subject { LogStash::Outputs::ElasticSearch.new(config) }
|
17
18
|
|
18
19
|
before do
|
@@ -47,7 +48,7 @@ end
|
|
47
48
|
describe "indexing" do
|
48
49
|
let(:event) { LogStash::Event.new("message" => "Hello World!", "type" => type) }
|
49
50
|
let(:index) { 10.times.collect { rand(10).to_s }.join("") }
|
50
|
-
let(:type) {
|
51
|
+
let(:type) { ESHelper.es_version_satisfies?("< 7") ? "doc" : "_doc" }
|
51
52
|
let(:event_count) { 1 + rand(2) }
|
52
53
|
let(:config) { "not implemented" }
|
53
54
|
let(:events) { event_count.times.map { event }.to_a }
|
@@ -79,8 +80,6 @@ describe "indexing" do
|
|
79
80
|
result = LogStash::Json.load(response.body)
|
80
81
|
result["hits"]["hits"].each do |doc|
|
81
82
|
if ESHelper.es_version_satisfies?(">= 6")
|
82
|
-
expect(doc["_type"]).to eq(doc_type)
|
83
|
-
else
|
84
83
|
expect(doc["_type"]).to eq(type)
|
85
84
|
end
|
86
85
|
expect(doc["_index"]).to eq(index)
|
@@ -125,7 +124,7 @@ describe "indexing" do
|
|
125
124
|
end
|
126
125
|
|
127
126
|
describe "an indexer with no type value set (default to doc)", :integration => true do
|
128
|
-
let(:type) { "doc" }
|
127
|
+
let(:type) { ESHelper.es_version_satisfies?("< 7") ? "doc" : "_doc" }
|
129
128
|
let(:config) {
|
130
129
|
{
|
131
130
|
"hosts" => get_host_port,
|
@@ -1,89 +1,13 @@
|
|
1
1
|
require_relative "../../../spec/es_spec_helper"
|
2
2
|
require "logstash/outputs/elasticsearch"
|
3
3
|
|
4
|
-
if ESHelper.es_version_satisfies?("<= 5.x")
|
5
|
-
context "when using elasticsearch 5.x and before", :integration => true do
|
6
|
-
shared_examples "a type based parent indexer" do
|
7
|
-
let(:index) { 10.times.collect { rand(10).to_s }.join("") }
|
8
|
-
let(:type) { 10.times.collect { rand(10).to_s }.join("") }
|
9
|
-
let(:event_count) { 10000 + rand(500) }
|
10
|
-
let(:parent) { "not_implemented" }
|
11
|
-
let(:config) { "not_implemented" }
|
12
|
-
let(:default_headers) {
|
13
|
-
{"Content-Type" => "application/json"}
|
14
|
-
}
|
15
|
-
subject { LogStash::Outputs::ElasticSearch.new(config) }
|
16
|
-
|
17
|
-
before do
|
18
|
-
# Add mapping and a parent document
|
19
|
-
index_url = "http://#{get_host_port()}/#{index}"
|
20
|
-
mapping = { "mappings" => { "#{type}" => { "_parent" => { "type" => "#{type}_parent" } } } }
|
21
|
-
Manticore.put("#{index_url}", {:body => mapping.to_json, :headers => default_headers}).call
|
22
|
-
pdoc = { "foo" => "bar" }
|
23
|
-
Manticore.put("#{index_url}/#{type}_parent/test", {:body => pdoc.to_json, :headers => default_headers}).call
|
24
|
-
|
25
|
-
subject.register
|
26
|
-
subject.multi_receive(event_count.times.map { LogStash::Event.new("link_to" => "test", "message" => "Hello World!", "type" => type) })
|
27
|
-
end
|
28
|
-
|
29
|
-
|
30
|
-
it "ships events" do
|
31
|
-
index_url = "http://#{get_host_port()}/#{index}"
|
32
|
-
|
33
|
-
Manticore.post("#{index_url}/_refresh").call
|
34
|
-
|
35
|
-
# Wait until all events are available.
|
36
|
-
Stud::try(10.times) do
|
37
|
-
query = { "query" => { "has_parent" => { "type" => "#{type}_parent", "query" => { "match" => { "foo" => "bar" } } } } }
|
38
|
-
response = Manticore.post("#{index_url}/_count", {:body => query.to_json, :headers => default_headers})
|
39
|
-
data = response.body
|
40
|
-
result = LogStash::Json.load(data)
|
41
|
-
cur_count = result["count"]
|
42
|
-
expect(cur_count).to eq(event_count)
|
43
|
-
end
|
44
|
-
end
|
45
|
-
end
|
46
|
-
|
47
|
-
describe "(http protocol) index events with static parent" do
|
48
|
-
it_behaves_like 'a type based parent indexer' do
|
49
|
-
let(:parent) { "test" }
|
50
|
-
let(:config) {
|
51
|
-
{
|
52
|
-
"hosts" => get_host_port,
|
53
|
-
"index" => index,
|
54
|
-
"parent" => parent
|
55
|
-
}
|
56
|
-
}
|
57
|
-
end
|
58
|
-
end
|
59
|
-
|
60
|
-
describe "(http_protocol) index events with fieldref in parent value" do
|
61
|
-
it_behaves_like 'a type based parent indexer' do
|
62
|
-
let(:config) {
|
63
|
-
{
|
64
|
-
"hosts" => get_host_port,
|
65
|
-
"index" => index,
|
66
|
-
"parent" => "%{link_to}"
|
67
|
-
}
|
68
|
-
}
|
69
|
-
end
|
70
|
-
end
|
71
|
-
end
|
72
|
-
end
|
73
|
-
|
74
4
|
if ESHelper.es_version_satisfies?(">= 5.6")
|
75
5
|
context "when using elasticsearch 5.6 and above", :integration => true do
|
76
6
|
|
77
7
|
shared_examples "a join field based parent indexer" do
|
78
8
|
let(:index) { 10.times.collect { rand(10).to_s }.join("") }
|
79
9
|
|
80
|
-
let(:type)
|
81
|
-
if ESHelper.es_version_satisfies?('<7')
|
82
|
-
10.times.collect { rand(10).to_s }.join("")
|
83
|
-
else
|
84
|
-
"_doc"
|
85
|
-
end
|
86
|
-
end
|
10
|
+
let(:type) { ESHelper.es_version_satisfies?("< 7") ? "doc" : "_doc" }
|
87
11
|
|
88
12
|
let(:event_count) { 10000 + rand(500) }
|
89
13
|
let(:parent) { "not_implemented" }
|
@@ -74,25 +74,6 @@ describe LogStash::Outputs::ElasticSearch do
|
|
74
74
|
expect(subject.send(:get_event_type, LogStash::Event.new())).to eql("bar")
|
75
75
|
end
|
76
76
|
end
|
77
|
-
|
78
|
-
context "with a bad type event field in a < 6.0 es cluster" do
|
79
|
-
let(:maximum_seen_major_version) { 5 }
|
80
|
-
let(:type_arg) { ["foo"] }
|
81
|
-
let(:result) { subject.send(:get_event_type, LogStash::Event.new("type" => type_arg)) }
|
82
|
-
|
83
|
-
before do
|
84
|
-
allow(subject.instance_variable_get(:@logger)).to receive(:warn)
|
85
|
-
result
|
86
|
-
end
|
87
|
-
|
88
|
-
it "should call @logger.warn and return nil" do
|
89
|
-
expect(subject.instance_variable_get(:@logger)).to have_received(:warn).with(/Bad event type!/, anything).once
|
90
|
-
end
|
91
|
-
|
92
|
-
it "should set the type to the stringified value" do
|
93
|
-
expect(result).to eql(type_arg.to_s)
|
94
|
-
end
|
95
|
-
end
|
96
77
|
end
|
97
78
|
|
98
79
|
describe "with auth" do
|