microsoft-sentinel-log-analytics-logstash-output-plugin 2.2.1-java → 2.3.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea487790648bd37da80785720d41eba04d6e25d26b51acd4dedaae12d4df788e
-  data.tar.gz: 2c5e07886e64407c588ebae4d080796ae83e4a5c24a6dd287cc91a8858e1bea4
+  metadata.gz: c28843f943eb0d0a6d882489496b7925807b6297afdfa3a50c502bf9acebe220
+  data.tar.gz: 2a43af3450ce0fa1842fb9a9daf61059a3b4576387daa9c244c04c0115e19907
 SHA512:
-  metadata.gz: 0a76b54722684ef96a897363bfe0b2104dc14c99ef7e196585a8e6ae2e03606e330c16ece586a262148a41cfee41797304ec8ecde13cdc3839005645b808d79c
-  data.tar.gz: d18a87da9ac8d7b5f19c3be49744d0ed7051b343fda7a8dc9dbb52c4f88c3c83dcb81310cbae590c910f0a2adb539c5dfe8ed4118303f4f24eb5969c7fe248a2
+  metadata.gz: e5c128d254f06c88fcd5f492a30c65cee0de83ad1a2eb98c49f9268db3c2f1109541e821054cbed38759ca906831ca0726510702968e78f2e3a5d77262e8b5e0
+  data.tar.gz: 0b8c115c9c082fa9a759e046df413cd30c663ec355789e87469ab9bed77a769021b91ffd93c4201570aa6e181a2f92f384287b4cf68925ec22d9b286d89d7bd0

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 2.3.2
+- Fixed silent worker thread death caused by uncaught exceptions in worker processing loop.
+- Fixed NullPointerException in SenderWorker when Azure returns a LogsUploadException with a null HTTP response.
+- Added resilient error handling with consecutive error tracking to reduce permanent worker failure.
+
+## 2.3.1
+- Added optional Id configuration value for telemetry.
+- Added DCR stream to sent-batches logging.
+
+## 2.3.0
+- Enabled functionality with logstash 9.4.
+
+## 2.2.2
+- Bumped dependency versions for external libraries (azure-sdk-bom, logback, slf4j, Netty).
+
 ## 2.2.1
 - Adds info-level logging line when batches are successfully sent.
 
@@ -5,7 +20,7 @@
 - Adds ability to use either new or old configuration values.
 
 ## 2.1.2
-- Documentation updates
+- Documentation updates.
 
 ## 2.1.1
 - Improved efficiency.

data/README.md

@@ -3,8 +3,8 @@
 Microsoft Sentinel provides a new output plugin for Logstash. Use this output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics workspace. This is done with the Log Analytics DCR-based API.
 You may send logs to custom or standard tables.  
 
-Plugin version: v2.2.1  
-Released on: 2026-05-27  
+Plugin version: v2.3.2  
+Released on: 2026-06-23  
 
 This plugin is currently in development and is free to use. We request and appreciate feedback from users.  
 
@@ -19,7 +19,7 @@ This plugin is currently in development and is free to use. We request and appre
 
 Microsoft Sentinel provides Logstash output plugin to Log analytics workspace using DCR based logs API.  
 
-The plugin is published on [RubyGems](https://rubygems.org/gems/microsoft-sentinel-log-analytics-logstash-output-plugin). To install to an existing logstash installation, run `logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin`.  
+The plugin is published on [RubyGems](https://rubygems.org/gems/microsoft-sentinel-log-analytics-logstash-output-plugin/versions/2.2.2-java). To install to an existing logstash installation, run `logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin`.  
 
 If you do not have a direct internet connection, you can install the plugin to another logstash installation, and then export and import a plugin bundle to the offline host. For more information, see [Logstash Offline Plugin Management instruction](<https://www.elastic.co/guide/en/logstash/current/offline-plugins.html>).  
 
@@ -32,6 +32,7 @@ Microsoft Sentinel's Logstash output plugin supports the following versions
 - 9.1.10 (NOTE: this version requires a security update, according to Logstash!)  
 - 9.2.4 - 9.2.5 (NOTE: these versions require a security update, according to Logstash! [Security Update](https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816))  
 - 9.3.3
+- 9.4.0
 
 Please note that when using Logstash 8, it is recommended to disable ECS in the pipeline. For more information refer to [Logstash documentation.](<https://www.elastic.co/guide/en/logstash/8.4/ecs-ls.html>)  
 
@@ -95,15 +96,13 @@ To configure Microsoft Sentinel Logstash plugin you first need to create the DCR
 
 *Note:* The identity (service principal or managed identity) must have the **Monitoring Metrics Publisher** role on the target DCR:  
 
-    ```
     az role assignment create \
       --assignee <object-id-of-identity> \
       --role "Monitoring Metrics Publisher" \
       --scope "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Insights/dataCollectionRules/<dcr-name>"
-    ```
 
 
-## 4. Configure the Output Plugin
+## 4. Configure Logstash configuration file
 
 Add the `microsoft-sentinel-log-analytics-logstash-output-plugin` block to the `output` section of your Logstash configuration file (e.g., `logstash.conf`). The plugin requires three values from your Azure DCR resources plus authentication credentials depending on your method.  
 
@@ -125,7 +124,6 @@ The plugin auto-detects the auth method based on which config values are present
 
 Provide `client_id`, `client_secret`, and `tenant_id` for your Azure App Registration / service principal.  
 
-    ```
     output {
       microsoft-sentinel-log-analytics-logstash-output-plugin {
         data_collection_endpoint => "https://<your-dce-name>.<region>.ingest.monitor.azure.com"
@@ -136,14 +134,12 @@ Provide `client_id`, `client_secret`, and `tenant_id` for your Azure App Registr
         tenant_id                => "<your-azure-tenant-id>"
       }
     }
-    ```
 
 
 #### Option 2: Managed Identity
 
 When running on an Azure VM with a system-assigned managed identity, omit `client_id`, `client_secret`, and `tenant_id`. The plugin will automatically use the VM's managed identity.  
 
-    ```
     output {
       microsoft-sentinel-log-analytics-logstash-output-plugin {
         data_collection_endpoint => "https://<your-dce-name>.<region>.ingest.monitor.azure.com"
@@ -151,13 +147,11 @@ When running on an Azure VM with a system-assigned managed identity, omit `clien
         stream_name              => "Custom-MyTableRawData_CL"
       }
     }
-    ```
 
 #### Option 3: Client Secret + Sovereign Cloud
 
 To authenticate against a sovereign cloud, add `azure_cloud`. Supported values: `AzurePublicCloud` (default), `AzureUSGovernment`, `AzureChinaCloud`, `AzureGermanyCloud`.  
 
-    ```
     output {
       microsoft-sentinel-log-analytics-logstash-output-plugin {
         data_collection_endpoint => "https://<your-dce-ingestion-endpoint>"
@@ -169,11 +163,9 @@ To authenticate against a sovereign cloud, add `azure_cloud`. Supported values:
         azure_cloud              => "AzureUSGovernment"
       }
     }
-    ```
 
 #### Option 4: Managed Identity + Sovereign Cloud
 
-    ```
     output {
       microsoft-sentinel-log-analytics-logstash-output-plugin {
         data_collection_endpoint => "https://<your-dce-ingestion-endpoint>"
@@ -182,7 +174,6 @@ To authenticate against a sovereign cloud, add `azure_cloud`. Supported values:
         azure_cloud              => "AzureUSGovernment"
       }
     }
-    ```
 ---
 Security notice: We recommend not to implicitly state client_id, client_secret, tenant_id, data_collection_endpoint, and dcr_id in your Logstash configuration for security reasons.  
                  It is best to store this sensitive information in a Logstash KeyStore as described here- ['Secrets Keystore'](<https://www.elastic.co/guide/en/logstash/current/keystore.html>)  
@@ -193,7 +184,6 @@ Security notice: We recommend not to implicitly state client_id, client_secret,
 
 A complete `logstash.conf` using client secret auth with a Beats input:  
 
-    ```
     input {
       beats {
         port => 5044
@@ -213,7 +203,6 @@ A complete `logstash.conf` using client secret auth with a Beats input:
         tenant_id                => "72f988bf-86f1-41af-91ab-xxxxxxxxxxxx"
       }
     }
-    ```
 ---
 
 ## Optional Config Values
@@ -234,18 +223,17 @@ A complete `logstash.conf` using client secret auth with a Beats input:
 | `batcher_workers_count` | *(auto)* | Number of batcher threads |  
 | `sender_workers_count` | *(auto)* | Number of sender threads |  
 | `unifier_workers_count` | *(auto)* | Number of unifier threads |  
+| `id` | `None` | A custom identification tag to be added to sent-batches logs |  
 
 ## Known issues
  
 When using Logstash installed on a Docker image of Lite Ubuntu, the following warning may appear:  
 
-    ```
     java.lang.RuntimeException: getprotobyname_r failed
-    ```
 
 To resolve it, use the following commands to install the *netbase* package within your Dockerfile:  
     ```
     USER root
     RUN apt install netbase -y
-    ```
+    ```  
 For more information, see [JNR regression in Logstash 7.17.0 (Docker)](https://github.com/elastic/logstash/issues/13703).  

data/VERSION

@@ -1 +1 @@
-2.2.1
+2.3.2

data/lib/logstash/outputs/microsoft-sentinel-log-analytics-logstash-output-plugin.rb

@@ -1,7 +1,14 @@
 # AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
 # encoding: utf-8
-
-# NOTE: Java plugin (no Ruby plugin class). This file exists only to ensure
-# jar-dependencies loads the packaged jar into JRuby's classpath.
-require "logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin_jars"
+require "logstash/outputs/base"
+require "logstash/namespace"
+require "microsoft-sentinel-log-analytics-logstash-output-plugin_jars"
 require "java"
+
+class LogStash::Outputs::MicrosoftSentinelLogAnalyticsLogstashOutputPlugin < LogStash::Outputs::Base
+  config_name "microsoft-sentinel-log-analytics-logstash-output-plugin"
+
+  def self.javaClass
+    Java::org.logstashplugins.MicrosoftSentinelLogAnalyticsLogstashOutputPlugin.java_class
+  end
+end

data/lib/logstash_registry.rb

@@ -1,4 +1,18 @@
 # AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
 # encoding: utf-8
-require "logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin_jars"
-require "java"
+require "logstash/plugins/registry"
+
+# Workaround for elastic/logstash registry.rb#is_a_plugin? not handling
+# Java plugin classes whose name uses dashes. Strip both '-' and '_'.
+LogStash::Plugins::Registry.class_eval do
+  define_method(:is_a_plugin?) do |klass, name|
+    if klass.class == Java::JavaLang::Class
+      klass.simple_name.downcase == name.gsub(/[-_]/, '')
+    else
+      klass.ancestors.include?(LogStash::Plugin) && klass.respond_to?(:config_name) && klass.config_name == name
+    end
+  end
+end
+
+require "logstash/outputs/microsoft-sentinel-log-analytics-logstash-output-plugin"
+LogStash::PLUGIN_REGISTRY.add(:output, "microsoft-sentinel-log-analytics-logstash-output-plugin", LogStash::Outputs::MicrosoftSentinelLogAnalyticsLogstashOutputPlugin)

data/lib/microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb

@@ -0,0 +1,5 @@
+# AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
+# encoding: utf-8
+
+require 'jar_dependencies'
+require_jar('org.logstashplugins', 'microsoft-sentinel-log-analytics-logstash-output-plugin', '2.3.2')

data/logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec

@@ -1,7 +1,7 @@
 # AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
 Gem::Specification.new do |s|
   s.name            = 'microsoft-sentinel-log-analytics-logstash-output-plugin'
-  s.version         = '2.2.1'
+  s.version         = '2.3.2'
   s.licenses        = ['Apache-2.0']
   s.summary         = 'Microsoft Sentinel Log Analytics output plugin'
   s.description     = 'Microsoft Sentinel provides a new output plugin for Logstash. Use this output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics workspace. This is done with the Log Analytics DCR-based API.'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: microsoft-sentinel-log-analytics-logstash-output-plugin
 version: !ruby/object:Gem::Version
-  version: 2.2.1
+  version: 2.3.2
 platform: java
 authors:
 - Microsoft
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-27 00:00:00.000000000 Z
+date: 2026-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -71,11 +71,11 @@ files:
 - Gemfile
 - README.md
 - VERSION
-- lib/logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb
 - lib/logstash/outputs/microsoft-sentinel-log-analytics-logstash-output-plugin.rb
 - lib/logstash_registry.rb
+- lib/microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb
 - logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec
-- vendor/jar-dependencies/org/logstashplugins/logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin/2.2.1/logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin-2.2.1.jar
+- vendor/jar-dependencies/org/logstashplugins/microsoft-sentinel-log-analytics-logstash-output-plugin/2.3.2/microsoft-sentinel-log-analytics-logstash-output-plugin-2.3.2.jar
 homepage:
 licenses:
 - Apache-2.0

data/lib/logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb

@@ -1,5 +0,0 @@
-# AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
-# encoding: utf-8
-
-require 'jar_dependencies'
-require_jar('org.logstashplugins', 'logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin', '2.2.1')