microsoft-sentinel-log-analytics-logstash-output-plugin 2.4.0-java → 2.5.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 52fc2d58edeab5e2a9d529828781d2f958a33c145c46ef05587a65407ea2e551
-  data.tar.gz: 781cf13f7ac5e4964cd3d628c8261b01034d31d0b8d03100d410f99690788a6d
+  metadata.gz: 4702fd72d471cd82239eeaa30f8c379a1ad7830c77321a388a60c98eddd25f58
+  data.tar.gz: 8eb5c632bd0875e3c305ff9879b87c29e798b720988c836efb2b4c1a9bb46d2a
 SHA512:
-  metadata.gz: 63dba7974498e08c48d04c410c2cafb3f6e37c7e2b7e52a9a43fe88c581a4eb686324e69fcb84cad5e79c4533f85165edd4d142823bc35acd9e76b2ec1d08e56
-  data.tar.gz: 27288003dce4595b3c81a22a7685d1684d74a91b153dcf46814ef7204a6a94fcc2edc54f9248bd50a96b6434a15416628b8f1590ea30357857605c02b69ec7b1
+  metadata.gz: 91c4e36abe689d0ce4498089a3678ac890c5c8cc9426ee6d2e96f14755df9926f2fa24e725bdf6642e7b06dff7debcc7bd4ca27323b24644f530e78bb349c44f
+  data.tar.gz: d47ee51b3c8b7013b2bbc63866cf525bda38a4de0f12ce7fc834fd5612a8852bdc64def2e3cd0ecd87d2a941acc25481ea4923b880289253d42cc8508a9343cb

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 2.5.1
+- Restricted `data_collection_endpoint` to HTTPS Azure Monitor ingestion hosts for the configured Azure cloud.
+- Fixed sovereign-cloud ingestion authentication by selecting the Azure Monitor token audience that matches `azure_cloud`.
+- Added detailed Azure Monitor upload failure telemetry, including inner HTTP status codes, service error details, request IDs, and the SDK-reported failed-log count.
+
+## 2.5.0
+- Added optional per-plugin proxy configuration for authentication and ingestion traffic using `proxy`, `proxy_aad`, and `proxy_endpoint`.
+- Updated Netty handler, HTTP, HTTP/2, and DNS components to 4.1.136.Final.
+- Updated Jackson Databind and Jackson Core to 2.18.8.
+
 ## 2.4.0
 - Worker threads now run as bounded, executor-scheduled passes: recoverable exceptions are logged and the worker resumes on the next cycle; fatal JVM errors are logged and re-thrown.
 - Fixed graceful shutdown so in-flight batches are drained (batchers, then unifiers, then senders) before workers stop, bounded by `max_graceful_shutdown_time_seconds`.
@@ -35,4 +45,7 @@
 
 ## 2.0.0
 - Refactored the plugin from Ruby to Java.
-- Added ManagedIdentity authentication.
+- Added ManagedIdentity authentication.
+
+## 1.x.x (Ruby - deprecated)
+The 1.x.x releases are the deprecated Ruby version of this plugin. For the 1.x.x changelog and documentation, see [microsoft-sentinel-log-analytics-logstash-output-plugin](../microsoft-sentinel-log-analytics-logstash-output-plugin/CHANGELOG.md).

data/README.md

@@ -3,8 +3,9 @@
 Microsoft Sentinel provides a new output plugin for Logstash. Use this output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics workspace. This is done with the Log Analytics DCR-based API.
 You may send logs to custom or standard tables.  
 
-Plugin version: v2.3.3  
-Released on: 2026-07-02  
+Plugin version: v2.5.1
+
+Released on: 2026-09-10
 
 This plugin is currently in development and is free to use. We request and appreciate feedback from users.  
 
@@ -19,7 +20,7 @@ This plugin is currently in development and is free to use. We request and appre
 
 Microsoft Sentinel provides Logstash output plugin to Log analytics workspace using DCR based logs API.  
 
-The plugin is published on [RubyGems](https://rubygems.org/gems/microsoft-sentinel-log-analytics-logstash-output-plugin/versions/2.2.2-java). To install to an existing logstash installation, run `logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin`.  
+The plugin is published on [RubyGems](https://rubygems.org/gems/microsoft-sentinel-log-analytics-logstash-output-plugin/versions/2.5.1-java). To install to an existing logstash installation, run `logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin`.
 
 If you do not have a direct internet connection, you can install the plugin to another logstash installation, and then export and import a plugin bundle to the offline host. For more information, see [Logstash Offline Plugin Management instruction](<https://www.elastic.co/guide/en/logstash/current/offline-plugins.html>).  
 
@@ -55,7 +56,7 @@ Note: make sure that the path exists before creating the sample file.
 ### Configurations:
 The following parameters are optional and should be used to create a sample file.  
 - **create_sample_file** - Boolean, False by default. When enabled, up to 10 events will be written to a sample json file.  
-- **sample_file_path** - Number, Empty by default. Required when create_sample_file is enabled. Should include a valid path in which to place the sample file generated.  
+- **sample_file_path** - String, Empty by default. Required when create_sample_file is enabled. Should include a valid path in which to place the sample file generated.  
 
 ### Complete example
 1. set the pipeline.conf with the following configuration:  
@@ -114,6 +115,19 @@ Add the `microsoft-sentinel-log-analytics-logstash-output-plugin` block to the `
 | `dcr_id` | The immutable ID of your Data Collection Rule |  
 | `stream_name` | The stream name from your DCR (e.g., `Custom-MyTableRawData_CL`) |  
 
+`data_collection_endpoint` must use HTTPS and must match the selected
+`azure_cloud`:
+
+| Azure cloud | Required endpoint host suffix |
+|---|---|
+| `AzurePublicCloud` | `.ingest.monitor.azure.com` |
+| `AzureUSGovernment` | `.ingest.monitor.azure.us` |
+| `AzureChinaCloud` | `.ingest.monitor.azure.cn` |
+| `AzureGermanyCloud` | `.ingest.monitor.azure.de` |
+
+User information, ports other than 443, non-root paths, query strings, and fragments
+are not accepted in the endpoint URL.
+
 ---
 
 ### Authentication Examples
@@ -150,7 +164,7 @@ When running on an Azure VM with a system-assigned managed identity, omit `clien
 
 #### Option 3: Client Secret + Sovereign Cloud
 
-To authenticate against a sovereign cloud, add `azure_cloud`. Supported values: `AzurePublicCloud` (default), `AzureUSGovernment`, `AzureChinaCloud`, `AzureGermanyCloud`.  
+To authenticate against a sovereign cloud, add `azure_cloud`. Supported values: `AzurePublicCloud` (default), `AzureUSGovernment`, `AzureChinaCloud`, `AzureGermanyCloud`. The plugin uses this value for both the Microsoft Entra authority and the Azure Monitor Logs Ingestion token audience.
 
     output {
       microsoft-sentinel-log-analytics-logstash-output-plugin {
@@ -210,6 +224,9 @@ A complete `logstash.conf` using client secret auth with a Beats input:
 | Key | Default | Description |  
 |---|---|---|  
 | `azure_cloud` | `AzurePublicCloud` | Azure cloud environment |  
+| `proxy` | *(none)* | Optional. Base HTTP proxy URL applied to all plugin traffic. Format: `[http://][user:password@]host:port`. When unset, no proxy is used and behavior is unchanged |  
+| `proxy_aad` | *(value of `proxy`)* | Optional. HTTP proxy URL used only for Microsoft Entra ID (AAD) authentication/token traffic. Falls back to `proxy` when unset |  
+| `proxy_endpoint` | *(value of `proxy`)* | Optional. HTTP proxy URL used only for traffic to the Data Collection Endpoint. Falls back to `proxy` when unset |  
 | `keys_to_keep` | *(all)* | Array of field names to send (subset filtering) |  
 | `max_retries_num` | `3` | Max retry attempts for failed sends |  
 | `initial_wait_time_seconds` | `1` | Initial backoff between retries |  
@@ -227,6 +244,34 @@ A complete `logstash.conf` using client secret auth with a Beats input:
 | `unifier_workers_count` | *(auto)* | Number of unifier threads |  
 | `id` | `None` | A custom identification tag to be added to sent-batches logs |  
 
+### Proxy configuration
+
+The proxy settings are **optional** and scoped to this plugin only. If you do not set any of them, the plugin behaves exactly as before and sends traffic directly (no proxy). This is useful when a single Logstash instance has multiple outputs and only the Microsoft Sentinel output needs to traverse a corporate proxy.
+
+- `proxy` — base proxy applied to both authentication and ingestion traffic.
+- `proxy_aad` — overrides the proxy used for Microsoft Entra ID (AAD) token requests; falls back to `proxy`.
+- `proxy_endpoint` — overrides the proxy used for Data Collection Endpoint traffic; falls back to `proxy`.
+
+Proxy URLs use the format `[http://][user:password@]host:port`. The scheme is optional and defaults to `http`; both host and port are required. Example:
+
+    output {
+      microsoft-sentinel-log-analytics-logstash-output-plugin {
+        data_collection_endpoint => "https://my-dce.eastus2-1.ingest.monitor.azure.com"
+        dcr_id                   => "dcr-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        stream_name              => "Custom-MyTableRawData_CL"
+        client_id                => "<your-app-client-id>"
+        client_secret            => "<your-app-client-secret>"
+        tenant_id                => "<your-azure-tenant-id>"
+        proxy                    => "http://proxyhost:8080"
+      }
+    }
+
+Security note: if your proxy requires credentials, store them in the Logstash KeyStore rather than placing them in plaintext in the configuration file.
+
+## Troubleshooting upload failures
+
+Starting with version 2.5.1, Azure Monitor upload failure logs include the inner HTTP status, Azure service error code and message, `x-ms-request-id`, `x-ms-client-request-id`, and the SDK-reported failed-log count. Event payloads and failed event contents are not written to the logs.
+
 ## Known issues
  
 When using Logstash installed on a Docker image of Lite Ubuntu, the following warning may appear:  

data/VERSION

@@ -1 +1 @@
-2.4.0
+2.5.1

data/lib/microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb

@@ -2,4 +2,4 @@
 # encoding: utf-8
 
 require 'jar_dependencies'
-require_jar('org.logstashplugins', 'microsoft-sentinel-log-analytics-logstash-output-plugin', '2.4.0')
+require_jar('org.logstashplugins', 'microsoft-sentinel-log-analytics-logstash-output-plugin', '2.5.1')

data/logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec

@@ -1,7 +1,7 @@
 # AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
 Gem::Specification.new do |s|
   s.name            = 'microsoft-sentinel-log-analytics-logstash-output-plugin'
-  s.version         = '2.4.0'
+  s.version         = '2.5.1'
   s.licenses        = ['Apache-2.0']
   s.summary         = 'Microsoft Sentinel Log Analytics output plugin'
   s.description     = 'Microsoft Sentinel provides a new output plugin for Logstash. Use this output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics workspace. This is done with the Log Analytics DCR-based API.'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: microsoft-sentinel-log-analytics-logstash-output-plugin
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.5.1
 platform: java
 authors:
 - Microsoft
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-10 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -75,7 +75,7 @@ files:
 - lib/logstash_registry.rb
 - lib/microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb
 - logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec
-- vendor/jar-dependencies/org/logstashplugins/microsoft-sentinel-log-analytics-logstash-output-plugin/2.4.0/microsoft-sentinel-log-analytics-logstash-output-plugin-2.4.0.jar
+- vendor/jar-dependencies/org/logstashplugins/microsoft-sentinel-log-analytics-logstash-output-plugin/2.5.1/microsoft-sentinel-log-analytics-logstash-output-plugin-2.5.1.jar
 homepage:
 licenses:
 - Apache-2.0