microsoft-sentinel-log-analytics-logstash-output-plugin 2.5.0-java → 2.5.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9de662d1b2a1b355e807bc3eb0ffb51dcf40e62b4e0f2a1c0b36477624a8b73
-  data.tar.gz: 3be11c0d54fc160d88ebecf8d9bf0821faf286dbc82af1934149698515699204
+  metadata.gz: 4702fd72d471cd82239eeaa30f8c379a1ad7830c77321a388a60c98eddd25f58
+  data.tar.gz: 8eb5c632bd0875e3c305ff9879b87c29e798b720988c836efb2b4c1a9bb46d2a
 SHA512:
-  metadata.gz: 2a206bc526a9068cfb35872399769e5da7dcd022b151f1459fec2c87db4704c986bfb168be497bf108fe085b296f0df2d44c1fc40fab03b7c7bc8cf075170ab1
-  data.tar.gz: c70d3cdf492dff244f511c35b720f96b6b7a1d0ac9c4e3b9bf9356b4c08314961a55fb3a08a4f3ab744f8a50e1d2d403660b0e9817d808788409ed59dfdd3f7f
+  metadata.gz: 91c4e36abe689d0ce4498089a3678ac890c5c8cc9426ee6d2e96f14755df9926f2fa24e725bdf6642e7b06dff7debcc7bd4ca27323b24644f530e78bb349c44f
+  data.tar.gz: d47ee51b3c8b7013b2bbc63866cf525bda38a4de0f12ce7fc834fd5612a8852bdc64def2e3cd0ecd87d2a941acc25481ea4923b880289253d42cc8508a9343cb

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 2.5.1
+- Restricted `data_collection_endpoint` to HTTPS Azure Monitor ingestion hosts for the configured Azure cloud.
+- Fixed sovereign-cloud ingestion authentication by selecting the Azure Monitor token audience that matches `azure_cloud`.
+- Added detailed Azure Monitor upload failure telemetry, including inner HTTP status codes, service error details, request IDs, and the SDK-reported failed-log count.
+
 ## 2.5.0
 - Added optional per-plugin proxy configuration for authentication and ingestion traffic using `proxy`, `proxy_aad`, and `proxy_endpoint`.
 - Updated Netty handler, HTTP, HTTP/2, and DNS components to 4.1.136.Final.

data/README.md

@@ -3,8 +3,9 @@
 Microsoft Sentinel provides a new output plugin for Logstash. Use this output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics workspace. This is done with the Log Analytics DCR-based API.
 You may send logs to custom or standard tables.  
 
-Plugin version: v2.5.0  
-Released on: 2026-08-04  
+Plugin version: v2.5.1
+
+Released on: 2026-09-10
 
 This plugin is currently in development and is free to use. We request and appreciate feedback from users.  
 
@@ -19,7 +20,7 @@ This plugin is currently in development and is free to use. We request and appre
 
 Microsoft Sentinel provides Logstash output plugin to Log analytics workspace using DCR based logs API.  
 
-The plugin is published on [RubyGems](https://rubygems.org/gems/microsoft-sentinel-log-analytics-logstash-output-plugin/versions/2.5.0-java). To install to an existing logstash installation, run `logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin`.  
+The plugin is published on [RubyGems](https://rubygems.org/gems/microsoft-sentinel-log-analytics-logstash-output-plugin/versions/2.5.1-java). To install to an existing logstash installation, run `logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin`.
 
 If you do not have a direct internet connection, you can install the plugin to another logstash installation, and then export and import a plugin bundle to the offline host. For more information, see [Logstash Offline Plugin Management instruction](<https://www.elastic.co/guide/en/logstash/current/offline-plugins.html>).  
 
@@ -114,6 +115,19 @@ Add the `microsoft-sentinel-log-analytics-logstash-output-plugin` block to the `
 | `dcr_id` | The immutable ID of your Data Collection Rule |  
 | `stream_name` | The stream name from your DCR (e.g., `Custom-MyTableRawData_CL`) |  
 
+`data_collection_endpoint` must use HTTPS and must match the selected
+`azure_cloud`:
+
+| Azure cloud | Required endpoint host suffix |
+|---|---|
+| `AzurePublicCloud` | `.ingest.monitor.azure.com` |
+| `AzureUSGovernment` | `.ingest.monitor.azure.us` |
+| `AzureChinaCloud` | `.ingest.monitor.azure.cn` |
+| `AzureGermanyCloud` | `.ingest.monitor.azure.de` |
+
+User information, ports other than 443, non-root paths, query strings, and fragments
+are not accepted in the endpoint URL.
+
 ---
 
 ### Authentication Examples
@@ -150,7 +164,7 @@ When running on an Azure VM with a system-assigned managed identity, omit `clien
 
 #### Option 3: Client Secret + Sovereign Cloud
 
-To authenticate against a sovereign cloud, add `azure_cloud`. Supported values: `AzurePublicCloud` (default), `AzureUSGovernment`, `AzureChinaCloud`, `AzureGermanyCloud`.  
+To authenticate against a sovereign cloud, add `azure_cloud`. Supported values: `AzurePublicCloud` (default), `AzureUSGovernment`, `AzureChinaCloud`, `AzureGermanyCloud`. The plugin uses this value for both the Microsoft Entra authority and the Azure Monitor Logs Ingestion token audience.
 
     output {
       microsoft-sentinel-log-analytics-logstash-output-plugin {
@@ -254,6 +268,10 @@ Proxy URLs use the format `[http://][user:password@]host:port`. The scheme is op
 
 Security note: if your proxy requires credentials, store them in the Logstash KeyStore rather than placing them in plaintext in the configuration file.
 
+## Troubleshooting upload failures
+
+Starting with version 2.5.1, Azure Monitor upload failure logs include the inner HTTP status, Azure service error code and message, `x-ms-request-id`, `x-ms-client-request-id`, and the SDK-reported failed-log count. Event payloads and failed event contents are not written to the logs.
+
 ## Known issues
  
 When using Logstash installed on a Docker image of Lite Ubuntu, the following warning may appear:  

data/VERSION

@@ -1 +1 @@
-2.5.0
+2.5.1

data/lib/microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb

@@ -2,4 +2,4 @@
 # encoding: utf-8
 
 require 'jar_dependencies'
-require_jar('org.logstashplugins', 'microsoft-sentinel-log-analytics-logstash-output-plugin', '2.5.0')
+require_jar('org.logstashplugins', 'microsoft-sentinel-log-analytics-logstash-output-plugin', '2.5.1')

data/logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec

@@ -1,7 +1,7 @@
 # AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
 Gem::Specification.new do |s|
   s.name            = 'microsoft-sentinel-log-analytics-logstash-output-plugin'
-  s.version         = '2.5.0'
+  s.version         = '2.5.1'
   s.licenses        = ['Apache-2.0']
   s.summary         = 'Microsoft Sentinel Log Analytics output plugin'
   s.description     = 'Microsoft Sentinel provides a new output plugin for Logstash. Use this output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics workspace. This is done with the Log Analytics DCR-based API.'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: microsoft-sentinel-log-analytics-logstash-output-plugin
 version: !ruby/object:Gem::Version
-  version: 2.5.0
+  version: 2.5.1
 platform: java
 authors:
 - Microsoft
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-04 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -75,7 +75,7 @@ files:
 - lib/logstash_registry.rb
 - lib/microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb
 - logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec
-- vendor/jar-dependencies/org/logstashplugins/microsoft-sentinel-log-analytics-logstash-output-plugin/2.5.0/microsoft-sentinel-log-analytics-logstash-output-plugin-2.5.0.jar
+- vendor/jar-dependencies/org/logstashplugins/microsoft-sentinel-log-analytics-logstash-output-plugin/2.5.1/microsoft-sentinel-log-analytics-logstash-output-plugin-2.5.1.jar
 homepage:
 licenses:
 - Apache-2.0