ucp-logstash-pipeline-test 0.1.1-java

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: d41c9c9d867b814d7e66ac047d36621c1d7b0842c137e625bbc674209eb8ebe8
+  data.tar.gz: 568a5b601009b575883923a4d6a539b66b2f11184f8dbcfb98624bf24c556e17
+SHA512:
+  metadata.gz: d4d90723426f9a197aeaaae0509ad4c6c90e10088821baf2aaf29901c5285e74cc68ebaea26a378e8eb76252e9deebc5492fac97f7b7cead362082807a379c89
+  data.tar.gz: 5d7a33e886b7127b3f253a0e383c958da76bc625dc7594809a4e91a528ba3d530520aecb6ce5fa65ea4c9b5d0d696590cb002f36ee40eda89b325e867ef9b910

data/CHANGELOG.md

@@ -0,0 +1,46 @@
+## 2.5.0
+- Added optional per-plugin proxy configuration for authentication and ingestion traffic using `proxy`, `proxy_aad`, and `proxy_endpoint`.
+- Updated Netty handler, HTTP, HTTP/2, and DNS components to 4.1.136.Final.
+- Updated Jackson Databind and Jackson Core to 2.18.8.
+
+## 2.4.0
+- Worker threads now run as bounded, executor-scheduled passes: recoverable exceptions are logged and the worker resumes on the next cycle; fatal JVM errors are logged and re-thrown.
+- Fixed graceful shutdown so in-flight batches are drained (batchers, then unifiers, then senders) before workers stop, bounded by `max_graceful_shutdown_time_seconds`.
+- Added configurable upload timeouts `connect_timeout_seconds` (default `15`) and `write_timeout_seconds` (default `60`); connect/write timeouts are retried.
+- Added thread id, exception type, batch size, and DCR stream to batch failure logs.
+
+## 2.3.3
+- Fixed loss of numeric and boolean type fidelity: fields backed by Logstash's internal JRuby types (e.g. ports, byte counts) are now preserved as native JSON numbers/booleans instead of being converted to strings, ensuring reliable ingestion into DCRs with typed columns.
+
+## 2.3.2
+- Fixed silent worker thread death caused by uncaught exceptions in worker processing loop.
+- Fixed NullPointerException in SenderWorker when Azure returns a LogsUploadException with a null HTTP response.
+- Added resilient error handling with consecutive error tracking to reduce permanent worker failure.
+- Added optional Id configuration value for telemetry.
+- Added DCR stream to sent-batches logging.
+
+## 2.3.0
+- Enabled functionality with logstash 9.4.
+- Bumped dependency versions for external libraries (azure-sdk-bom, logback, slf4j, Netty).
+
+## 2.2.1
+- Adds info-level logging line when batches are successfully sent.
+
+## 2.2.0
+- Adds ability to use either new or old configuration values.
+
+## 2.1.2
+- Documentation updates.
+
+## 2.1.1
+- Improved efficiency.
+
+## 2.1.0
+- Fixed event normalization.
+
+## 2.0.0
+- Refactored the plugin from Ruby to Java.
+- Added ManagedIdentity authentication.
+
+## 1.x.x (Ruby - deprecated)
+The 1.x.x releases are the deprecated Ruby version of this plugin. For the 1.x.x changelog and documentation, see [microsoft-sentinel-log-analytics-logstash-output-plugin](../microsoft-sentinel-log-analytics-logstash-output-plugin/CHANGELOG.md).

data/Gemfile

@@ -0,0 +1,12 @@
+# AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
+source 'https://rubygems.org'
+
+gemspec
+
+logstash_path = ENV["LOGSTASH_PATH"] || "../../logstash"
+use_logstash_source = ENV["LOGSTASH_SOURCE"] && ENV["LOGSTASH_SOURCE"].to_s == "1"
+
+if Dir.exist?(logstash_path) && use_logstash_source
+  gem 'logstash-core', :path => "#{logstash_path}/logstash-core"
+  gem 'logstash-core-plugin-api', :path => "#{logstash_path}/logstash-core-plugin-api"
+end

data/README.md

@@ -0,0 +1,268 @@
+# Microsoft Sentinel Output Plugin for Logstash 
+
+Microsoft Sentinel provides a new output plugin for Logstash. Use this output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics workspace. This is done with the Log Analytics DCR-based API.
+You may send logs to custom or standard tables.  
+
+Plugin version: v2.5.0  
+Released on: 2026-08-04  
+
+This plugin is currently in development and is free to use. We request and appreciate feedback from users.  
+
+## Installation Instructions
+1) Install the plugin  
+2) Create a sample file  
+3) Create the required DCR-related resources  
+4) Configure Logstash configuration file  
+
+
+## 1. Install the plugin
+
+Microsoft Sentinel provides Logstash output plugin to Log analytics workspace using DCR based logs API.  
+
+The plugin is published on [RubyGems](https://rubygems.org/gems/microsoft-sentinel-log-analytics-logstash-output-plugin/versions/2.5.0-java). To install to an existing logstash installation, run `logstash-plugin install microsoft-sentinel-log-analytics-logstash-output-plugin`.  
+
+If you do not have a direct internet connection, you can install the plugin to another logstash installation, and then export and import a plugin bundle to the offline host. For more information, see [Logstash Offline Plugin Management instruction](<https://www.elastic.co/guide/en/logstash/current/offline-plugins.html>).  
+
+Microsoft Sentinel's Logstash output plugin supports the following versions  
+- 7.0 - 7.17.13  
+- 8.0 - 8.9 (NOTE: these versions require a security update, according to Logstash!)  
+- 8.11 - 8.15 (NOTE: these versions require a security update, according to Logstash!)  
+- 8.19.2 (NOTE: this version requires a security update, according to Logstash!)  
+- 9.0.8 (NOTE: this version requires a security update, according to Logstash!)  
+- 9.1.10 (NOTE: this version requires a security update, according to Logstash!)  
+- 9.2.4 - 9.2.5 (NOTE: these versions require a security update, according to Logstash! [Security Update](https://discuss.elastic.co/t/logstash-8-19-14-9-2-8-9-3-3-security-update-esa-2026-29/385816))  
+- 9.3.3
+- 9.4.0
+
+Please note that when using Logstash 8, it is recommended to disable ECS in the pipeline. For more information refer to [Logstash documentation.](<https://www.elastic.co/guide/en/logstash/8.4/ecs-ls.html>)  
+
+## 2. Create a sample file
+To create a sample file, follow the following steps:  
+1)	Copy the output plugin configuration below to your Logstash configuration file:  
+    ```
+    output {
+        microsoft-sentinel-log-analytics-logstash-output-plugin {
+            create_sample_file => true
+            sample_file_path => "<enter the path to the file in which the sample data will be written>" #for example: "c:\\temp" (for windows) or "/var/log" for Linux.
+        }
+    }
+    ```
+Note: make sure that the path exists before creating the sample file.  
+2) Start Logstash. The plugin will collect up to 10 records to a sample.  
+3) The file named "sampleFile<epoch seconds>.json" in the configured path will be created once there are 10 events to sample or when the Logstash process exited gracefully. (for example: "c:\temp\sampleFile1648453501.json").  
+
+
+### Configurations:
+The following parameters are optional and should be used to create a sample file.  
+- **create_sample_file** - Boolean, False by default. When enabled, up to 10 events will be written to a sample json file.  
+- **sample_file_path** - String, Empty by default. Required when create_sample_file is enabled. Should include a valid path in which to place the sample file generated.  
+
+### Complete example
+1. set the pipeline.conf with the following configuration:  
+    ```
+    input {
+          generator {
+            lines => [ "This is a test log message"]
+            count => 10
+          }
+    }
+
+    output {
+        microsoft-sentinel-log-analytics-logstash-output-plugin {
+            create_sample_file => true
+            sample_file_path => "<enter the path to the file in which the sample data will be written>" #for example: "c:\\temp" (for windows) or "/var/log" for Linux.
+        }
+    }
+    ```
+
+2. the following sample file will be generated:  
+    ```
+    [
+      {
+        "host": "logstashMachine",
+        "sequence": 0,
+        "message": "This is a test log message",
+        "ls_timestamp": "2022-10-29T13:19:28.116Z",
+        "ls_version": "1"
+      },
+      ...
+    ]
+    ```
+
+## 3. Create the required DCR-related resources
+To configure Microsoft Sentinel Logstash plugin you first need to create the DCR-related resources. To create these resources, follow one of the following tutorials:  
+1) To ingest the data to a custom table use [Tutorial - Send custom logs to Azure Monitor Logs (preview) - Azure Monitor | Microsoft Docs](<https://docs.microsoft.com/azure/azure-monitor/logs/tutorial-custom-logs>) tutorial. Note that as part of creating the table and the DCR you will need to provide the sample file that you've created in the previous section.  
+2) To ingest the data to a standard table like Syslog or CommonSecurityLog use [Tutorial - Send custom logs to Azure Monitor Logs using resource manager templates - Azure Monitor | Microsoft Docs](<https://docs.microsoft.com/azure/azure-monitor/logs/tutorial-custom-logs-api>).  
+
+*Note:* The identity (service principal or managed identity) must have the **Monitoring Metrics Publisher** role on the target DCR:  
+
+    az role assignment create \
+      --assignee <object-id-of-identity> \
+      --role "Monitoring Metrics Publisher" \
+      --scope "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Insights/dataCollectionRules/<dcr-name>"
+
+
+## 4. Configure Logstash configuration file
+
+Add the `microsoft-sentinel-log-analytics-logstash-output-plugin` block to the `output` section of your Logstash configuration file (e.g., `logstash.conf`). The plugin requires three values from your Azure DCR resources plus authentication credentials depending on your method.  
+
+### Required Config Values (needed for all methods)
+
+| Key | Description |  
+|---|---|  
+| `data_collection_endpoint` | Your DCE logsIngestion URI |  
+| `dcr_id` | The immutable ID of your Data Collection Rule |  
+| `stream_name` | The stream name from your DCR (e.g., `Custom-MyTableRawData_CL`) |  
+
+---
+
+### Authentication Examples
+
+The plugin auto-detects the auth method based on which config values are present.  
+
+#### Option 1: Client Secret (App Registration)
+
+Provide `client_id`, `client_secret`, and `tenant_id` for your Azure App Registration / service principal.  
+
+    output {
+      microsoft-sentinel-log-analytics-logstash-output-plugin {
+        data_collection_endpoint => "https://<your-dce-name>.<region>.ingest.monitor.azure.com"
+        dcr_id                   => "dcr-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        stream_name              => "Custom-MyTableRawData_CL"
+        client_id                => "<your-app-client-id>"
+        client_secret            => "<your-app-client-secret>"
+        tenant_id                => "<your-azure-tenant-id>"
+      }
+    }
+
+
+#### Option 2: Managed Identity
+
+When running on an Azure VM with a system-assigned managed identity, omit `client_id`, `client_secret`, and `tenant_id`. The plugin will automatically use the VM's managed identity.  
+
+    output {
+      microsoft-sentinel-log-analytics-logstash-output-plugin {
+        data_collection_endpoint => "https://<your-dce-name>.<region>.ingest.monitor.azure.com"
+        dcr_id                   => "dcr-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        stream_name              => "Custom-MyTableRawData_CL"
+      }
+    }
+
+#### Option 3: Client Secret + Sovereign Cloud
+
+To authenticate against a sovereign cloud, add `azure_cloud`. Supported values: `AzurePublicCloud` (default), `AzureUSGovernment`, `AzureChinaCloud`, `AzureGermanyCloud`.  
+
+    output {
+      microsoft-sentinel-log-analytics-logstash-output-plugin {
+        data_collection_endpoint => "https://<your-dce-ingestion-endpoint>"
+        dcr_id                   => "dcr-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        stream_name              => "Custom-MyTableRawData_CL"
+        client_id                => "<your-app-client-id>"
+        client_secret            => "<your-app-client-secret>"
+        tenant_id                => "<your-tenant-id>"
+        azure_cloud              => "AzureUSGovernment"
+      }
+    }
+
+#### Option 4: Managed Identity + Sovereign Cloud
+
+    output {
+      microsoft-sentinel-log-analytics-logstash-output-plugin {
+        data_collection_endpoint => "https://<your-dce-ingestion-endpoint>"
+        dcr_id                   => "dcr-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        stream_name              => "Custom-MyTableRawData_CL"
+        azure_cloud              => "AzureUSGovernment"
+      }
+    }
+---
+Security notice: We recommend not to implicitly state client_id, client_secret, tenant_id, data_collection_endpoint, and dcr_id in your Logstash configuration for security reasons.  
+                 It is best to store this sensitive information in a Logstash KeyStore as described here- ['Secrets Keystore'](<https://www.elastic.co/guide/en/logstash/current/keystore.html>)  
+
+---
+
+## Full Pipeline Example
+
+A complete `logstash.conf` using client secret auth with a Beats input:  
+
+    input {
+      beats {
+        port => 5044
+      }
+    }
+
+    filter {
+    }
+
+    output {
+      microsoft-sentinel-log-analytics-logstash-output-plugin {
+        data_collection_endpoint => "https://my-dce.eastus2-1.ingest.monitor.azure.com"
+        dcr_id                   => "dcr-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        stream_name              => "Custom-MyTableRawData_CL"
+        client_id                => "619c1731-15ca-4403-9c61-xxxxxxxxxxxx"
+        client_secret            => "xxxxxxxxxxxxxxxx"
+        tenant_id                => "72f988bf-86f1-41af-91ab-xxxxxxxxxxxx"
+      }
+    }
+---
+
+## Optional Config Values
+
+| Key | Default | Description |  
+|---|---|---|  
+| `azure_cloud` | `AzurePublicCloud` | Azure cloud environment |  
+| `proxy` | *(none)* | Optional. Base HTTP proxy URL applied to all plugin traffic. Format: `[http://][user:password@]host:port`. When unset, no proxy is used and behavior is unchanged |  
+| `proxy_aad` | *(value of `proxy`)* | Optional. HTTP proxy URL used only for Microsoft Entra ID (AAD) authentication/token traffic. Falls back to `proxy` when unset |  
+| `proxy_endpoint` | *(value of `proxy`)* | Optional. HTTP proxy URL used only for traffic to the Data Collection Endpoint. Falls back to `proxy` when unset |  
+| `keys_to_keep` | *(all)* | Array of field names to send (subset filtering) |  
+| `max_retries_num` | `3` | Max retry attempts for failed sends |  
+| `initial_wait_time_seconds` | `1` | Initial backoff between retries |  
+| `connect_timeout_seconds` | `15` | Timeout for establishing the connection to the ingestion endpoint. Bounds how long an upload can block in the connect phase; a resulting timeout is retried |  
+| `write_timeout_seconds` | `60` | Timeout for sending the request body to the ingestion endpoint. Bounds how long an upload can block in the write phase; a resulting timeout is retried |  
+| `max_graceful_shutdown_time_seconds` | `60` | Max wait for graceful shutdown |  
+| `max_waiting_time_for_batch_seconds` | `10` | Max wait before flushing a batch |  
+| `max_waiting_for_unifier_time_seconds` | `10` | Max wait before flushing the unifier |  
+| `max_batch_size` | `10000` | Maximum number of events per batch. When a batch reaches this size it is flushed immediately, regardless of the time window |  
+| `input_queue_capacity` | `50000` | Maximum capacity of the input queue. Bounds memory usage under high-volume ingestion. When full, back-pressure is applied to the Logstash pipeline |  
+| `internal_queue_capacity` | `500` | Maximum capacity of the internal queues between batcher, unifier, and sender workers. Bounds memory usage for in-flight batches |  
+| `worker_sleep_time_millis` | `10` | Delay between worker iterations |  
+| `batcher_workers_count` | *(auto)* | Number of batcher threads |  
+| `sender_workers_count` | *(auto)* | Number of sender threads |  
+| `unifier_workers_count` | *(auto)* | Number of unifier threads |  
+| `id` | `None` | A custom identification tag to be added to sent-batches logs |  
+
+### Proxy configuration
+
+The proxy settings are **optional** and scoped to this plugin only. If you do not set any of them, the plugin behaves exactly as before and sends traffic directly (no proxy). This is useful when a single Logstash instance has multiple outputs and only the Microsoft Sentinel output needs to traverse a corporate proxy.
+
+- `proxy` — base proxy applied to both authentication and ingestion traffic.
+- `proxy_aad` — overrides the proxy used for Microsoft Entra ID (AAD) token requests; falls back to `proxy`.
+- `proxy_endpoint` — overrides the proxy used for Data Collection Endpoint traffic; falls back to `proxy`.
+
+Proxy URLs use the format `[http://][user:password@]host:port`. The scheme is optional and defaults to `http`; both host and port are required. Example:
+
+    output {
+      microsoft-sentinel-log-analytics-logstash-output-plugin {
+        data_collection_endpoint => "https://my-dce.eastus2-1.ingest.monitor.azure.com"
+        dcr_id                   => "dcr-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        stream_name              => "Custom-MyTableRawData_CL"
+        client_id                => "<your-app-client-id>"
+        client_secret            => "<your-app-client-secret>"
+        tenant_id                => "<your-azure-tenant-id>"
+        proxy                    => "http://proxyhost:8080"
+      }
+    }
+
+Security note: if your proxy requires credentials, store them in the Logstash KeyStore rather than placing them in plaintext in the configuration file.
+
+## Known issues
+ 
+When using Logstash installed on a Docker image of Lite Ubuntu, the following warning may appear:  
+
+    java.lang.RuntimeException: getprotobyname_r failed
+
+To resolve it, use the following commands to install the *netbase* package within your Dockerfile:  
+    ```
+    USER root
+    RUN apt install netbase -y
+    ```  
+For more information, see [JNR regression in Logstash 7.17.0 (Docker)](https://github.com/elastic/logstash/issues/13703).  

data/VERSION

@@ -0,0 +1 @@
+2.5.0

data/lib/logstash/outputs/microsoft-sentinel-log-analytics-logstash-output-plugin.rb

@@ -0,0 +1,14 @@
+# AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
+# encoding: utf-8
+require "logstash/outputs/base"
+require "logstash/namespace"
+require "microsoft-sentinel-log-analytics-logstash-output-plugin_jars"
+require "java"
+
+class LogStash::Outputs::MicrosoftSentinelLogAnalyticsLogstashOutputPlugin < LogStash::Outputs::Base
+  config_name "microsoft-sentinel-log-analytics-logstash-output-plugin"
+
+  def self.javaClass
+    Java::org.logstashplugins.MicrosoftSentinelLogAnalyticsLogstashOutputPlugin.java_class
+  end
+end

data/lib/logstash_registry.rb

@@ -0,0 +1,18 @@
+# AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
+# encoding: utf-8
+require "logstash/plugins/registry"
+
+# Workaround for elastic/logstash registry.rb#is_a_plugin? not handling
+# Java plugin classes whose name uses dashes. Strip both '-' and '_'.
+LogStash::Plugins::Registry.class_eval do
+  define_method(:is_a_plugin?) do |klass, name|
+    if klass.class == Java::JavaLang::Class
+      klass.simple_name.downcase == name.gsub(/[-_]/, '')
+    else
+      klass.ancestors.include?(LogStash::Plugin) && klass.respond_to?(:config_name) && klass.config_name == name
+    end
+  end
+end
+
+require "logstash/outputs/microsoft-sentinel-log-analytics-logstash-output-plugin"
+LogStash::PLUGIN_REGISTRY.add(:output, "microsoft-sentinel-log-analytics-logstash-output-plugin", LogStash::Outputs::MicrosoftSentinelLogAnalyticsLogstashOutputPlugin)

data/lib/microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb

@@ -0,0 +1,5 @@
+# AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
+# encoding: utf-8
+
+require 'jar_dependencies'
+require_jar('org.logstashplugins', 'microsoft-sentinel-log-analytics-logstash-output-plugin', '2.5.0')

data/logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec

@@ -0,0 +1,22 @@
+# AUTOGENERATED BY THE GRADLE SCRIPT. EDITS WILL BE OVERWRITTEN.
+Gem::Specification.new do |s|
+  s.name            = 'ucp-logstash-pipeline-test'
+  s.version         = '0.1.1'
+  s.licenses        = ['Apache-2.0']
+  s.summary         = 'Microsoft Sentinel Log Analytics output plugin'
+  s.description     = 'Microsoft Sentinel provides a new output plugin for Logstash. Use this output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics workspace. This is done with the Log Analytics DCR-based API.'
+  s.authors         = ['Microsoft']
+  s.email           = ['msg-ucp@service.microsoft.com']
+  s.platform        = 'java'
+  s.require_paths   = ['lib', 'vendor/jar-dependencies']
+
+  s.files = Dir["lib/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "vendor/jar-dependencies/**/*.jar", "vendor/jar-dependencies/**/*.rb", "VERSION", "docs/**/*"]
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { 'logstash_plugin' => 'true', 'logstash_group' => 'output', 'java_plugin' => 'true'}
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", ">= 1.60", "<= 2.99"
+  s.add_runtime_dependency 'jar-dependencies'
+  s.add_development_dependency 'logstash-devutils'
+end

metadata

@@ -0,0 +1,106 @@
+--- !ruby/object:Gem::Specification
+name: ucp-logstash-pipeline-test
+version: !ruby/object:Gem::Version
+  version: 0.1.1
+platform: java
+authors:
+- Microsoft
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-08-26 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: '2.99'
+  name: logstash-core-plugin-api
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.60'
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: '2.99'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: jar-dependencies
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-devutils
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Microsoft Sentinel provides a new output plugin for Logstash. Use this
+  output plugin to send any log via Logstash to the Microsoft Sentinel/Log Analytics
+  workspace. This is done with the Log Analytics DCR-based API.
+email:
+- msg-ucp@service.microsoft.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- Gemfile
+- README.md
+- VERSION
+- lib/logstash/outputs/microsoft-sentinel-log-analytics-logstash-output-plugin.rb
+- lib/logstash_registry.rb
+- lib/microsoft-sentinel-log-analytics-logstash-output-plugin_jars.rb
+- logstash-output-microsoft-sentinel-log-analytics-logstash-output-plugin.gemspec
+- vendor/jar-dependencies/org/logstashplugins/microsoft-sentinel-log-analytics-logstash-output-plugin/2.5.0/microsoft-sentinel-log-analytics-logstash-output-plugin-2.5.0.jar
+homepage:
+licenses:
+- Apache-2.0
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: output
+  java_plugin: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+- vendor/jar-dependencies
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.3.26
+signing_key:
+specification_version: 4
+summary: Microsoft Sentinel Log Analytics output plugin
+test_files: []