Add the logstash-output-http plugin to observabilitySRE container - #19465
Open
donoghuc wants to merge 1 commit into
Open
Add the logstash-output-http plugin to observabilitySRE container#19465donoghuc wants to merge 1 commit into
donoghuc wants to merge 1 commit into
Conversation
This commit adds the http output plugin which uses the same crypto providers as the elasticsearch output plugin which is already in use for this container.
Contributor
🤖 GitHub commentsJust comment with:
|
Member
Author
|
run exhaustive tests |
Contributor
|
This pull request does not have a backport label. Could you fix it @donoghuc? 🙏
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the observabilitySRE internal distribution to include the logstash-output-http plugin and adds acceptance coverage intended to validate FIPS vs non-FIPS TLS behavior when sending data through the HTTP output.
Changes:
- Add
logstash-output-httpto the observabilitySRE plugin allow-list. - Add new acceptance test contexts for Logstash → HTTP output → Elasticsearch in both FIPS-compliant and non-FIPS TLS configurations.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| x-pack/distributions/internal/observabilitySRE/qa/acceptance/spec/acceptance_tests_spec.rb | Adds new acceptance test contexts for HTTP output under FIPS and non-FIPS TLS configurations. |
| x-pack/distributions/internal/observabilitySRE/plugin-allow-list.txt | Allows the logstash-output-http plugin in the observabilitySRE container. |
Suppressed comments (1)
x-pack/distributions/internal/observabilitySRE/qa/acceptance/spec/acceptance_tests_spec.rb:101
- This test references LOGSTASH_PIPELINE=logstash-to-http-weak.conf, but there is no corresponding pipeline file under x-pack/distributions/internal/observabilitySRE/qa/acceptance/docker/logstash/pipeline/. As written, the container will fail to start and the acceptance test will be invalid.
work_dir = File.expand_path("../docker", __dir__)
docker_compose_up({"LOGSTASH_PIPELINE" => "logstash-to-http-weak.conf"}, work_dir)
wait_for_elasticsearch
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+69
to
+71
| work_dir = File.expand_path("../docker", __dir__) | ||
| docker_compose_up({"LOGSTASH_PIPELINE" => "logstash-to-http.conf"}, work_dir) | ||
| wait_for_elasticsearch |
Comment on lines
+88
to
+92
| wait_until(timeout: 30, message: "No documents in logstash-http-fips-test") do | ||
| response = es_request("/logstash-http-fips-test/_search", query) | ||
| result = JSON.parse(response.body) | ||
| response.code == "200" && result["hits"]["total"]["value"] > 0 | ||
| end |
Comment on lines
+109
to
+124
| it "prevents data flow when using TLSv1.1 which is not FIPS-compliant" do | ||
| # Allow time for Logstash to attempt connections (and fail) | ||
| sleep 15 | ||
|
|
||
| # Verify that no index has been created that would indicate successful data flow | ||
| response = es_request("/_cat/indices?v") | ||
| expect(response.body).not_to include("logstash-http-weak-ssl-test") | ||
|
|
||
| # Check logs for the specific BouncyCastle FIPS error we expect | ||
| logs = `docker logs fips_test_logstash 2>&1` | ||
|
|
||
| # Verify the logs contain the FIPS-mode TLS protocol error | ||
| expect(logs).to include("No usable protocols enabled") | ||
| expect(logs).to include("IllegalStateException") | ||
| expect(logs).to include("org.bouncycastle") | ||
| end |
💛 Build succeeded, but was flaky
Failed CI Steps |
donoghuc
added
the
backport-active-all
Member
Author
|
not quite sure what exhaustive tests didnt trigger... manually did it https://buildkite.com/elastic/logstash-exhaustive-tests-pipeline/builds/4265 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release notes
[rn:skip]
What does this PR do?
This commit adds the http output plugin which uses the same crypto providers as the elasticsearch output plugin which is already in use for this container.