Logstash 9.0.8 → 9.5.5
44 releases · 14 breaking changes · 3 security fixes · 1 advisory fixed
3security14breaking17deprecated100feature57fix
Vulnerabilities fixed by this upgrade
- 8.1 CVE-2026-33466 Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The…
Breaking changes
- breaking Drop support for Logstash 7.x by requiring elasticsearch gem >= 8. Logstash 8+ continues to work as before #213 in 9.5.0
- breaking Drop support for Logstash 7.x by requiring elasticsearch gem >= 8. Logstash 8+ continues to work as before #252 in 9.5.0
- breaking Remove explicit lz4-java dependency (now transitive from Kafka client) in 9.5.0
- breaking Breaking: partitioner options default and uniform_sticky are removed in 9.5.0
- breaking Remove duplicated deprecation log entry #208 in 9.5.0
- breaking Dropped support for Logstash 7.x. Minimum supported version is now Logstash 8.0.0 in 9.3.2
- breaking Dropped support for Java 8. Minimum required version is now Java 11 in 9.3.2
- breaking Removed unused runtime dependency #91 in 9.3.1
- breaking Remove unused adal4j dependency #107 in 9.3.0
- breaking Remove duplicated deprecation log entry #1232 in 9.3.0
- breaking Dropped support for Logstash 7.x. Minimum supported version is now Logstash 8.0.0 in 9.2.7
- breaking Dropped support for Java 8. Minimum required Java version is now Java 11 in 9.2.7
- breaking Removed unused runtime dependency #91 in 9.2.6
- breaking Remove unused Azure Active Directory dependency #107 in 9.2.5
Security changes
- security Fixes CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The… in 9.3.3
- security Fixes CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The… in 9.2.8
- security FIX: The snmptrap input now correctly enforces the user security level set by security_level config, and drops received events that do not match the configured value #75 in 9.1.1
Deprecations
- deprecated Replace deprecated Aws::S3::Object#upload_file in favor of Aws::S3::TransferManager#upload_file #67 in 9.4.0
- deprecated Replace deprecated File.exists? with File.exist? for Ruby 3.4 (JRuby 10) compatibility #65 in 9.4.0
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #36 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #215 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #239 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #197 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #31 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #192 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #11 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #36 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #215 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #239 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #197 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #31 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #192 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #11 in 9.2.6
- deprecated Deprecate partitioner default and uniform_sticky options #206 Both options are deprecated in Kafka client 3 and will be removed in the plugin 12.0.0. in 9.2.4
Every release in between
otherUpdate bundled JDK to 21.0.12.1 build 1 #19510
otherUpdate bundled JRuby to 10.0.7.0 #19608
otherUpdate Jackson to 2.21.7 and jrjackson to 0.5.4 #19442 #19577
otherUpgrade rubyzip dependency to 3.x #19501
otherUpgrade zstd-jni dependency to 1.5.7-14 #19512
otherDocument that the lumberjack input plugin should not be used for Logstash-to-Logstash communication #19505
otherUpdate Netty dependency to 4.1.138.Final #579
otherUpdate Netty dependency to 4.1.138.Final #241
otherUpdate Netty dependency to 4.1.138.Final #290
otherUpgrade march_hare to consume 4.10+ #87
fixFix for processing the HA Proxy protocol, considering the line can be split in multiple buffers. #286
otherUpgrade zstd-jni dependency #279
fixFix: terminate idle scheduler work threads on plugin close, which leaked one thread per pipeline reload #7
featureInclude timestamp in health report snapshot API response #19422
otherRequire httpclient5 version 5.6.4 or later #501
otherUpdate jackson dependency to 3.1.6 #499
otherUpdate proton-j to 0.35.0 #122
otherUpdate jackson dependency to 2.21.6 #121
otherUpdate Netty dependency to 4.1.137.Final #576
otherUpdate Netty dependency to 4.1.137.Final #239
featureAdd optional HTTP traffic logging (disabled by default). To enable it, turn on debug logging. #237
otherUpdate Netty dependency to 4.1.137.Final #284
fixFix access method for large tables to avoid materializing the full result set in memory and triggering an out-of-memory error. #204
otherPrevent concurrent Sequel JDBC subadapter initialization races by preloading adapter at driver load time #203
otherRequire httpclient5 version 5.6.4 or later #277
otherUpgrades kafka-avro-serializer dependency to v8.3.1, and constrains transitive dependency on Apache httpclient5 to be at least v5.6.3 #273
otherUpdate jackson dependency to 2.21.6 #274
otherRequire mail dependency 2.9 or later #72
fixMade BufferedTokenizer thread safe and usable in multithreaded contexts; its flush operation now returns an error when the remainder token overruns the size limit, and logs when data is dropped #19345 #19312
fixHandle a NoSuchFileException that could occur while resolving the oldest dead letter queue segment file #19409
otherUpdate concurrent-ruby to 1.3.8 #19428
fixFix NameError: uninitialized constant Bignum that prevented the codec from loading on Logstash 9.4+ #8
otherThe edn gem references the Bignum constant, which Ruby removed in 3.2 (shipped by the JRuby in Logstash 9.4+). This raised a NameError when the codec registered, so any pipeline using the edn codec failed to start. Alias the removed Fixnum/Bignum constants to Integer before requiring edn.
otherThe edn gem references the Bignum constant, which Ruby removed in 3.2 (shipped by the JRuby in Logstash 9.4+). This raised a NameError when the codec registered, so any pipeline using the edn_lines codec failed to start. Alias the removed Fixnum/Bignum constants to Integer before requiring edn.
fixFix NameError: uninitialized constant Fixnum when using the MURMUR3 algorithm on Logstash 9.4+ (Ruby 3.2+, which removed Fixnum in favor of Integer) #19
fixFixes an issue where failing to load a dictionary could cause the plugin to continue to run with a missing or partially-updated dictionary; this issue was especially noticeable when configured with refresh_behaviour => replace, which clears the dictionary before loading the replacement #112.
fixFix NameError: uninitialized constant Fixnum when reading a JMS MapMessage on Logstash 9.4+ #63
otherThe jruby-jms gem references the Fixnum constant, which Ruby removed in 3.2 (shipped by the JRuby in Logstash 9.4+). This raised a NameError while decoding a JMS MapMessage. Alias the removed Fixnum/Bignum constants to Integer before requiring jms.
fixUpdates common functionality used to dice data used in some codec plugins to validate oversized segments also on last part. Added logging when data is dropped because passed the size limit #19312
featureSend Logstash Metrics via OTLP #18857
featureAuto-reload pipelines on TLS certificate rotation #18978
featureExtend TLS auto-reload to CPM and monitoring service clients #19045
featureAdd support for cgroupv2 #18708
featureNew dead_letter_queue.flush_check_interval setting to control how frequently stale DLQ segment files are flushed #19036
featureRemoved legacy output concurrency mode. The deprecated concurrency :legacy option is no longer supported; outputs should use concurrency :single or concurrency :shared #19003
featureRemoved the pipe output plugin from the default plugin bundle #19159
fixPipeline metrics are now cleared when a pipeline fails to start, preventing stale metrics from being reported by the monitoring API #19091
fixFailures in plugin do_close no longer halt the pipeline shutdown sequence #19035
fixFixed forced-shutdown (double SIGINT) behavior for JRuby 10 #19017
fixAdded missed standard types during batch size estimation #19158
otherBump OpenTelemetry to 1.62.0 #19209
otherUpdate Netty dependency to 4.1.136.Final #575
otherSet SO_TIMEOUT on IOReactor to ensure NIO connections have a baseline socket timeout, preventing indefinite hangs when connection pool restore fails to apply the request-level timeout #480
otherSync up with Elasticsearch 9.5 branch to pull latest dependencies #476
fixFixes an issue where a field set by an integration pipeline to java.util.Date value-object representing a timestamp could not be converted to a timestamp #460
otherApplies Elasticsearch geoip module relocation changes #445
otherSupport Elastic Cloud API keys in the api_key option, which now accepts an id:api_key pair, its base64-encoded form, or an essu_ Cloud API key, and rejects an unrecognized format at startup #215
breakingDrop support for Logstash 7.x by requiring elasticsearch gem >= 8. Logstash 8+ continues to work as before #213
otherSupport Elastic Cloud API keys in the api_key option, which now accepts an id:api_key pair, its base64-encoded form, or an essu_ Cloud API key, and rejects an unrecognized format at startup #274
fixFix serverless request failure caused by conflicting compatible-with and Elastic-Api-Version headers when using elasticsearch-ruby v9 #269
breakingDrop support for Logstash 7.x by requiring elasticsearch gem >= 8. Logstash 8+ continues to work as before #252
fixFix to use the Content-type declared charset to decode the request body #230
otherUpdate Netty dependency to 4.1.136.Final #228
otherUpdate Netty dependency to 4.1.136.Final #281
fixFix connection leak on statement retry by opening JDBC connection once outside retry loop #201
fixFix sasl_jaas_config output configuration #245
otherUpdate Kafka client to 4.2.0 #243
breakingRemove explicit lz4-java dependency (now transitive from Kafka client)
otherDocument by_duration offset reset strategy (available since Apache Kafka 4.0.0)
otherMask sensitive sasl_jaas_config values in debug logs to prevent credential exposure #232
otherUpdate Kafka client to 4.1.0 and transitive dependencies #205
breakingBreaking: partitioner options default and uniform_sticky are removed
otherlinger_ms default value changed from 0 to 5
featureAdd group_protocols option for configuring Kafka consumer rebalance protocol
featureSetting group_protocol => consumer opts in to the new consumer group protocol
breakingRemove duplicated deprecation log entry #208
otherGenerate error events with _snmpfailure tag when all SNMP operations fail and the response data is empty (timeout for example) #92
featureHandle partial responses and errors gracefully: add tag_on_failure (default: ["_snmpfailure"]) to tag events when SNMP operations fail, and allow_partial_response (default: false) to preserve partial data from failed walk/table operations #91
featureAdded support for IPv6 addresses #16
otherUpdate bundled JDK to 21.0.12.1 build 1 #19508
otherUpdate bundled JRuby to 10.0.7.0 #19609
otherUpdate Jackson to 2.21.7 and jrjackson to 0.5.4 #19442 #19577
otherUpgrade rubyzip dependency to 3.x #19501
otherUpgrade zstd-jni dependency to 1.5.7-14 #19512
otherDocument that the lumberjack input plugin should not be used for Logstash-to-Logstash communication #19505
otherUpdate Netty dependency to 4.1.138.Final #579
otherUpdate Netty dependency to 4.1.138.Final #241
otherUpdate Netty dependency to 4.1.138.Final #290
otherUpgrade march_hare to consume 4.10+ #87
otherRequire httpclient5 5.6.4 or later #502
otherUpdate jackson dependency to 3.1.6 #498
otherUpdate proton-j to 0.35.0 #122
fixFix for processing the HA Proxy protocol, considering the line can be split in multiple buffers. #286
fixFix access method for large tables to avoid materializing the full result set in memory and triggering an out-of-memory error. #204
otherPrevent concurrent Sequel JDBC subadapter initialization races by preloading adapter at driver load time #203
otherUpgrade zstd-jni dependency #280
fixFix: terminate idle scheduler work threads on plugin close, which leaked one thread per pipeline reload #7
otherRequiere mail dependency 2.9 or later #72
featureInclude timestamp in health report snapshot API response #19422
fixFix a NoSuchFileException in the dead letter queue that could occur during oldest segment resolution when a segment file is concurrently removed #19409
otherUpdated concurrent-ruby gem #19428
fixFix NameError: uninitialized constant Bignum that prevented the codec from loading on Logstash 9.4+ #8
otherThe edn gem references the Bignum constant, which Ruby removed in 3.2 (shipped by the JRuby in Logstash 9.4+). This raised a NameError when the codec registered, so any pipeline using the edn codec failed to start. Alias the removed Fixnum/Bignum constants to Integer before requiring edn.
otherThe edn gem references the Bignum constant, which Ruby removed in 3.2 (shipped by the JRuby in Logstash 9.4+). This raised a NameError when the codec registered, so any pipeline using the edn_lines codec failed to start. Alias the removed Fixnum/Bignum constants to Integer before requiring edn.
fixFix NameError: uninitialized constant Fixnum when using the MURMUR3 algorithm on Logstash 9.4+ (Ruby 3.2+, which removed Fixnum in favor of Integer) #19
otherUpdate jackson dependency to 2.21.6 #121
otherUpdate Netty dependency to 4.1.137.Final #576
otherUpdate Netty dependency to 4.1.137.Final #239
featureAdd optional HTTP traffic logging (disabled by default). To enable it, turn on debug logging. #237
fixFix NameError: uninitialized constant Fixnum when reading a JMS MapMessage on Logstash 9.4+ #63
otherThe jruby-jms gem references the Fixnum constant, which Ruby removed in 3.2 (shipped by the JRuby in Logstash 9.4+). This raised a NameError while decoding a JMS MapMessage. Alias the removed Fixnum/Bignum constants to Integer before requiring jms.
otherUpdate Netty dependency to 4.1.137.Final #284
otherUpdate jackson dependency to 2.21.6 #275
otherUpdated JDK to 21.0.12 build 8 #19365
otherApply the default 30-second socket timeout to low-level HTTP connections so stalled connections time out consistently. #480
fixFixes an issue where failing to load a dictionary could cause the plugin to continue to run with a missing or partially-updated dictionary; this issue was especially noticeable when configured with refresh_behaviour => replace, which clears the dictionary before loading the replacement #112.
otherUpdated JRuby to 10.0.6.0 #19279
otherUpdated Jackson and jrjackson dependencies #19286
otherUpgraded Puma to 8.x #19234
otherSync up with Elasticsearch 9.4 branch to pull latest dependencies #477
otherUpdate jackson dependency to 3.1.4 #467
otherUpdate jackson dependency to 2.21.4 #118
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #537 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #221 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
otherUpdate jackson dependency to 2.21.4 #269
fixFix serverless compatibility: nil params in pool requests and unsupported template settings #1276
otherSupport Elastic Cloud API keys in the api_key option, which now accepts an id:api_key pair, its base64-encoded form, or an essu_ Cloud API key, and rejects an unrecognized format at startup #1274
feature[Doc] Add note for index option #1269
featureBatch size estimation improvements #19180
otherLogstash's file descriptors usage, limits and sizing guidance documented #19206
otherUpgrades jackson.core to 2.21.2 and nimbus-jose-jwt to 10.9 versions. #117
feature[DOCS] Added recommendation to migrate to the Kafka integration plugin #116
otherUpdate Netty dependency to 4.1.135.Final #567
otherUpdate Netty dependency to 4.1.135.Final #219
otherUpdate Netty dependency to 4.1.135.Final #274
fixFixes a metric leak in _node/stats when a pipeline repeatedly fails to start with config.reload.automatic: true. Previously, each retry left a fresh set of plugin metric entries in the collector, causing the stats payload to grow indefinitely #19120
otherUpdated jruby-openssl to 0.16.0 #19116
otherUpgraded jrjackson and fasterxml.jackson #19126
fixFixes an issue where a field set by an integration pipeline to java.util.Date value-object representing a timestamp could not be converted to a timestamp #462
otherInclude httpclient5/httpcore5 from the elasticsearch-java artifact #458
otherUpgrades jackson.core to 2.21.2 version #255
otherUpdate Netty dependency to 4.1.134.Final #541
otherUpdate Netty dependency to 4.1.134.Final #217
otherUpdate Netty dependency to 4.1.134.Final #257
other[DOC] Document command string form limitation #6
otherUpdate bundled JDK to 21.0.11 build 10.
otherUpdate Netty dependency to 4.1.133.Final #539
otherUpdate Netty dependency to 4.1.133.Final #216
otherUpdate Netty dependency to 4.1.133.Final #256
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline. This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy #250
otherImproves the logging experience when DLQ used #1253.
featureauto: enables pipeline crash recovery for pipelines backed by the persistent queue
featurefalse (default): do not automate recovery of crashed pipelines
featuretrue: enables pipeline crash recovery for any pipeline, even if backed by the ephemeral memory queue (risk: data loss)
featurePerformance improvements which saves ~40% CPU resource on DLQ segment file lookup operations 19013
otherUpdate JRuby to 10.0.5.0
otherUpdate bundled JDK to 21.0.10 build 7
featureFeature: Add a warning log message when the number of tasks stored in memory exceeds the configured threshold #125
fixUse milliseconds timestamp precision in S3 input to fix the skip backup and delete object issue in S3-compatible storage services #60
deprecatedReplace deprecated Aws::S3::Object#upload_file in favor of Aws::S3::TransferManager#upload_file #67
deprecatedReplace deprecated File.exists? with File.exist? for Ruby 3.4 (JRuby 10) compatibility #65
otherRe-packaging the plugin #63
featureAdd cutoff_second configuration option to S3 input plugin #59
featureAdd precision setting to support nanosecond precision timestamps #165
otherms (default): timestamps are stored with millisecond precision
otherit keeps the same behavior as before for backward compatibility
otherfractional seconds are truncated to 3 digits
othercustom parsing formats use joda-time library
otherns: timestamps are stored with nanosecond precision
otherfractional seconds support up to 9 digits
othercustom parsing formats use java.time
otherISO8601 now accepts up to 9 fractional-second digits
otherApply an 'error' tag to any event that fails the de-dotting process #26
featureAdd JRuby 10 support: replace removed NativeException with RaiseException, source JRuby from Logstash vendor directory instead of pinning Maven version #96
otherInclude Elasticsearch web-utils JAR into the plugin to keep registered_domain processor dependencies #397
fixFixed set_security_user processor to behave consistently with other unsupported processors (inference, enrich) by tagging events with _ingest_pipeline_failure #269
fixFix fingerprint instability for Hash and Array field values caused by JRuby 10 changing Hash#inspect formatting #79
fixFix a regression introduced in 11.8.7 where sasl_jaas_config was incorrectly typed in the output plugin, crashing Logstash on startup when a SASL Kafka output configuration was present #247
fixAdd JRuby 10 support: fix integer conversion precision loss beyond 2^53 caused by parse_signed_hex_str routing all strings through Float() #178
otherUpdates the gelf dependency #77
otherUpdated JRuby to 9.4.15.0 #19290
otherUpdated Jackson and jrjackson dependencies #19289
otherSync up with Elasticsearch 9.3 branch to pull latest dependencies #478
otherUpdate jackson dependency to 3.1.4 #470
otherUpdate jackson dependency to 2.21.4 #118
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #537 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #221 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
otherUpdate jackson dependency to 2.21.4 #269
fixFix serverless compatibility: nil params in pool requests and unsupported template settings #1276
otherSupport Elastic Cloud API keys in the api_key option, which now accepts an id:api_key pair, its base64-encoded form, or an essu_ Cloud API key, and rejects an unrecognized format at startup #1274
feature[Doc] Add note for index option #1269
otherUpgrade puma to 8.x #19228
otherNo user-facing changes in Logstash plugins.
featureBatch's size estimation improvements #19179
otherLogstash's file descriptors usage, limits and sizing guidance documented #19207
otherUpgrades jackson.core to 2.21.2 and nimbus-jose-jwt to 10.9 versions. #117
feature[DOCS] Added recommendation to migrate to the Kafka integration plugin #116
otherUpdate Netty dependency to 4.1.135.Final #567
otherUpdate Netty dependency to 4.1.135.Final #219
otherUpdate Netty dependency to 4.1.135.Final #274
otherUpdated bundled JDK to 21.0.11 build 10 #19069
otherUpdated jruby-openssl to 0.16.0 #19115
otherUpgraded jrjackson and fasterxml.jackson #19103
featureIntroduces new dead_letter_queue.flush_check_interval config for flushing the staled segment files scheduler which can reduce frequent check overhead #19036
fixFixes a metric leak in _node/stats when a pipeline repeatedly fails to start with config.reload.automatic: true. Previously, each retry left a fresh set of plugin metric entries in the collector, causing the stats payload to grow indefinitely #19091
fixFixes an issue where a field set by an integration pipeline to java.util.Date value-object representing a timestamp could not be converted to a timestamp #464
otherInclude httpclient5/httpcore5 from the elasticsearch-java artifact #457
otherUpgrades tools.jackson.core dependency to 3.1.1 #453
otherUpdate Netty dependency to 4.1.134.Final #541
other[DOC] Note that search_after requires permissions on underlying indices/data streams, not aliases #251
otherUpdate Netty dependency to 4.1.134.Final #217
otherUpdate Netty dependency to 4.1.134.Final #257
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #250 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
other[DOC] Document command string form limitation #6
otherUpgrades jackson.core to 2.21.2 version #255
otherUpdated Log4j to 2.25.4 #18991
featureImproved dead letter queue performance during flush operations #18874
featureOptimized DLQ segment directory scans with single-pass logic, saving ~40% CPU on segment file lookup operations #18970
fixFix a regression introduced in 11.8.5 that prevented the Kafka Output plugin from being configured with sasl_jaas_config https://github.com/logstash-plugins/logstash-integration-kafka/pull/247[#247]
otherImproves the logging experience when DLQ used #1253
securityFixes CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The…
otherUpgrades kotlin-stdlib dependency #114
otherUpdate Netty dependency to 4.1.132.Final #535
otherUpdate Netty dependency to 4.1.132.Final #214
otherUpdate Netty dependency to 4.1.132.Final #249
otherUpgrade Avro dependency to 1.11.5 #242
feature[DOC] Add info about Kafka timestamp behavior #241
otherRedact sasl_jaas_config to prevent credentials from appearing in debug logs. #237
other[DOC] Clarify that ssl_certificate_authorities takes at-most-one value #150
otherUpdated the bundled JDK to 21.0.10 build 7
otherUpgraded the bundled MaxMind geoip2 library to version 4.4.0 #238
breakingDropped support for Logstash 7.x. Minimum supported version is now Logstash 8.0.0
breakingDropped support for Java 8. Minimum required version is now Java 11
otherUpgraded the kafka-avro-serializer dependency #225
fixFixed an issue where some logstash artifacts were shipped with a JDK targeting the wrong platform/architecture. #18750
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #36
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #215
otherEnsure gem artifact ships with all runtime dependencies #163
otherEnsure gem artifact ships with all runtime dependencies #93
breakingRemoved unused runtime dependency #91
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #239
otherEnsure gem artifact ships with all runtime dependencies #236
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #197
otherUpgrade Netty version to 4.1.131 #531
otherEnsure gem artifact ships with all runtime dependencies #527
otherEnsure gem artifact ships with all runtime dependencies #57
otherEnsure gem artifact ships with all runtime dependencies #331
otherUpgrade Netty version to 4.1.131 #207
otherEnsure gem artifact ships with all runtime dependencies #206
otherUpgrade Netty version to 4.1.131 #246
otherEnsure gem artifact ships with all runtime dependencies #242
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #31
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #192
otherEnsure gem artifact ships with all runtime dependencies #190
otherEnsure gem artifact ships with all runtime dependencies #223
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #11
otherEnsure gem artifact ships with all runtime dependencies #49
featureAdd wait_for_status and timeout query params for _health_report API #18377
featureExpose average batch metrics at 1, 5 and 15 minutes time window #18460
fixFix an issue with Central Management where a spurious 404 when looking up pipeline definitions could cause the running pipelines to shut down #18265
featureStandardize SSL configurations, add proxy and basic auth supports #47
featureAdd SSL/TLS support for HTTPS schema registry connections
featureAdd ssl_enabled option to enable/disable SSL
featureAdd ssl_certificate and ssl_key options for PEM-based client authentication (unencrypted keys only)
featureAdd ssl_certificate_authorities option for PEM-based server certificate validation
featureAdd ssl_verification_mode option to control SSL verification (full, none)
featureAdd ssl_cipher_suites option to configure cipher suites
featureAdd ssl_supported_protocols option to configure TLS protocol versions (TLSv1.1, TLSv1.2, TLSv1.3)
featureAdd ssl_truststore_path and ssl_truststore_password options for server certificate validation (JKS/PKCS12)
featureAdd ssl_keystore_path and ssl_keystore_password options for mutual TLS authentication (JKS/PKCS12)
featureAdd ssl_truststore_type and ssl_keystore_type options (JKS or PKCS12)
featureAdd HTTP proxy support with proxy option
featureAdd HTTP basic authentication support with username and password options
fixFix NoMethodError when decode fails #214
featureFeature: Add address_field config option to handle nested fields #29
otherEmbeds Ingest Node components from Elasticsearch 9.3 #378
otherEnsure full jar-dependency tree is shipped with gem artifact #110
breakingRemove unused adal4j dependency #107
otherUpgrade transitive org.apache.commons:commons-lang3 dependency #217
otherUpgrade log4j dependency #85
featureAdd AES256 with 3DES extension support for priv_protocol #78
breakingRemove duplicated deprecation log entry #1232
featureAdd drop_error_types config option to avoid retrying on certain error types #1228
securityFixes CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The…
otherUpgrades kotlin-stdlib dependency #114
otherUpdate Netty dependency to 4.1.132.Final #535
otherUpdate Netty dependency to 4.1.132.Final #214
otherUpdate Netty dependency to 4.1.132.Final #249
otherUpgrade Avro dependency to 1.11.5 #242
feature[DOC] Add info about Kafka timestamp behavior #241
otherRedact sasl_jaas_config to prevent credentials from appearing in debug logs. #237
other[DOC] Clarify that ssl_certificate_authorities takes at-most-one value #150
otherUpdated the bundled JDK to 21.0.10 build 7
otherUpgraded Log4j to 2.25.3 #18805
otherUpdated MaxMind GeoIP2 database library to version 4.4.0 #238
breakingDropped support for Logstash 7.x. Minimum supported version is now Logstash 8.0.0
breakingDropped support for Java 8. Minimum required Java version is now Java 11
otherUpgraded the kafka-avro-serializer dependency #225
fixFixed an issue where some logstash artifacts were shipped with a JDK targeting the wrong platform/architecture. #18749
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #36
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #215
otherEnsure gem artifact ships with all runtime dependencies #163
otherEnsure gem artifact ships with all runtime dependencies #93
breakingRemoved unused runtime dependency #91
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #239
otherEnsure gem artifact ships with all runtime dependencies #236
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #197
otherUpgrade Netty version to 4.1.131 #531
otherEnsure gem artifact ships with all runtime dependencies #527
otherEnsure gem artifact ships with all runtime dependencies #57
otherEnsure gem artifact ships with all runtime dependencies #331
otherUpgrade Netty version to 4.1.131 #207
otherEnsure gem artifact ships with all runtime dependencies #206
otherUpgrade Netty version to 4.1.131 #246
otherEnsure gem artifact ships with all runtime dependencies #242
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #31
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #192
otherEnsure gem artifact ships with all runtime dependencies #190
otherEnsure gem artifact ships with all runtime dependencies #223
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #11
otherEnsure gem artifact ships with all runtime dependencies #49
otherMade decoding more robust to malformed events #214
otherEnsure gem artifact ship with all runtime dependencies #110
breakingRemove unused Azure Active Directory dependency #107
otherUpgrade transitive dependency used by Avro serializer #217
featureFix to clean batch statistic metrics on pipeline shutdown #18515
otherUpgrade netty 4.1.129 #525
otherUpgrade netty to 4.1.129 #203
otherUpgrade netty to 4.1.129 #239
otherUpgrade lz4 dependency #213
deprecatedDeprecate partitioner default and uniform_sticky options #206 Both options are deprecated in Kafka client 3 and will be removed in the plugin 12.0.0.
featureAdd reconnect_backoff_max_ms option for configuring kafka client #204
featureUpdated logging in JSON format to include pipeline and plugin IDs. #18470
otherNo user-facing changes in Logstash plugins.
featureAdded trace log to track event size expansion #49
feature[DOC] Added introductory statement to clarify purpose of the plugin #43
featureFix Logstash startup failure when queue.max_bytes exceeds 2 GiB #18366
featureDeprecation logs are now written to both the deprecation logger and the standard logger #18326
otherUpdate JDK to 21.0.9 #18350
featureAdd logs when MaxMind databases fail to deserialize custom field #235
fixFix convert to correctly parse hexadecimal float notation and scientific notation strings into floats and integers #175
fixFix an issue when config_mode => 'advanced' is set, event hub-specific settings (initial_position, max_batch_size, prefetch_count, receive_timeout, initial_position_look_back) were being ignored and replaced with global defaults. These settings are now correctly applied per event hub #104
otherImprove thread safety to avoid race conditions during shutdown #67
featureSpeed: spend the least amount of CPU to get minimal compression benefit
featureBalanced: spend moderate CPU to further reduce size
featureSize: enable maximum compression, at significantly higher cost
featurePersisted Queue: improved serialization to be more compact by default (note: queues containing these compact events can be processed by Logstash v8.10.0 and later) #17849
featureSupport for user defined metrics #18218
featurePQ: Add support for event-level compression using ZStandard (ZSTD) #18121
featureImplements current batch event count and byte size metrics #18160
featureImplements average batch event count and byte size metrics. The collection of such metric could be disabled, enabled for each batch or done on a sample of the total batches #18000
featureDropped the persistent queue setting queue.checkpoint.interval #17759
featureReimplements BufferedTokenizer to leverage pure Java classes instead of use JRuby runtime's classes #17229
featureLogging improvement while handling exceptions in the pipeline, ensuring that chained exceptions propagate enough information to be actionable. #17935
featureSupport for using ES|QL queries in the Elasticsearch filter to add improved flexibility when ingesting data from Elasticsearch is now in Technical Preview.
featureGauge type metrics, such as current and peak connection counts of Elastic Agent, are now available in the _node/stats API response when the vertices=true parameter is included. These metrics are particularly useful for monitoring Logstash plugin activity on the Logstash Integration dashboards #18090
featureImprove Logstash release artifacts file metadata: mtime is preserved when building tar archives #18091
otherLogging compatability with Elasticsearch 9.2 #373
otherUtilizes Elasticsearch interfaces via Elasticsearch logstash-bridge #336
featureIntroduce opt-in "yaml_load_strategy => streaming" to stream parse YAML dictionaries. This can hugely reduce the memory footprint when working with large YAML dictionaries. #106
featureAdd support for SNMPv3 context engine ID and context name to the snmptrap input #76
featureAdded trace log to track event size expansion #49
feature[DOC] Added introductory statement to clarify purpose of the plugin #43
featureDeprecation logs are now written to both the deprecation logger and the standard logger #18326
otherUpdate JDK to 21.0.9 #18350
featureAdd logs when MaxMind databases fail to deserialize custom field #235
fixFix convert to correctly parse hexadecimal float notation and scientific notation strings into floats and integers #175
fixFix an issue when config_mode => 'advanced' is set, event hub-specific settings (initial_position, max_batch_size, prefetch_count, receive_timeout, initial_position_look_back) were being ignored and replaced with global defaults. These settings are now correctly applied per event hub #104
otherImprove thread safety to avoid race conditions during shutdown #67
otherDocs: Correct code snippet #28
featureAdded support for encoded and non-encoded api-key formats on plugin configuration #203
featureAdded support for encoded and non-encoded api-key formats on plugin configuration #237
fixFixes an issue where the jdbc_static filter's throughput was artificially limited to 4 concurrent queries, causing the plugin to become a bottleneck in pipelines with more than 4 workers. Each instance of the plugin is now limited to 16 concurrent queries, with increased timeouts to eliminate…
otherSupport both, encoded and non encoded api-key formats on plugin configuration #1223
featureSupport for using ES|QL queries in the Elasticsearch filter to add improved flexibility when ingesting data from Elasticsearch is now in Technical Preview.
fixGauge type metrics, such as current and peak connection counts of Elastic Agent, are now available in the _node/stats API response when the vertices=true parameter is included. These metrics are particularly useful for monitoring Logstash plugin activity on the Logstash Integration dashboards #18090
fixImprove logstash release artifacts file metadata: mtime is preserved when buiilding tar archives #18091
otherES|QL support #194
otherUpgrade netty 4.1.126 #517
otherUpgrade netty to 4.1.126 #198
fixFixed a regression introduced in 3.3.0 where add_field is no longer enriching events #59
otherUpgrade netty to 4.1.126 #235
otherDisplay exception chain comes from kafka client #200
featureLogging improvement while handling exceptions in the pipeline, ensuring that chained exceptions propagate enough information to be actionable. #17935
otherNo user-facing changes in Logstash core.
otherNo change to the plugins in this release.
featureAdd terminate processor support #345
featureAllow YamlFile's Psych::Parser and Visitor instances to be garbage collected #104
otherUpdate Nokogiri dependency version #89
otherUpdated JWT dependency #101
securityFIX: The snmptrap input now correctly enforces the user security level set by security_level config, and drops received events that do not match the configured value #75
featureAdd headers reporting uncompressed size and doc count for bulk requests #1217
featureSignificantly improves write speeds to the persistent queue (PQ) when a pipeline's workers are caught up with already-written events #17791
featureEliminated log warning about unknown gauge metric type when using pipeline-to-pipeline. #17721
featureImprove plugins remove command to support multiple plugins #17030
featureDeprecated the persistent queue setting queue.checkpoint.interval#17759, which was found to have no effect. This will be removed in a future Logstash release.
featureLogstash now ships with JRuby 9.4.13.0 to leveragle latest features and improvements in the 9.4 series #17696
featureEnhanced keystore validation to prevent the creation of secrets in an invalid format #17351
featureSupport for using ES|QL queries in the Elasticsearch input to add improved flexibility when ingesting data from Elasticsearch is now in Technical Preview.
featureLogstash OSS and Full docker images are now based on Ubuntu 24.04.
otherUpdate JDK to 21.0.7+6 #17591
featureIntroduces proxy param to support proxy #316
otherEmbeds Ingest Node components from Elasticsearch 9.1
featureAdd target configuration option to store the result into it #196
featureAdd "cursor"-like index tracking #205
otherES|QL support #233
otherDocs: update Cloud terminology #1212
otherChange connection log entry from WARN to INFO when connecting during register phase #1211
otherSupport other rufus scheduling options in JDBC Input #183
featureAdded support for decoding multiple events from text or binary messages when using a codec that produces multiple events #56
otherUpdate kafka client to 3.9.1 #193
otherDocs: fixed setting type reference for sasl_iam_jar_paths #192
otherExpose the SASL client callback class setting to the Logstash configuration #177
featureAdds a mechanism to load AWS IAM authentication as SASL client libraries at startup #178
otherUpdate Nokogiri dependency version #88
otherCall connection check after connect #61