Logstash 9.2.4 → 9.4.4
18 releases · 9 breaking changes · 2 security fixes · 1 advisory fixed
2security9breaking16deprecated37feature22fix
Vulnerabilities fixed by this upgrade
- 8.1 CVE-2026-33466 Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The…
Breaking changes
- breaking Dropped support for Logstash 7.x. Minimum supported version is now Logstash 8.0.0 in 9.3.2
- breaking Dropped support for Java 8. Minimum required version is now Java 11 in 9.3.2
- breaking Removed unused runtime dependency #91 in 9.3.1
- breaking Remove unused adal4j dependency #107 in 9.3.0
- breaking Remove duplicated deprecation log entry #1232 in 9.3.0
- breaking Dropped support for Logstash 7.x. Minimum supported version is now Logstash 8.0.0 in 9.2.7
- breaking Dropped support for Java 8. Minimum required Java version is now Java 11 in 9.2.7
- breaking Removed unused runtime dependency #91 in 9.2.6
- breaking Remove unused Azure Active Directory dependency #107 in 9.2.5
Security changes
- security Fixes CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The… in 9.3.3
- security Fixes CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The… in 9.2.8
Deprecations
- deprecated Replace deprecated Aws::S3::Object#upload_file in favor of Aws::S3::TransferManager#upload_file #67 in 9.4.0
- deprecated Replace deprecated File.exists? with File.exist? for Ruby 3.4 (JRuby 10) compatibility #65 in 9.4.0
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #36 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #215 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #239 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #197 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #31 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #192 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #11 in 9.3.1
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #36 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #215 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #239 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #197 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #31 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #192 in 9.2.6
- deprecated Replace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #11 in 9.2.6
Every release in between
otherUpdated JRuby to 10.0.6.0 #19279
otherUpdated Jackson and jrjackson dependencies #19286
otherUpgraded Puma to 8.x #19234
otherSync up with Elasticsearch 9.4 branch to pull latest dependencies #477
otherUpdate jackson dependency to 3.1.4 #467
otherUpdate jackson dependency to 2.21.4 #118
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #537 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #221 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
otherUpdate jackson dependency to 2.21.4 #269
fixFix serverless compatibility: nil params in pool requests and unsupported template settings #1276
otherSupport Elastic Cloud API keys in the api_key option, which now accepts an id:api_key pair, its base64-encoded form, or an essu_ Cloud API key, and rejects an unrecognized format at startup #1274
feature[Doc] Add note for index option #1269
featureBatch size estimation improvements #19180
otherLogstash's file descriptors usage, limits and sizing guidance documented #19206
otherUpgrades jackson.core to 2.21.2 and nimbus-jose-jwt to 10.9 versions. #117
feature[DOCS] Added recommendation to migrate to the Kafka integration plugin #116
otherUpdate Netty dependency to 4.1.135.Final #567
otherUpdate Netty dependency to 4.1.135.Final #219
otherUpdate Netty dependency to 4.1.135.Final #274
fixFixes a metric leak in _node/stats when a pipeline repeatedly fails to start with config.reload.automatic: true. Previously, each retry left a fresh set of plugin metric entries in the collector, causing the stats payload to grow indefinitely #19120
otherUpdated jruby-openssl to 0.16.0 #19116
otherUpgraded jrjackson and fasterxml.jackson #19126
fixFixes an issue where a field set by an integration pipeline to java.util.Date value-object representing a timestamp could not be converted to a timestamp #462
otherInclude httpclient5/httpcore5 from the elasticsearch-java artifact #458
otherUpgrades jackson.core to 2.21.2 version #255
otherUpdate Netty dependency to 4.1.134.Final #541
otherUpdate Netty dependency to 4.1.134.Final #217
otherUpdate Netty dependency to 4.1.134.Final #257
other[DOC] Document command string form limitation #6
otherUpdate bundled JDK to 21.0.11 build 10.
otherUpdate Netty dependency to 4.1.133.Final #539
otherUpdate Netty dependency to 4.1.133.Final #216
otherUpdate Netty dependency to 4.1.133.Final #256
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline. This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy #250
otherImproves the logging experience when DLQ used #1253.
featureauto: enables pipeline crash recovery for pipelines backed by the persistent queue
featurefalse (default): do not automate recovery of crashed pipelines
featuretrue: enables pipeline crash recovery for any pipeline, even if backed by the ephemeral memory queue (risk: data loss)
featurePerformance improvements which saves ~40% CPU resource on DLQ segment file lookup operations 19013
otherUpdate JRuby to 10.0.5.0
otherUpdate bundled JDK to 21.0.10 build 7
featureFeature: Add a warning log message when the number of tasks stored in memory exceeds the configured threshold #125
fixUse milliseconds timestamp precision in S3 input to fix the skip backup and delete object issue in S3-compatible storage services #60
deprecatedReplace deprecated Aws::S3::Object#upload_file in favor of Aws::S3::TransferManager#upload_file #67
deprecatedReplace deprecated File.exists? with File.exist? for Ruby 3.4 (JRuby 10) compatibility #65
otherRe-packaging the plugin #63
featureAdd cutoff_second configuration option to S3 input plugin #59
featureAdd precision setting to support nanosecond precision timestamps #165
otherms (default): timestamps are stored with millisecond precision
otherit keeps the same behavior as before for backward compatibility
otherfractional seconds are truncated to 3 digits
othercustom parsing formats use joda-time library
otherns: timestamps are stored with nanosecond precision
otherfractional seconds support up to 9 digits
othercustom parsing formats use java.time
otherISO8601 now accepts up to 9 fractional-second digits
otherApply an 'error' tag to any event that fails the de-dotting process #26
featureAdd JRuby 10 support: replace removed NativeException with RaiseException, source JRuby from Logstash vendor directory instead of pinning Maven version #96
otherInclude Elasticsearch web-utils JAR into the plugin to keep registered_domain processor dependencies #397
fixFixed set_security_user processor to behave consistently with other unsupported processors (inference, enrich) by tagging events with _ingest_pipeline_failure #269
fixFix fingerprint instability for Hash and Array field values caused by JRuby 10 changing Hash#inspect formatting #79
fixFix a regression introduced in 11.8.7 where sasl_jaas_config was incorrectly typed in the output plugin, crashing Logstash on startup when a SASL Kafka output configuration was present #247
fixAdd JRuby 10 support: fix integer conversion precision loss beyond 2^53 caused by parse_signed_hex_str routing all strings through Float() #178
otherUpdates the gelf dependency #77
otherUpdated JRuby to 9.4.15.0 #19290
otherUpdated Jackson and jrjackson dependencies #19289
otherSync up with Elasticsearch 9.3 branch to pull latest dependencies #478
otherUpdate jackson dependency to 3.1.4 #470
otherUpdate jackson dependency to 2.21.4 #118
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #537 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #221 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
otherUpdate jackson dependency to 2.21.4 #269
fixFix serverless compatibility: nil params in pool requests and unsupported template settings #1276
otherSupport Elastic Cloud API keys in the api_key option, which now accepts an id:api_key pair, its base64-encoded form, or an essu_ Cloud API key, and rejects an unrecognized format at startup #1274
feature[Doc] Add note for index option #1269
otherUpgrade puma to 8.x #19228
otherNo user-facing changes in Logstash plugins.
featureBatch's size estimation improvements #19179
otherLogstash's file descriptors usage, limits and sizing guidance documented #19207
otherUpgrades jackson.core to 2.21.2 and nimbus-jose-jwt to 10.9 versions. #117
feature[DOCS] Added recommendation to migrate to the Kafka integration plugin #116
otherUpdate Netty dependency to 4.1.135.Final #567
otherUpdate Netty dependency to 4.1.135.Final #219
otherUpdate Netty dependency to 4.1.135.Final #274
otherUpdated bundled JDK to 21.0.11 build 10 #19069
otherUpdated jruby-openssl to 0.16.0 #19115
otherUpgraded jrjackson and fasterxml.jackson #19103
featureIntroduces new dead_letter_queue.flush_check_interval config for flushing the staled segment files scheduler which can reduce frequent check overhead #19036
fixFixes a metric leak in _node/stats when a pipeline repeatedly fails to start with config.reload.automatic: true. Previously, each retry left a fresh set of plugin metric entries in the collector, causing the stats payload to grow indefinitely #19091
fixFixes an issue where a field set by an integration pipeline to java.util.Date value-object representing a timestamp could not be converted to a timestamp #464
otherInclude httpclient5/httpcore5 from the elasticsearch-java artifact #457
otherUpgrades tools.jackson.core dependency to 3.1.1 #453
otherUpdate Netty dependency to 4.1.134.Final #541
other[DOC] Note that search_after requires permissions on underlying indices/data streams, not aliases #251
otherUpdate Netty dependency to 4.1.134.Final #217
otherUpdate Netty dependency to 4.1.134.Final #257
fixWhen configured to use a port that is already in use, the failure is now propagated to the pipeline #250 This fixes an issue where a misconfigured input could retry indefinitely while Logstash's health report continued to report the pipeline as healthy.
other[DOC] Document command string form limitation #6
otherUpgrades jackson.core to 2.21.2 version #255
otherUpdated Log4j to 2.25.4 #18991
featureImproved dead letter queue performance during flush operations #18874
featureOptimized DLQ segment directory scans with single-pass logic, saving ~40% CPU on segment file lookup operations #18970
fixFix a regression introduced in 11.8.5 that prevented the Kafka Output plugin from being configured with sasl_jaas_config https://github.com/logstash-plugins/logstash-integration-kafka/pull/247[#247]
otherImproves the logging experience when DLQ used #1253
securityFixes CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The…
otherUpgrades kotlin-stdlib dependency #114
otherUpdate Netty dependency to 4.1.132.Final #535
otherUpdate Netty dependency to 4.1.132.Final #214
otherUpdate Netty dependency to 4.1.132.Final #249
otherUpgrade Avro dependency to 1.11.5 #242
feature[DOC] Add info about Kafka timestamp behavior #241
otherRedact sasl_jaas_config to prevent credentials from appearing in debug logs. #237
other[DOC] Clarify that ssl_certificate_authorities takes at-most-one value #150
otherUpdated the bundled JDK to 21.0.10 build 7
otherUpgraded the bundled MaxMind geoip2 library to version 4.4.0 #238
breakingDropped support for Logstash 7.x. Minimum supported version is now Logstash 8.0.0
breakingDropped support for Java 8. Minimum required version is now Java 11
otherUpgraded the kafka-avro-serializer dependency #225
fixFixed an issue where some logstash artifacts were shipped with a JDK targeting the wrong platform/architecture. #18750
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #36
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #215
otherEnsure gem artifact ships with all runtime dependencies #163
otherEnsure gem artifact ships with all runtime dependencies #93
breakingRemoved unused runtime dependency #91
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #239
otherEnsure gem artifact ships with all runtime dependencies #236
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #197
otherUpgrade Netty version to 4.1.131 #531
otherEnsure gem artifact ships with all runtime dependencies #527
otherEnsure gem artifact ships with all runtime dependencies #57
otherEnsure gem artifact ships with all runtime dependencies #331
otherUpgrade Netty version to 4.1.131 #207
otherEnsure gem artifact ships with all runtime dependencies #206
otherUpgrade Netty version to 4.1.131 #246
otherEnsure gem artifact ships with all runtime dependencies #242
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #31
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #192
otherEnsure gem artifact ships with all runtime dependencies #190
otherEnsure gem artifact ships with all runtime dependencies #223
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #11
otherEnsure gem artifact ships with all runtime dependencies #49
featureAdd wait_for_status and timeout query params for _health_report API #18377
featureExpose average batch metrics at 1, 5 and 15 minutes time window #18460
fixFix an issue with Central Management where a spurious 404 when looking up pipeline definitions could cause the running pipelines to shut down #18265
featureStandardize SSL configurations, add proxy and basic auth supports #47
featureAdd SSL/TLS support for HTTPS schema registry connections
featureAdd ssl_enabled option to enable/disable SSL
featureAdd ssl_certificate and ssl_key options for PEM-based client authentication (unencrypted keys only)
featureAdd ssl_certificate_authorities option for PEM-based server certificate validation
featureAdd ssl_verification_mode option to control SSL verification (full, none)
featureAdd ssl_cipher_suites option to configure cipher suites
featureAdd ssl_supported_protocols option to configure TLS protocol versions (TLSv1.1, TLSv1.2, TLSv1.3)
featureAdd ssl_truststore_path and ssl_truststore_password options for server certificate validation (JKS/PKCS12)
featureAdd ssl_keystore_path and ssl_keystore_password options for mutual TLS authentication (JKS/PKCS12)
featureAdd ssl_truststore_type and ssl_keystore_type options (JKS or PKCS12)
featureAdd HTTP proxy support with proxy option
featureAdd HTTP basic authentication support with username and password options
fixFix NoMethodError when decode fails #214
featureFeature: Add address_field config option to handle nested fields #29
otherEmbeds Ingest Node components from Elasticsearch 9.3 #378
otherEnsure full jar-dependency tree is shipped with gem artifact #110
breakingRemove unused adal4j dependency #107
otherUpgrade transitive org.apache.commons:commons-lang3 dependency #217
otherUpgrade log4j dependency #85
featureAdd AES256 with 3DES extension support for priv_protocol #78
breakingRemove duplicated deprecation log entry #1232
featureAdd drop_error_types config option to avoid retrying on certain error types #1228
securityFixes CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The…
otherUpgrades kotlin-stdlib dependency #114
otherUpdate Netty dependency to 4.1.132.Final #535
otherUpdate Netty dependency to 4.1.132.Final #214
otherUpdate Netty dependency to 4.1.132.Final #249
otherUpgrade Avro dependency to 1.11.5 #242
feature[DOC] Add info about Kafka timestamp behavior #241
otherRedact sasl_jaas_config to prevent credentials from appearing in debug logs. #237
other[DOC] Clarify that ssl_certificate_authorities takes at-most-one value #150
otherUpdated the bundled JDK to 21.0.10 build 7
otherUpgraded Log4j to 2.25.3 #18805
otherUpdated MaxMind GeoIP2 database library to version 4.4.0 #238
breakingDropped support for Logstash 7.x. Minimum supported version is now Logstash 8.0.0
breakingDropped support for Java 8. Minimum required Java version is now Java 11
otherUpgraded the kafka-avro-serializer dependency #225
fixFixed an issue where some logstash artifacts were shipped with a JDK targeting the wrong platform/architecture. #18749
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #36
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #215
otherEnsure gem artifact ships with all runtime dependencies #163
otherEnsure gem artifact ships with all runtime dependencies #93
breakingRemoved unused runtime dependency #91
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #239
otherEnsure gem artifact ships with all runtime dependencies #236
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #197
otherUpgrade Netty version to 4.1.131 #531
otherEnsure gem artifact ships with all runtime dependencies #527
otherEnsure gem artifact ships with all runtime dependencies #57
otherEnsure gem artifact ships with all runtime dependencies #331
otherUpgrade Netty version to 4.1.131 #207
otherEnsure gem artifact ships with all runtime dependencies #206
otherUpgrade Netty version to 4.1.131 #246
otherEnsure gem artifact ships with all runtime dependencies #242
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #31
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #192
otherEnsure gem artifact ships with all runtime dependencies #190
otherEnsure gem artifact ships with all runtime dependencies #223
deprecatedReplace deprecated File.exists? by File.exist? to ensure compatibility with Ruby 3.4 (JRuby 10) #11
otherEnsure gem artifact ships with all runtime dependencies #49
otherMade decoding more robust to malformed events #214
otherEnsure gem artifact ship with all runtime dependencies #110
breakingRemove unused Azure Active Directory dependency #107
otherUpgrade transitive dependency used by Avro serializer #217