Logstash output plugin doesn't support 'id'
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 3.8k
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 125
Description
**Describe the bug**
The current version 2.2.0 of the microsoft-sentinel-log-analytics-logstash-output-plugin fails to load if an id is specified in the output config. It works without this, but then the output id is a random hash string which makes monitoring difficult.
**To Reproduce**
Edit your outputs as such:
```
output {
microsoft-sentinel-log-analytics-logstash-output-plugin {
client_id => "REDACTED"
client_secret => "REDACTED"
tenant_id => "REDACTED"
data_collection_endpoint => "REDACTED.ingest.monitor.azure.com"
dcr_id => "dcr-REDACTED"
stream_name => "Custom-REDACTED_CL"
id => "id_value_here"
}
}
```
**Expected behavior**
I expect the plugin to load and be the instance be named 'id_value_here'. This will then show up in the logs and API metrics.
In 1.1.3, we get something like:
```
{
"id": "id_value_here",
"name": "microsoft-sentinel-log-analytics-logstash-output-plugin",
"flow": {
"worker_utilization": {
"current": 0.0002156,
"last_1_minute": 0.00009688,
"last_5_minutes": 0.00009223,
"last_15_minutes": 0.00008821,
"last_1_hour": 0.0000849,
"lifetime": 0.0002557
},
"worker_millis_per_event": {
"current": "Infinity",
"last_1_minute": "Infinity",
"last_5_minutes": "Infinity",
"last_15_minutes": "Infinity",
"last_1_hour": "Infinity",
"lifetime": "Infinity"
}
},
"events": {
"in": 0,
"duration_in_millis": 2593,
"out": 0
}
```
In 2.2.0 if we remove the id field from the output configuration so the pipeline will start, we get:
```
{
"id": "f23f46f8a11a6ed72cc8bbbe8374cf1ec46ae26538a60b11a4c9aa0c414f6b5f",
"flow": {
"worker_utilization": {
"current": 0.0,
"last_1_minute": 0.0,
"last_5_minutes": 0.00002771,
"lifetime": 0.000586
},
"worker_millis_per_event": {
"last_5_minutes": "Infinity",
"lifetime": 0.005203
}
},
"events": {
"duration_in_millis": 39,
"in": 7496,
"out": 7496
},
"name": "microsoft-sentinel-log-analytics-logstash-output-plugin"
}
```
**Screenshots**
No screenshot, but the output from logstash-plain.log:
```
[2026-05-11T14:54:48,319][ERROR][co.elastic.logstash.api.PluginHelper] Unknown setting 'id' specified for plugin 'microsoft-sentinel-log-analytics-logstash-output-plugin'
[2026-05-11T14:54:48,320][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::IllegalStateException", :message=>"Unable to configure plugins: Config errors found for plugin 'microsoft-sentinel-log-analytics-logstash-output-plugin'", :backtrace=>["org.logstash.config.ir.CompiledPipeline.(CompiledPipeline.java:137)", "org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:237)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$initialize.call(AbstractPipelineExt$INVOKER$i$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:847)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1379)", "org.jruby.ir.instructions.InstanceSuperInstr.interpret(InstanceSuperInstr.java:139)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:363)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:128)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:115)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)", "org.jruby.RubyClass.newInstance(RubyClass.java:950)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)", "org.jruby.ir.instructions.CallBase.interpret(CallBase.java:548)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:363)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", "org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:88)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:238)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:225)", "org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:228)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:476)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:293)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:324)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", "org.jruby.ir.interpreter.Interpreter.INTERPRET_BLOCK(Interpreter.java:118)", "org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:136)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:66)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.Block.call(Block.java:144)", "org.jruby.RubyProc.call(RubyProc.java:354)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:111)", "java.base/java.lang.Thread.run(Thread.java:1583)"], :cause=>{:exception=>Java::JavaLang::IllegalStateException, :message=>"Config errors found for plugin 'microsoft-sentinel-log-analytics-logstash-output-plugin'", :backtrace=>["org.logstash.plugins.PluginUtil.validateConfig(PluginUtil.java:51)", "org.logstash.plugins.factory.AbstractPluginCreator.instantiateAndValidate(AbstractPluginCreator.java:36)", "org.logstash.plugins.factory.OutputPluginCreator.createDelegator(OutputPluginCreator.java:22)", "org.logstash.plugins.factory.PluginFactoryExt.plugin(PluginFactoryExt.java:268)", "org.logstash.plugins.factory.PluginFactoryExt.buildOutput(PluginFactoryExt.java:136)", "org.logstash.config.ir.CompiledPipeline.lambda$setupOutputs$0(CompiledPipeline.java:186)", "java.base/java.util.ArrayList.forEach(ArrayList.java:1596)", "org.logstash.config.ir.CompiledPipeline.setupOutputs(CompiledPipeline.java:182)", "org.logstash.config.ir.CompiledPipeline.(CompiledPipeline.java:135)", "org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:237)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$initialize.call(AbstractPipelineExt$INVOKER$i$initialize.gen)", "org.jruby.internal.runtime.methods.JavaMethod$JavaMethodN.call(JavaMethod.java:847)", "org.jruby.ir.runtime.IRRuntimeHelpers.instanceSuper(IRRuntimeHelpers.java:1379)", "org.jruby.ir.instructions.InstanceSuperInstr.interpret(InstanceSuperInstr.java:139)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:363)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:128)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:115)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)", "org.jruby.RubyClass.newInstance(RubyClass.java:950)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(RubyClass$INVOKER$i$newInstance.gen)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:446)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:92)", "org.jruby.ir.instructions.CallBase.interpret(CallBase.java:548)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:363)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", "org.jruby.ir.interpreter.InterpreterEngine.interpret(InterpreterEngine.java:88)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:238)", "org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:225)", "org.jruby.internal.runtime.methods.DynamicMethod.call(DynamicMethod.java:228)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:476)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:293)", "org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:324)", "org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)", "org.jruby.ir.interpreter.Interpreter.INTERPRET_BLOCK(Interpreter.java:118)", "org.jruby.runtime.MixedModeIRBlockBody.commonYieldPath(MixedModeIRBlockBody.java:136)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:66)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.Block.call(Block.java:144)", "org.jruby.RubyProc.call(RubyProc.java:354)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:111)", "java.base/java.lang.Thread.run(Thread.java:1583)"]}}
```
**Additional context**
The id field works fine with the older 1.1.3 version.
Contributor guide
Assessment
This issue has not been assessed yet.