Open
Description
Many plugins that communicate with Elasticsearch accept an api_key
parameter, which they expect to be in the name:key
format. This value is base64-encoded into an opaque value before being used in an Authorization: ApiKey #{opaque}
HTTP header.
To reduce friction, we should accept the opaque value for api_key
anywhere that we accept the name:key format api_key
. We can do so by assuming that the value is opaque unless it includes a colon (:
) character.
plugin | name:key |
opaque |
---|---|---|
logstash-output-elasticsearch |
✅ | ❌ |
logstash-filter-elasticsearch |
✅ | ❌ |
logstash-input-elasticsearch |
✅ | ❌ |
logstash-filter-elastic_integration |
✅ | ✅ |
- support opaque
api_key
in Elasticsearch Output - support opaque
api_key
in Elasticsearch Filter - support opaque
api_key
in Elasticsearch Input - support opaque
api_key
in Elastic Integration Filter - support opaque
api_key
in LS-Core Central Management - support opaque
api_key
in LS-Core Stack Monitoring
Notes:
- Plugins in
logstash-integration-elastic_enterprise_search
have anapi_key
parameter, but the underlying client provides it verbatim as aBearer
token. - LS Core's Central Management and Stack Monitoring both borrow connections from a stand-alone Elasticsearch Output plugin, to which they provide a configured
api_key
without modification; they should work for free once the Elasticsearch Output has been updated.