Copilot · Dec 23, 2024 · May 8, 2026 · Jun 16, 2026 · Aug 5, 2026 · Sep 17, 2026
diff --git a/.github/workflows/changelog-version-update.yml b/.github/workflows/changelog-version-update.yml
@@ -0,0 +1,38 @@
+# This workflow automates changelog entry updates and version bumps for pull requests
+# in logstash-plugins repositories. It is triggered when a PR is opened or merged,
+# and delegates to the reusable pr-prepare workflow which reads /pr_prepare comments
+# to determine the type of changelog entry and the appropriate version bump.
+# Can also be triggered manually via workflow_dispatch for missed or late updates.
+
+name: Changelog & Version Update
+
+on:
+  pull_request_target:
+    types: [opened, closed]
+  workflow_dispatch:
+    inputs:
+      command:
+        description: 'Type of update'
+        required: true
+        type: choice
+        options:
+          - release:patch
+          - release:minor
+          - release:major
+          - changelog:add
+      pr_number:
+        description: 'PR number to link in the changelog entry'
+        required: true
+        type: string
+      changelog_entry:
+        description: 'Custom changelog entry (defaults to PR title if omitted)'
+        required: false
+        type: string
+
+jobs:
+  changelog:
+    uses: logstash-plugins/.github/.github/workflows/pr-prepare.yml@main
+    with:
+      command: ${{ inputs.command }}
+      pr_number: ${{ inputs.pr_number }}
+      changelog_entry: ${{ inputs.changelog_entry }}
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
@@ -0,0 +1,41 @@
+name: Unit Tests
+
+on:
+  push:
+    branches: ['1.x', main]
+  pull_request:
+    branches: ['1.x', main]
+  schedule:
+    # Daily run that fans out across every active branch via the matrix
+    # job below. GitHub only fires `schedule:` from the workflow file on
+    # the default branch (main); copies of this file on
+    # non-default branches keep the block for symmetry but it is dormant
+    # there.
+    - cron: '0 8 * * *'
+  workflow_dispatch:
+
+jobs:
+  tests:
+    if: github.event_name != 'schedule'
+    uses: logstash-plugins/.ci/.github/workflows/unit-tests.yml@1.x
+    # Forward org/repo secrets (e.g. SLACK_BOT_TOKEN used by the reusable's
+    # failure-notification step). The reusable does not declare a
+    # workflow_call.secrets block, so `inherit` is required.
+    secrets: inherit
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: ${{ github.ref != 'refs/heads/1.x' && github.ref != 'refs/heads/main' }}
+    with:
+      timeout-minutes: 60
+
+  scheduled:
+    if: github.event_name == 'schedule'
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: ['1.x', main]
+    uses: logstash-plugins/.ci/.github/workflows/unit-tests.yml@1.x
+    secrets: inherit
+    with:
+      ref: ${{ matrix.branch }}
+      timeout-minutes: 60
diff --git a/.travis.yml b/.travis.yml
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 2.0.0
+  - SSL settings that were marked deprecated in version `0.1.3` are now marked obsolete, and will prevent the plugin from starting.
+  - These settings are:
+    - `ssl`, which should be replaced by `ssl_enabled`
+    - [#11](https://github.com/logstash-plugins/logstash-input-elastic_serverless_forwarder/pull/11)
+
 ## 1.0.0
   - Promote from technical preview to GA [#10](https://github.com/logstash-plugins/logstash-input-elastic_serverless_forwarder/pull/10)
 

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # Logstash Plugin
 
-[![Travis Build Status](https://travis-ci.com/logstash-plugins/logstash-input-http.svg)](https://travis-ci.com/logstash-plugins/logstash-input-http)
+[![Unit Tests](https://github.com/logstash-plugins/logstash-input-elastic_serverless_forwarder/actions/workflows/unit-tests.yml/badge.svg?branch=main)](https://github.com/logstash-plugins/logstash-input-elastic_serverless_forwarder/actions/workflows/unit-tests.yml)
 
 This is a plugin for [Logstash](https://github.com/elastic/logstash).
 

diff --git a/docs/index.asciidoc b/docs/index.asciidoc
@@ -159,14 +159,16 @@ filter {
 
 This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
 
+NOTE: As of version `2.0.0` of this plugin, a previously deprecated SSL setting has been removed.
+Please check out <<plugins-{type}s-{plugin}-obsolete-options>> for details.
+
 [cols="<,<,<",options="header",]
 |=======================================================================
 |Setting |Input type|Required
 | <<plugins-{type}s-{plugin}-auth_basic_username>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-auth_basic_password>> |<<password,password>>|No
 | <<plugins-{type}s-{plugin}-host>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-port>> |<<number,number>>|No
-| <<plugins-{type}s-{plugin}-ssl>> |<<boolean,boolean>>|__Deprecated__
 | <<plugins-{type}s-{plugin}-ssl_certificate>> |a valid filesystem path|No
 | <<plugins-{type}s-{plugin}-ssl_certificate_authorities>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-ssl_client_authentication>> |<<string,string>>, one of `["none", "optional", "required"]`|No
@@ -218,17 +220,6 @@ The host or ip to bind
 
 The TCP port to bind to
 
-[id="plugins-{type}s-{plugin}-ssl"]
-===== `ssl`
-deprecated[0.1.3, Replaced by <<plugins-{type}s-{plugin}-ssl_enabled>>]
-
-* Value type is <<boolean,boolean>>
-* Default value is `true`
-
-Events are by default sent over SSL, which requires configuring this plugin to present an identity certificate using <<plugins-{type}s-{plugin}-ssl_certificate>> and key using <<plugins-{type}s-{plugin}-ssl_key>>.
-
-You can disable SSL with `+ssl => false+`.
-
 [id="plugins-{type}s-{plugin}-ssl_certificate"]
 ===== `ssl_certificate`
 
@@ -355,6 +346,18 @@ When <<plugins-{type}s-{plugin}-ssl_client_authentication>> causes a client to p
 NOTE: Client identity is not typically validated using SSL because the receiving server only has access to the client's outbound-ip, which is not always constant and is frequently not represented in the certificate's subject or subjectAltNames extensions.
       For more information, see https://www.rfc-editor.org/rfc/rfc2818#section-3.1[RFC2818 § 3.2 (HTTP over TLS -- Client Identity)]
 
+[id="plugins-{type}s-{plugin}-obsolete-options"]
+==== Elasticsearch Output Obsolete Configuration Options
+
+WARNING: As of version `2.0.0` of this plugin, some configuration options have been replaced.
+The plugin will fail to start if it contains any of these obsolete options.
+
+[cols="<,<",options="header",]
+|=======================================================================
+|Setting|Replaced by
+| ssl | <<plugins-{type}s-{plugin}-ssl_enabled>>
+|=======================================================================
+
 [id="plugins-{type}s-{plugin}-common-options"]
 include::{include_path}/{type}.asciidoc[]
 

diff --git a/lib/logstash/inputs/elastic_serverless_forwarder.rb b/lib/logstash/inputs/elastic_serverless_forwarder.rb
@@ -10,7 +10,6 @@
 
 class LogStash::Inputs::ElasticServerlessForwarder < LogStash::Inputs::Base
   include LogStash::PluginMixins::PluginFactorySupport
-  include LogStash::PluginMixins::NormalizeConfigSupport
 
   config_name "elastic_serverless_forwarder"
 
@@ -23,7 +22,6 @@ class LogStash::Inputs::ElasticServerlessForwarder < LogStash::Inputs::Base
   config :auth_basic_password,         :validate => :password
 
   # ssl-config
-  config :ssl,                         :validate => :boolean, :default => true, :deprecated => "Use 'ssl_enabled' instead."
   config :ssl_enabled,                 :validate => :boolean, :default => true
 
   # ssl-identity
@@ -41,11 +39,12 @@ class LogStash::Inputs::ElasticServerlessForwarder < LogStash::Inputs::Base
   config :ssl_supported_protocols,     :validate => :string,  :list => true
   config :ssl_handshake_timeout,       :validate => :number,  :default => 10_000
 
+  # obsolete config
+  config :ssl,                         :obsolete => "Use 'ssl_enabled' instead."
+
   def initialize(*a)
     super
 
-    normalize_ssl_configs!
-
     if original_params.include?('codec')
       fail LogStash::ConfigurationError, 'The `elastic_serverless_forwarder` input does not have an externally-configurable `codec`'
     end
@@ -155,12 +154,6 @@ def inner_json_lines_codec_options
     }
   end
 
-  def normalize_ssl_configs!
-    @ssl_enabled = normalize_config(:ssl_enabled) do |normalizer|
-      normalizer.with_deprecated_alias(:ssl)
-    end
-  end
-
   class QueueWrapper
     def initialize(wrapped_queue)
       @wrapped_queue = wrapped_queue

diff --git a/logstash-input-elastic_serverless_forwarder.gemspec b/logstash-input-elastic_serverless_forwarder.gemspec
@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |s|
   s.name = 'logstash-input-elastic_serverless_forwarder'
-  s.version = '1.0.0'
+  s.version         = ::File.read('version').split("\n").first
   s.licenses = ['Apache License (2.0)']
   s.summary = "Receives events from Elastic Serverless Forwarder over HTTP or HTTPS"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"
@@ -12,7 +12,7 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib", "vendor/jar-dependencies"]
 
   # Files
-  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "VERSION", "docs/**/*"]
+  s.files = Dir["lib/**/*","spec/**/*","*.gemspec","*.md","CONTRIBUTORS","Gemfile","LICENSE","NOTICE.TXT", "VERSION", "version", "docs/**/*"]
   # Tests
   s.test_files = s.files.grep(%r{^(test|spec|features)/})
 

diff --git a/spec/fixtures/certs/generate.sh b/spec/fixtures/certs/generate.sh
@@ -11,28 +11,28 @@ echo "DO NOT USE THESE CERTIFICATES IN PRODUCTION" >> ./README.txt
 
 # certificate authority
 openssl genrsa -out root.key 4096
-openssl req -new -x509 -days 1826 -extensions ca -key root.key -out root.crt -subj "/C=LS/ST=NA/L=Http Input/O=Logstash/CN=root" -config ../openssl.cnf
+openssl req -new -x509 -days 36500 -extensions ca -key root.key -out root.crt -subj "/C=LS/ST=NA/L=Http Input/O=Logstash/CN=root" -config ../openssl.cnf
 
 # server certificate from root
 openssl genrsa -out server_from_root.key 4096
 openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in server_from_root.key -out server_from_root.pkcs8.key
 openssl req -new -key server_from_root.key -out server_from_root.csr -subj "/C=LS/ST=NA/L=Http Input/O=Logstash/CN=server" -config ../openssl.cnf
-openssl x509 -req -extensions server_cert -extfile ../openssl.cnf -days 1096 -in server_from_root.csr -CA root.crt -CAkey root.key -set_serial 03 -out server_from_root.crt -sha256
+openssl x509 -req -extensions server_cert -extfile ../openssl.cnf -days 36500 -in server_from_root.csr -CA root.crt -CAkey root.key -set_serial 03 -out server_from_root.crt -sha256
 
 # client certificate from root
 openssl genrsa -out client_from_root.key 4096
 openssl req -new -key client_from_root.key -out client_from_root.csr -subj "/C=LS/ST=NA/L=Http Input/O=Logstash/CN=client" -config ../openssl.cnf
-openssl x509 -req -extensions client_cert -extfile ../openssl.cnf -days 1096 -in client_from_root.csr -CA root.crt -CAkey root.key -set_serial 04 -out client_from_root.crt -sha256
+openssl x509 -req -extensions client_cert -extfile ../openssl.cnf -days 36500 -in client_from_root.csr -CA root.crt -CAkey root.key -set_serial 04 -out client_from_root.crt -sha256
 
 # self-signed for testing
-openssl req -newkey rsa:4096 -nodes -keyout client_self_signed.key -x509 -days 365 -out client_self_signed.crt -subj "/C=LS/ST=NA/L=Http Input/O=Logstash/CN=self"
+openssl req -newkey rsa:4096 -nodes -keyout client_self_signed.key -x509 -days 36500 -out client_self_signed.crt -subj "/C=LS/ST=NA/L=Http Input/O=Logstash/CN=self"
 #openssl genrsa -out client_self_signed.key 4096
-#openssl req -new -x509 -days 1826 -extensions client_cert -key client_self_signed.key -out client_self_signed.crt -subj "/C=LS/ST=NA/L=Http Input/O=Logstash/CN=self" -config ../openssl.cnf
+#openssl req -new -x509 -days 36500 -extensions client_cert -key client_self_signed.key -out client_self_signed.crt -subj "/C=LS/ST=NA/L=Http Input/O=Logstash/CN=self" -config ../openssl.cnf
 
 ## client with invalid subject
 openssl genrsa -out client_no_matching_subject.key 4096
 openssl req -new -key client_no_matching_subject.key -out client_no_matching_subject.csr -subj "/C=LS/ST=NA/L=Http Input/O=Logstash/CN=client_no_matching_subject" -config ../openssl.cnf
-openssl x509 -req -extensions client_cert_no_matching_subject -extfile ../openssl.cnf -days 1096 -in client_no_matching_subject.csr -CA root.crt -CAkey root.key -set_serial 04 -out client_no_matching_subject.crt
+openssl x509 -req -extensions client_cert_no_matching_subject -extfile ../openssl.cnf -days 36500 -in client_no_matching_subject.csr -CA root.crt -CAkey root.key -set_serial 04 -out client_no_matching_subject.crt
 
 # verify :allthethings
 openssl verify -CAfile root.crt server_from_root.crt

diff --git a/spec/fixtures/certs/generated/client_from_root.crt b/spec/fixtures/certs/generated/client_from_root.crt
@@ -1,35 +1,35 @@
 -----BEGIN CERTIFICATE-----
-MIIGATCCA+mgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJMUzEL
+MIIGAzCCA+ugAwIBAgIBBDANBgkqhkiG9w0BAQsFADBRMQswCQYDVQQGEwJMUzEL
 MAkGA1UECAwCTkExEzARBgNVBAcMCkh0dHAgSW5wdXQxETAPBgNVBAoMCExvZ3N0
-YXNoMQ0wCwYDVQQDDARyb290MB4XDTIyMTExODA2MTA0OFoXDTI1MTExODA2MTA0
-OFowUzELMAkGA1UEBhMCTFMxCzAJBgNVBAgMAk5BMRMwEQYDVQQHDApIdHRwIElu
-cHV0MREwDwYDVQQKDAhMb2dzdGFzaDEPMA0GA1UEAwwGY2xpZW50MIICIjANBgkq
-hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA49LRvGg28z/chbygtYSEHILCOqkUgPom
-M1K6Zity7oPHHfepVSJjIuvyAeT/c2wSay4VL4npZWQ2/AuNdtltGb58PviuYtB/
-1S2sX8WyC2rPcq3vVk85FA0c7xLsOPA+4Hp7hHLxgBfBkIkCNFBRXQOrMBiPrBM7
-RKrCKo1b254O83Hdy+kiUr6GZGXIWDPK3C3tkksKCAv++fxMQgucB9ERX4cigVAQ
-+ZIBZGLrWU7Jm/LbI4+TlbFZj/3dQDflRuAhX01Kb5dktnhxrlQd/UkDcpHCv38+
-2/haBov4wmu9/93eKWfc5tqMx8SnnNPjq+ms3rq8WVQtxBUrh60cKhdEKO9nYhrX
-KssHPIPXiM5V2R8yVddFygmgkEEUkxYIg9VYHFGlMCOQC5OoyXIoi08xs8h+GJbM
-MdODsRF8ZhIPeCA7Va34MlySZrvXEzPavNwk3fq7NVUV4Um1lLWQPVwZ9yR9ii3y
-yDa+xibvUWegs/3y04iFL9hhp4EM3u5ucQOdyQEMurxvXx9WrBi8VhMmJUN7dDq4
-emWe8BITVYG6+vVkX577dgm12FGjah4HCEqJuckudP/QGa1xmgJ+AjQ5Q7xzp0VA
-5/llWSlGjzCcVms0V21wyHKGPm0p1sJ+cmcqLBCCgdFl2dnevoLXVjp18Xt6Oas9
-KI343tBSn7ECAwEAAaOB4TCB3jAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF
-oDAzBglghkgBhvhCAQ0EJhYkT3BlblNTTCBHZW5lcmF0ZWQgQ2xpZW50IENlcnRp
-ZmljYXRlMB0GA1UdDgQWBBSsU4ZmryDNkeQXZHZ2zvYu7Xp6tTAfBgNVHSMEGDAW
-gBTA8vgd/nWOBOCTxL+z67d+Am9lqjAOBgNVHQ8BAf8EBAMCBeAwHQYDVR0lBBYw
-FAYIKwYBBQUHAwIGCCsGAQUFBwMEMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAA
-ATANBgkqhkiG9w0BAQsFAAOCAgEAKfEdNhRpBfZgjZm8cFVLHEL+ML8zMlCubS2v
-v8JL/Fg3Tlj11iCYa5XmwwHdprpDyrIChZOwsZK+1xWHgy+vGI5W93RbhCxx7o4C
-DzcFkeI13qgjtdDvbzttZIHGNWSN8qaXLlc+rJBYn8uOUyQ95wXYJM+j+hH3E34c
-60Iy8AcYPcBhtiDN94eHswKxiF1EgViHVlVraaTWTU7U0VCeFTHWebQb+Hdg9Fa8
-SjK1Mqcnowd4owgXEjPgbyyf6UOgBe6wScwJjyDPmh7tvDKsSeD4XibRK+Hmwinx
-gtxnZtlM4472EOOENNfd7JGui6H8XxHU9dUMMDTH4YY6cakpHpAopMY5jKYqhEdH
-bCNZX+EmP9XV8cfjQWOJOSck3O1FA8EL5Yekbyh8Rf60gneSu3lrvwvLE2msz00Y
-vILeVMZvBXO3Ua3YitWFv9pxrgkGfpIt1U25H6Bg1pP2qSoEBSh5tCBqXbFqr1o2
-QiuE0Y+bv2DT0rtKZ3Gt1G2klqZg3KpL2pM7Udf5bxm0Bxgj+XA1SycNqNsciGtK
-jPFuA1IsFwNzJd0AcDtDRWK6o0GhtUwQ+JMfP06V07knWg21aTPddhiaDrgpMTFJ
-hD8TJvTs8kkjz4COiv/jTippc9lw0Fy4rneZ2iAt59JaiqmoXvBP0tvj3orBBnqW
-n3C9qbA=
+YXNoMQ0wCwYDVQQDDARyb290MCAXDTI2MDgwNTIyMDMzNloYDzIxMjYwNzEyMjIw
+MzM2WjBTMQswCQYDVQQGEwJMUzELMAkGA1UECAwCTkExEzARBgNVBAcMCkh0dHAg
+SW5wdXQxETAPBgNVBAoMCExvZ3N0YXNoMQ8wDQYDVQQDDAZjbGllbnQwggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDnH0IF7sKU+mQmeA6S3q1WdgWgv3QO
+5+oFwPdU5Mc4y/WNtPSpKKZwuKxhWfPZrjV6Kuq5iHEDM/nI93x5JJZhp6QFT5/8
+7pjq+qrNQmWxVs8naRWhDoAOnMGpqyiw79tvAdXV58/MkP/4oYeq/BuqFQIf4/hk
+RHvQjQRGDy5I8uG2AUbN8FbVKSYvDbb8xk2c2Vg/wInvpwQdNkjxelObvOun/wgs
+8QdTL5wWoaMjZ9U3c/BSAvDJcg/9unS31gfhbp8w5VMpmEQYZgUYrHG+zJRshY44
+hZYN52assBJsQDTNotGN2cnMzmYp+GpYvaJeOGUo3crH/0QdbdbX8I7g7EjbOfSj
+94qoV0E6NaG+hdiZ6YMU59jWinddDONDAwxhrdhe6YEIC1gy8zwBhjsCUM5fWMBt
+F95S9AetK1Uyr8s8yUwdMd3rp5thgUZxzh5LUCf+Hz++8AzTB/IqntXfFMqEx0JG
+v9lsE04WAKLZSNEXVz4UKFEvGUenNQTk2cbGjrQPqQ81Xrcoll8Rlhzx2IPX/gxz
+48M+bLwHF5+miLzwoJyRyseAX2p/DPySbi/P7SJ51VKK/Jp+0C1Hwj11UFqXw+Rx
+xAGAibju05axhylicB/LmhTYEp8ld+ODPrmKE9ldDQRgUHmxZ0o1bm4fpnvGeMTb
+Lodyz3HPKPgqNwIDAQABo4HhMIHeMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQD
+AgWgMDMGCWCGSAGG+EIBDQQmFiRPcGVuU1NMIEdlbmVyYXRlZCBDbGllbnQgQ2Vy
+dGlmaWNhdGUwHQYDVR0OBBYEFBS196ktsN/hhtBwhkkWMiZkS/OAMB8GA1UdIwQY
+MBaAFMfSf7nYxJX0zHiwlStI0ohcPwcUMA4GA1UdDwEB/wQEAwIF4DAdBgNVHSUE
+FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/
+AAABMA0GCSqGSIb3DQEBCwUAA4ICAQChr2caK6QjIaJEkHtVH9Ik9SnwwCnR3wxU
+mbxyrBvMRrpxKNrTity8atG80yKrJM+va7et1EGaO4I2aEgZ8GAwP9YJiWzijO2C
+zpG0b7QZNUnC/9sP8XNAStsE4hs3dYjAShgiKxSwBG0SDIZnjBqMCRZXhlMMsa3D
+Lhtomwdzfbqu5udP8VnSbQSS/nlOowTY5IXp4sU0wtAqYKdi/LhxSN+0E3ZMqVpX
+RN+d7RTy0GHXgoBEF/95YYjADLblXeUqF4vl5aiNoVNp/2v0V9b/IOStwTl5qVFK
+gW1PCGiSEXKsLYnismlJN4Nv590i5hgOPWjGywTHBMFGg8xvhxGdACwZnYvRQXTu
+zjztQOy9Omy8KS3pq50Pi50GYLUsFbP9aaLAgNcqL8WrgWDmz9nsxMN74aOZJLJy
+bCpn0DJ+bIMLK3tqBdNHTA3xDRq/yGFkneZziLq/LQyC//6WO581I3FrRYjs8ngC
+9nn5O95BBxbn3O9tFtJ9XcZeYXv18h92wKZ5j3iqwOU74mSQ0uNa3+qxjDbWlAtJ
+6qFQMe0MJ2ZnUPncJUyTb0JEMPNh85Zhpxlor5LyBX4kVsns2V3c+zc5IpgaPVIt
+MuVV5GMkF5Hqxd/KWFFbmKkdVtbsjY7/+qQ1ER6/lXVVmgd00w3+J/hLC86QWVSG
+tJzjjgRQmw==
 -----END CERTIFICATE-----
diff --git a/spec/fixtures/certs/generated/client_from_root.jks b/spec/fixtures/certs/generated/client_from_root.jks