What Changed

This PR reorganises the Logstash output plugin directory structure to formally separate the deprecated Ruby plugin (1.x.x) from the active Java plugin (2.x.x):

  • The existing microsoft-sentinel-log-analytics-logstash-output-plugin/ directory now carries prominent deprecation banners in both README.md and CHANGELOG.md, reverting documentation to reflect the last Ruby version (1.2.0, released 2026-02-05).
  • A new microsoft-sentinel-log-analytics-logstash-output-plugin_java/ directory is created to house documentation for the Java-based version, which will be linked from RubyGems.org as the authoritative source.
  • The Java plugin changelog entries (2.0.0 through 2.3.0) including the closed-source refactor, managed identity support, DCR stream logging, and Logstash 9.4 compatibility have been removed from the Ruby directory and relocated to the Java directory.

Security Impact

No detection gap or ingestion disruption introduced. This is a documentation reorganisation, not a functional change to either plugin version.

However, operators should be aware:

  • Any deployment still running the Ruby plugin (1.x.x) is on a no-longer-maintained code path. Security fixes, new Logstash version compatibility, and DCR API changes will only be addressed in the Java version.
  • The Ruby plugin README now explicitly lists supported Logstash versions up to 9.2.5, and notes that compatibility with newer versions is neither guaranteed nor supported.
  • The Java version managed identity improvements (AKS Workload Identity, Azure Arc, IMDS fallback chain) are not available to Ruby plugin users. Environments relying on managed identity authentication should migrate to the Java version.

Recommended action: Verify which plugin version is running in your Logstash pipelines. If running 1.x.x, plan migration to the Java version (2.x.x).

Affected Files

DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/CHANGELOG.md
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/README.md
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin_java/CHANGELOG.md
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin_java/README.md