Logstash output plugin logs no longer include stream name and request ID

[aadam-ali]

Describe the bug
Prior to v2.x.x of the microsoft-sentinel-log-analytics-logstash-output-plugin the output would emit a log containing the stream name.

Since the release of v2.x.x until v2.2.1 this type of logging didn't exist, though it now has been re-added but is missing information that was present before including:

• Stream name
• Output ID
• Request ID

To Reproduce

To reproduce the old behaviour:

FROM docker.elastic.co/logstash/logstash:8.19.16

RUN cd /usr/share/logstash && \
       bin/logstash-plugin install --version 1.1.4 microsoft-sentinel-log-analytics-logstash-output-plugin

COPY --chown=logstash:logstash --chmod=750 logstash.conf /usr/share/logstash/pipeline/logstash.conf

input {
  generator {
    lines => [
      'Hello World'
    ]
    count => 10
  }
}

output {
      microsoft-sentinel-log-analytics-logstash-output-plugin {
        client_app_Id            => "${SENTINEL_CLIENT_APP_ID}"
        client_app_secret        => "${SENTINEL_CLIENT_APP_SECRET}"
        data_collection_endpoint => "${SENTINEL_DATA_COLLECTION_ENDPOINT}"
        dcr_immutable_id         => "<dcr1-id>"
        dcr_stream_name          => "<dcr1-stream-name>"
        tenant_id                => "${SENTINEL_TENANT_ID}"
      }
      microsoft-sentinel-log-analytics-logstash-output-plugin {
        client_app_Id            => "${SENTINEL_CLIENT_APP_ID}"
        client_app_secret        => "${SENTINEL_CLIENT_APP_SECRET}"
        data_collection_endpoint => "${SENTINEL_DATA_COLLECTION_ENDPOINT}"
        dcr_immutable_id         => "<dcr2-id>"
        dcr_stream_name          => "<dcr2-stream-name>"
        tenant_id                => "${SENTINEL_TENANT_ID}"
      }
}

To reproduce the new behaviour:

FROM docker.elastic.co/logstash/logstash:8.19.16

RUN cd /usr/share/logstash && \
       bin/logstash-plugin install --version 2.2.1 microsoft-sentinel-log-analytics-logstash-output-plugin

COPY --chown=logstash:logstash --chmod=750 logstash.conf /usr/share/logstash/pipeline/logstash.conf

input {
  generator {
    lines => [
      'Hello World'
    ]
    count => 10
  }
}

output {
      microsoft-sentinel-log-analytics-logstash-output-plugin {
        client_id                => "${SENTINEL_CLIENT_APP_ID}"
        client_secret            => "${SENTINEL_CLIENT_APP_SECRET}"
        data_collection_endpoint => "${SENTINEL_DATA_COLLECTION_ENDPOINT}"
        dcr_id                   => "<dcr1-id>"
        stream_name              => "<dcr1-stream-name>"
        tenant_id                => "${SENTINEL_TENANT_ID}"
      }
      microsoft-sentinel-log-analytics-logstash-output-plugin {
        client_id                => "${SENTINEL_CLIENT_APP_ID}"
        client_secret            => "${SENTINEL_CLIENT_APP_SECRET}"
        data_collection_endpoint => "${SENTINEL_DATA_COLLECTION_ENDPOINT}"
        dcr_immutable_id         => "<dcr2-id>"
        dcr_stream_name          => "<dcr2-stream-name>"
        tenant_id                => "${SENTINEL_TENANT_ID}"
      }
}

Steps to reproduce the behavior:

1. Build each of the Dockerfiles
2. Run each of the Dockerfiles
3. Observe the difference in the Logstash logs

Expected behavior

The expected behaviour is a log that contains the DCR stream name and the request ID.

[2026-06-02T14:35:18,896][INFO ][logstash.outputs.microsoftsentineloutput][sentinel][7bcdf1ba19752d96e8a18fa0a2834db6b8a6d1dee5c4a156e0be2af069c6e02d] Successfully posted 100 logs into log analytics DCR stream [Custom-TableName_CL] x-ms-request-id [xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx].

However, the logs for v2.2.1 look like the following.

[2026-06-02T15:07:14,588][INFO ][org.logstashplugins.LogAnalyticsEventsHandler.Workers.SenderWorker] Batch uploaded successfully. Batch size: 2962. Thread id: 39

Screenshots
N/A

Desktop (please complete the following information):

• OS: N/A
• Browser N/A
• Version N/A

Smartphone (please complete the following information):

• Device: N/A
• OS: N/A
• Browser N/A
• Version N/A

Additional context

This has been observed using a dockerised Logstash setup using the base image docker.elastic.co/logstash/logstash:8.19.16.

[madcitygeek]

This appears to be similar to the issue reported in #14251 - Logstash output plugin doesn't support 'id'

[aadam-ali]

I've upgraded to version 2.3.2 and can see that the stream name is now included in the log message.

I'm fairly happy with that, but would still like the request ID, but I don't feel as strongly about it as the stream name.