From 188a34eb31599444824f824ea93c9219c6f1b8d6 Mon Sep 17 00:00:00 2001
From: Rusty Wilson <rwilson@iinfosec.com>
Date: Sun, 4 Mar 2018 18:38:17 -0600
Subject: [PATCH] Added ssl_certificate_verification

Added capability to ignore ssl certificate verification
---
 lib/logstash/inputs/elasticsearch.rb | 64 ++++++----------------------
 1 file changed, 12 insertions(+), 52 deletions(-)

diff --git a/lib/logstash/inputs/elasticsearch.rb b/lib/logstash/inputs/elasticsearch.rb
index bab4bd7..2702a43 100644
--- a/lib/logstash/inputs/elasticsearch.rb
+++ b/lib/logstash/inputs/elasticsearch.rb
@@ -10,13 +10,11 @@
 # called `http.content_type.required`. If this option is set to `true`, and you
 # are using Logstash 2.4 through 5.2, you need to update the Elasticsearch input
 # plugin to version 4.0.2 or higher.
-# 
+#
 # ================================================================================
-# 
+#
 # Read from an Elasticsearch cluster, based on search query results.
 # This is useful for replaying test logs, reindexing, etc.
-# It also supports periodically scheduling lookup enrichments
-# using a cron syntax (see `schedule` setting).
 #
 # Example:
 # [source,ruby]
@@ -39,24 +37,6 @@
 #       "sort": [ "_doc" ]
 #     }'
 #
-# ==== Scheduling
-#
-# Input from this plugin can be scheduled to run periodically according to a specific
-# schedule. This scheduling syntax is powered by https://github.com/jmettraux/rufus-scheduler[rufus-scheduler].
-# The syntax is cron-like with some extensions specific to Rufus (e.g. timezone support ).
-#
-# Examples:
-#
-# |==========================================================
-# | `* 5 * 1-3 *`               | will execute every minute of 5am every day of January through March.
-# | `0 * * * *`                 | will execute on the 0th minute of every hour every day.
-# | `0 6 * * * America/Chicago` | will execute at 6:00am (UTC/GMT -5) every day.
-# |==========================================================
-#
-#
-# Further documentation describing this syntax can be found https://github.com/jmettraux/rufus-scheduler#parsing-cronlines-and-time-strings[here].
-#
-#
 class LogStash::Inputs::Elasticsearch < LogStash::Inputs::Base
   config_name "elasticsearch"
 
@@ -130,20 +110,15 @@ class LogStash::Inputs::Elasticsearch < LogStash::Inputs::Base
 
   # SSL
   config :ssl, :validate => :boolean, :default => false
+  
+  # ssl_certificate_verification - Disable ssl_verification with false
+  config :ssl_certificate_verification, :validate => :boolean, :default => true
 
-  # SSL Certificate Authority file in PEM encoded format, must also include any chain certificates as necessary 
+  # SSL Certificate Authority file in PEM encoded format, must also include any chain certificates as necessary
   config :ca_file, :validate => :path
 
-  # Schedule of when to periodically run statement, in Cron format
-  # for example: "* * * * *" (execute query every minute, on the minute)
-  #
-  # There is no schedule by default. If no schedule is given, then the statement is run
-  # exactly once.
-  config :schedule, :validate => :string
-
   def register
     require "elasticsearch"
-    require "rufus/scheduler"
 
     @options = {
       :index => @index,
@@ -168,34 +143,17 @@ def register
       @hosts
     end
 
-    if @ssl && @ca_file
+    if @ssl && !@ssl_certificate_verification
+      transport_options[:ssl] = { :verify => @ssl_certificate_verification }
+    elsif @ssl && @ca_file
       transport_options[:ssl] = { :ca_file => @ca_file }
     end
+    
 
     @client = Elasticsearch::Client.new(:hosts => hosts, :transport_options => transport_options)
   end
 
-
   def run(output_queue)
-    if @schedule
-      @scheduler = Rufus::Scheduler.new(:max_work_threads => 1)
-      @scheduler.cron @schedule do
-        do_run(output_queue)
-      end
-
-      @scheduler.join
-    else
-      do_run(output_queue)
-    end
-  end
-
-  def stop
-    @scheduler.stop if @scheduler
-  end
-
-  private
-
-  def do_run(output_queue)
     # get first wave of data
     r = @client.search(@options)
 
@@ -208,6 +166,8 @@ def do_run(output_queue)
     end
   end
 
+  private
+
   def process_next_scroll(output_queue, scroll_id)
     r = scroll_request(scroll_id)
     r['hits']['hits'].each { |hit| push_hit(hit, output_queue) }