Merge pull request #151149 from yelevin/yelevin/logstash-change

Added Logstash doc changes

Author: PRMerger9

articles/sentinel/connect-logstash.md

@@ -40,7 +40,9 @@ The Logstash engine is comprised of three components:
 - Output plugins: Customized sending of collected and processed data to various destinations.
 
 > [!NOTE]
-> Azure Sentinel supports its own provided output plugin only. It does not support third-party output plugins for Azure Sentinel, or any other Logstash plugin of any type.
+> - Azure Sentinel supports its own provided output plugin only. The current version of this plugin is v1.0.0, released 2020-08-25. It does not support third-party output plugins for Azure Sentinel, or any other Logstash plugin of any type.
+>
+> - Azure Sentinel's Logstash output plugin supports only **Logstash versions from 7.0 to 7.9**.
 
 The Azure Sentinel output plugin for Logstash sends JSON-formatted data to your Log Analytics workspace, using the Log Analytics HTTP Data Collector REST API. The data is ingested into custom logs.
 
@@ -63,19 +65,21 @@ Use the information in the Logstash [Structure of a config file](https://www.ela
 
 | Field name | Data type | Description |
 |----------------|---------------|-----------------|
-| `workspace_id` | string | Enter your workspace ID GUID. * |
-| `workspace_key` | string | Enter your workspace primary key GUID. * |
+| `workspace_id` | string | Enter your workspace ID GUID (see Tip). |
+| `workspace_key` | string | Enter your workspace primary key GUID (see Tip). |
 | `custom_log_table_name` | string | Set the name of the table into which the logs will be ingested. Only one table name per output plugin can be configured. The log table will appear in Azure Sentinel under **Logs**, in **Tables** in the **Custom Logs** category, with a `_CL` suffix. |
 | `endpoint` | string | Optional field. By default, this is the Log Analytics endpoint. Use this field to set an alternative endpoint. |
 | `time_generated_field` | string | Optional field. This property overrides the default **TimeGenerated** field in Log Analytics. Enter the name of the timestamp field in the data source. The data in the field must conform to the ISO 8601 format (`YYYY-MM-DDThh:mm:ssZ`) |
 | `key_names` | array | Enter a list of Log Analytics output schema fields. Each list item should be enclosed in single quotes and the items separated by commas, and the entire list enclosed in square brackets. See example below. |
 | `plugin_flush_interval` | number | Optional field. Set to define the maximum interval (in seconds) between message transmissions to Log Analytics. The default is 5. |
-    | `amount_resizing` | boolean | True or false. Enable or disable the automatic scaling mechanism, which adjusts the message buffer size according to the volume of log data received. |
+| `amount_resizing` | boolean | True or false. Enable or disable the automatic scaling mechanism, which adjusts the message buffer size according to the volume of log data received. |
 | `max_items` | number | Optional field. Applies only if `amount_resizing` set to "false." Use to set a cap on the message buffer size (in records). The default is 2000.  |
 | `azure_resource_id` | string | Optional field. Defines the ID of the Azure resource where the data resides. <br>The resource ID value is especially useful if you are using [resource-context RBAC](resource-context-rbac.md) to provide access to specific data only. |
 | | | |
 
-* You can find the workspace ID and primary key in the workspace resource, under **Agents management**.
+> [!TIP]
+> - You can find the workspace ID and primary key in the workspace resource, under **Agents management**.
+> - **However**, because having credentials and other sensitive information stored in cleartext in configuration files is not in line with security best practices, you are strongly encouraged to make use of the **Logstash key store** in order to securely include your **workspace ID** and **workspace primary key** in the configuration. See [Elastic's documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/get-started-logstash-user.html) for instructions.
 
 #### Sample configurations
 
@@ -171,5 +175,5 @@ If you are not seeing any data in this log file, generate and send some events l
 ## Next steps
 
 In this document, you learned how to use Logstash to connect external data sources to Azure Sentinel. To learn more about Azure Sentinel, see the following articles:
-- Learn how to [get visibility into your data, and potential threats](quickstart-get-visibility.md).
+- Learn how to [get visibility into your data and potential threats](quickstart-get-visibility.md).
 - Get started detecting threats with Azure Sentinel, using [built-in](tutorial-detect-threats-built-in.md) or [custom](tutorial-detect-threats-custom.md) rules.