azureeventhub: remove deprecated processor v1 implementation

.github/dependabot.yml

@@ -40,8 +40,6 @@ updates:
       - dependency-name: github.com/aws/smithy-go/*
       # Azure SDK dependencies
       - dependency-name: github.com/Azure/azure-sdk-for-go/*
-      - dependency-name: github.com/Azure/azure-event-hubs-go/*
-      - dependency-name: github.com/Azure/azure-storage-blob-go/*
       - dependency-name: github.com/Azure/go-autorest/*
       # GCP SDK dependencies
       - dependency-name: cloud.google.com/go/*

.gitignore

@@ -1,4 +1,5 @@
 # Directories
+/.worktrees
 /.vagrant
 /.idea
 /.vscode

changelog/fragments/1774907084-remove-azureeventhub-processor-v1.yaml

@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: security
+
+# Change summary; a 80ish characters long description of the change.
+summary: Remove the Event Hub processor v1
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+description: Remove the Event Hub processor v1, which is using the old Azure SDK. The new Event Hub processor v2, which is using the new Azure SDK, should be used instead.
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: filebeat
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+pr: https://github.com/elastic/beats/pull/49772
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234

docs/reference/filebeat/filebeat-input-azure-eventhub.md

@@ -9,35 +9,15 @@
 
 # Azure eventhub input [filebeat-input-azure-eventhub]
 
-Use the `azure-eventhub` input to read messages from an Azure EventHub. The azure-eventhub input implementation is based on the event processor host. EPH is intended to be run across multiple processes and machines while load balancing message consumers more on this here [https://github.com/Azure/azure-event-hubs-go#event-processor-host](https://github.com/Azure/azure-event-hubs-go#event-processor-host), [https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-event-processor-host](https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-event-processor-host). 
+Use the `azure-eventhub` input to read messages from an Azure Event Hub. The input uses the [Azure Event Hubs SDK for Go](https://github.com/Azure/azure-sdk-for-go/tree/main/sdk/messaging/azeventhubs) to consume events with load-balanced partition processing across multiple instances.
 
 State such as leases on partitions and checkpoints in the event stream are shared between receivers using an Azure Storage container. For this reason, as a prerequisite to using this input, you must create or use an existing storage account.
 
-Enable internal logs tracing for this input by setting the environment variable `BEATS_AZURE_EVENTHUB_INPUT_TRACING_ENABLED: true`. When enabled, this input will log additional information to the logs. Additional information includes partition ownership, blob lease information, and other internal state.
-
 ## Example configurations
 
-### Connection string authentication (processor v1)
-
-**Note:** Processor v1 only supports connection string authentication.
-
-Example configuration using connection string authentication with processor v1:
-
-```yaml
-filebeat.inputs:
-- type: azure-eventhub
-  eventhub: "insights-operational-logs"
-  consumer_group: "$Default"
-  connection_string: "Endpoint=sb://your-namespace.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=your-shared-access-key"
-  storage_account: "your-storage-account"
-  storage_account_key: "your-storage-account-key"
-  storage_account_container: "your-storage-container"
-  processor_version: "v1"
-```
-
-### Connection string authentication (processor v2)
+### Connection string authentication
 
-Example configuration using connection string authentication with processor v2:
+Example configuration using connection string authentication:
 
 ```yaml
 filebeat.inputs:
@@ -51,13 +31,13 @@
   storage_account_container: "your-storage-container"
 ```
 
-### Client secret authentication (processor v2)
+### Client secret authentication
 
 ```{applies_to}
 stack: ga 9.3.0+
 ```
 
-Example configuration using Azure Active Directory service principal authentication with processor v2:
+Example configuration using Azure Active Directory service principal authentication:
 
 ```yaml
 filebeat.inputs:
@@ -77,13 +57,13 @@
 When using `client_secret` authentication, the service principal must have the appropriate Azure RBAC permissions. See [Required permissions](#_required_permissions) for details.
 :::
 
-### Managed identity authentication (processor v2)
+### Managed identity authentication
 
 ```{applies_to}
 stack: ga 9.2.6+
 ```
 
-Example configuration using Azure Managed Identity authentication with processor v2. This is ideal for workloads running on Azure VMs, Azure Container Apps, Azure Kubernetes Service (AKS), or other Azure services that support managed identities.
+Example configuration using Azure Managed Identity authentication. This is ideal for workloads running on Azure VMs, Azure Container Apps, Azure Kubernetes Service (AKS), or other Azure services that support managed identities.
 
 :::{important}
 Available starting from {{filebeat}} 9.2.6 and later, 9.3.1 and later, 9.4.0 and later, and {{stack}} 8.19.12 and later.
@@ -261,16 +241,91 @@
 
 ### `storage_account_key` [_storage_account_key]
 
-The storage account key, this key will be used to authorize access to data in your storage account, option is required.
+::::{deprecated} 9.0.0
+Use [`storage_account_connection_string`](#_storage_account_connection_string) instead. When `storage_account_key` is set together with `storage_account`, the input auto-constructs a connection string for backward compatibility, but this behavior will be removed in a future release.
+::::
+
+The storage account key. When using `connection_string` authentication, you can provide either `storage_account_connection_string` (recommended) or `storage_account_key` together with `storage_account` to auto-construct the connection string. Not required when using `client_secret` or `managed_identity` authentication.
+
+### `storage_account_connection_string` [_storage_account_connection_string]
+
+The connection string for the storage account used to store partition ownership and checkpoint information. Required when using `connection_string` authentication. Not required when using `client_secret` or `managed_identity` authentication, as the storage account uses the same credentials as the Event Hub.
 
 ### `storage_account_container` [_storage_account_container]
 
 Optional, the name of the storage account container you would like to store the offset information in.
 
 ### `resource_manager_endpoint` [_resource_manager_endpoint]
 
+::::{deprecated} 9.0.0
+Use [`authority_host`](#_authority_host) instead to control the cloud environment. The `resource_manager_endpoint` option will be removed in a future release.
+::::
+
 Optional, by default we are using the azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different azure environment. Ex: [https://management.chinacloudapi.cn/](https://management.chinacloudapi.cn/) for azure ChinaCloud [https://management.microsoftazure.de/](https://management.microsoftazure.de/) for azure GermanCloud [https://management.azure.com/](https://management.azure.com/) for azure PublicCloud [https://management.usgovcloudapi.net/](https://management.usgovcloudapi.net/) for azure USGovernmentCloud Users can also use this in case of a Hybrid Cloud model, where one may define their own endpoints.
 
+### `sanitize_options` [_sanitize_options]
+
+::::{deprecated} 9.0.0
+Use [`sanitizers`](#_sanitizers) instead. The `sanitize_options` option will be removed in a future release.
+::::
+
+Optional. A list of legacy sanitization options to apply to messages that contain invalid JSON. Supported values: `NEW_LINES`, `SINGLE_QUOTES`.
+
+### `sanitizers` [_sanitizers]
+
+Optional. A list of sanitizers to apply to messages that contain invalid JSON. Each sanitizer has a `type` and an optional `spec` for additional configuration.
+
+Supported sanitizer types:
+- `new_lines`: Removes new lines inside JSON strings.
+- `single_quotes`: Replaces single quotes with double quotes in JSON strings.
+- `replace_all`: Replaces all occurrences of a substring matching a regex `pattern` with a fixed literal string `replacement`. Requires a `spec` with `pattern` and `replacement` fields.
+
+Example:
+
+```yaml
+sanitizers:
+  - type: new_lines
+  - type: single_quotes
+  - type: replace_all
+    spec:
+      pattern: '\[\s*([^\[\]{},\s]+(?:\s+[^\[\]{},\s]+)*)\s*\]'
+      replacement: "{}"
+```
+
+### `transport` [_transport]
+
+The transport protocol used for the Event Hub connection. Default: `amqp`.
+
+Valid values:
+- `amqp` (default): Uses the standard AMQP protocol over port 5671.
+- `websocket`: Uses AMQP over WebSockets. Use this when connecting through HTTP proxies or when port 5671 is blocked.
+
+### `processor_update_interval` [_processor_update_interval]
+
+Controls how often the input attempts to claim partitions. Default: `10s`. Minimum: `1s`.
+
+### `processor_start_position` [_processor_start_position]
+
+Controls the start position for all partitions when no checkpoint exists. Default: `earliest`.
+
+Valid values:
+- `earliest`: Start reading from the earliest available event in each partition.
+- `latest`: Start reading from the latest event, ignoring any events that were sent before the input started.
+
+### `partition_receive_timeout` [_partition_receive_timeout]
+
+Controls the maximum time the partition client waits for events before returning a batch. Works together with `partition_receive_count` — the client returns whichever threshold is reached first. Default: `5s`. Minimum: `1s`.
+
+### `partition_receive_count` [_partition_receive_count]
+
+Controls the minimum number of events the partition client tries to receive before returning a batch. Works together with `partition_receive_timeout` — the client returns whichever threshold is reached first. Default: `100`. Minimum: `1`.
+
+### `migrate_checkpoint` [_migrate_checkpoint]
+
+Controls whether the input migrates checkpoint information from the legacy format to the current format on startup. Default: `true`.
+
+Set this to `true` when upgrading from an older version of {{filebeat}} that used the previous Event Hub processor, to avoid reprocessing events from the beginning of the retention period.
+
 ## Metrics [_metrics_3]
 
 This input exposes metrics under the [HTTP monitoring endpoint](/reference/filebeat/http-endpoint.md). These metrics are exposed under the `/inputs` path. They can be used to observe the activity of the input.

go.mod

@@ -9,7 +9,6 @@ require (
 	code.cloudfoundry.org/go-diodes v0.0.0-20190809170250-f77fb823c7ee // indirect
 	code.cloudfoundry.org/go-loggregator v7.4.0+incompatible
 	code.cloudfoundry.org/rfc5424 v0.0.0-20180905210152-236a6d29298a // indirect
-	github.com/Azure/azure-event-hubs-go/v3 v3.6.1
 	github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Azure/go-autorest/autorest v0.11.30
@@ -46,7 +45,6 @@ require (
 	github.com/containerd/fifo v1.1.0
 	github.com/coreos/go-systemd/v22 v22.6.0
 	github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f
-	github.com/devigned/tab v0.1.2-0.20190607222403-0c15cf42f9a2
 	github.com/digitalocean/go-libvirt v0.0.0-20240709142323-d8406205c752
 	github.com/docker/docker v28.5.2+incompatible
 	github.com/docker/go-connections v0.6.0
@@ -96,7 +94,6 @@ require (
 	github.com/insomniacslk/dhcp v0.0.0-20251020182700-175e84fbb167
 	github.com/jonboulle/clockwork v0.2.2
 	github.com/josephspurrier/goversioninfo v1.5.0
-	github.com/jpillora/backoff v1.0.0 // indirect
 	github.com/lib/pq v1.10.9
 	github.com/magefile/mage v1.15.0
 	github.com/mattn/go-colorable v0.1.13 // indirect
@@ -158,7 +155,6 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/monitor/armmonitor v0.8.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.0
-	github.com/Azure/azure-storage-blob-go v0.15.0
 	github.com/aerospike/aerospike-client-go/v7 v7.7.1
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.79
@@ -285,13 +281,10 @@ require (
 	cloud.google.com/go/longrunning v0.6.7 // indirect
 	code.cloudfoundry.org/gofileutils v0.0.0-20170111115228-4d0c80011a0f // indirect
 	filippo.io/edwards25519 v1.1.1 // indirect
-	github.com/Azure/azure-amqp-common-go/v4 v4.2.0 // indirect
-	github.com/Azure/azure-pipeline-go v0.2.3 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/go-amqp v1.4.0 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest/adal v0.9.24 // indirect
-	github.com/Azure/go-autorest/autorest/to v0.4.1 // indirect
 	github.com/Azure/go-autorest/autorest/validation v0.3.2 // indirect
 	github.com/Azure/go-autorest/logger v0.2.2 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.1 // indirect
@@ -416,7 +409,6 @@ require (
 	github.com/lestrrat-go/strftime v1.1.1 // indirect
 	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-ieproxy v0.0.1 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mileusna/useragent v1.3.5 // indirect