fix: preserve integer/float types in Logstash plugin serialization (#14272)

[dcaayushd]

Change(s):

• Modified logStashEventsBatcher.rb to detect and preserve native integer and float types during JSON serialization
• Updated customSizeBasedBuffer.rb, logStashAutoResizeBuffer.rb, logStashCompressedStream.rb, and sampleFileCreator.rb with related type handling fixes
• Added specs in spec/ to cover integer and float field serialization

Reason for Change(s):

• Plugin v2.x was converting numeric fields like SourcePort, DestinationPort and SentBytes to strings during serialization, causing fields to be silently dropped when ingested via DCRs with strict column types like int or real
• Plugin v1.x preserved these types correctly, this restores that behavior
• Resolves Logstash output plugin 2.x loss of integer type fidelity for numeric fields (e.g., ports) #14272

Version Updated:

• N/A (this is a plugin bug fix, not a Detections/Analytic Rule template)

Testing Completed:

• Yes, tested locally with Logstash 8 by sending events with integer and float fields and verifying the serialized JSON payload contains numeric values instead of quoted strings
• Added unit tests in spec/ covering the fix

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR restores v1.x behavior by switching the Logstash plugin’s JSON serialization to LogStash::Json, preserving native integer/float types so DCR ingestion won’t drop strictly-typed numeric columns.

Changes:

• Replaced .to_json usage with LogStash::Json.dump across buffering/compression/sample-file paths to preserve numeric types.
• Added a minimal LogStash::Json shim for the spec environment (avoids loading logstash-core).
• Added an RSpec that validates integers/floats remain JSON numbers after serialization.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/spec/support/logstash/json.rb	Adds a minimal LogStash::Json shim for unit tests.
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/spec/outputs/serialization_spec.rb	Adds spec coverage asserting numeric fields remain numeric after serialization.
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/sampleFileCreator.rb	Uses LogStash::Json.dump when writing sample payloads.
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logStashEventsBatcher.rb	Uses LogStash::Json.dump for document-size calculation.
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logStashCompressedStream.rb	Uses LogStash::Json.dump when adding events to the compressed stream.
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/logStashAutoResizeBuffer.rb	Uses LogStash::Json.dump for payload serialization and sizing.
DataConnectors/microsoft-sentinel-log-analytics-logstash-output-plugin/lib/logstash/sentinel_la/customSizeBasedBuffer.rb	Uses LogStash::Json.dump for var_size calculation.

[v-atulyadav]

Hi @dcaayushd,

Please check Copilot’s suggestions and act accordingly. Once done, click the “Resolve conversation” button. Thanks