From cc91af34b04210f2529544413a8f427c0ce28e23 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Tue, 11 Nov 2025 14:22:49 -0800
Subject: [PATCH 01/14] WIP: Rewrite Env2yaml in java instead of Go

Managing a Go toolchain for persisting ENV vars in logstash container artifacts
has become cumbersome. We already manage a java runtime so this commit presents
a path forward to use that instead of Go. The Go binary is faster than java (in
my testing Go would complete in around less than 200ms while java takes over
300ms). Given the container startup time is on the order of magnitute of seconds
this change should be inperceptable to consumers. The benefit from consolidating
in Java is worth the slightly lower performance.
---
 docker/Makefile                             |  19 +-
 docker/data/logstash/env2yaml/Env2Yaml.java | 193 +++++++++++++++++++
 docker/data/logstash/env2yaml/env2yaml      |   8 +
 docker/data/logstash/env2yaml/env2yaml.go   | 199 --------------------
 docker/templates/Dockerfile.erb             |  16 +-
 5 files changed, 213 insertions(+), 222 deletions(-)
 create mode 100644 docker/data/logstash/env2yaml/Env2Yaml.java
 create mode 100644 docker/data/logstash/env2yaml/env2yaml
 delete mode 100644 docker/data/logstash/env2yaml/env2yaml.go

diff --git a/docker/Makefile b/docker/Makefile
index c220f57f898..644ca4e7a6e 100644
--- a/docker/Makefile
+++ b/docker/Makefile
@@ -69,7 +69,7 @@ build-from-local-observability-sre-artifacts: dockerfile
 
 COPY_FILES := $(ARTIFACTS_DIR)/docker/config/pipelines.yml $(ARTIFACTS_DIR)/docker/config/logstash-oss.yml $(ARTIFACTS_DIR)/docker/config/logstash-full.yml
 COPY_FILES += $(ARTIFACTS_DIR)/docker/config/log4j2.file.properties $(ARTIFACTS_DIR)/docker/config/log4j2.properties
-COPY_FILES += $(ARTIFACTS_DIR)/docker/env2yaml/env2yaml.go $(ARTIFACTS_DIR)/docker/env2yaml/go.mod $(ARTIFACTS_DIR)/docker/env2yaml/go.sum
+COPY_FILES += $(ARTIFACTS_DIR)/docker/env2yaml/Env2Yaml.java $(ARTIFACTS_DIR)/docker/env2yaml/env2yaml
 COPY_FILES += $(ARTIFACTS_DIR)/docker/pipeline/default.conf $(ARTIFACTS_DIR)/docker/bin/docker-entrypoint
 
 $(ARTIFACTS_DIR)/docker/config/pipelines.yml: data/logstash/config/pipelines.yml
@@ -79,9 +79,8 @@ $(ARTIFACTS_DIR)/docker/config/log4j2.file.properties: data/logstash/config/log4
 $(ARTIFACTS_DIR)/docker/config/log4j2.properties: data/logstash/config/log4j2.properties
 $(ARTIFACTS_DIR)/docker/pipeline/default.conf: data/logstash/pipeline/default.conf
 $(ARTIFACTS_DIR)/docker/bin/docker-entrypoint: data/logstash/bin/docker-entrypoint
-$(ARTIFACTS_DIR)/docker/env2yaml/env2yaml.go: data/logstash/env2yaml/env2yaml.go
-$(ARTIFACTS_DIR)/docker/env2yaml/go.mod: data/logstash/env2yaml/go.mod
-$(ARTIFACTS_DIR)/docker/env2yaml/go.sum: data/logstash/env2yaml/go.sum
+$(ARTIFACTS_DIR)/docker/env2yaml/Env2Yaml.java: data/logstash/env2yaml/Env2Yaml.java
+$(ARTIFACTS_DIR)/docker/env2yaml/env2yaml: data/logstash/env2yaml/env2yaml
 
 $(ARTIFACTS_DIR)/docker/%:
 	cp -f $< $@
@@ -95,8 +94,8 @@ docker_paths:
 
 COPY_IRONBANK_FILES := $(ARTIFACTS_DIR)/ironbank/scripts/config/pipelines.yml $(ARTIFACTS_DIR)/ironbank/scripts/config/logstash.yml
 COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.file.properties $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.properties
-COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint $(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/env2yaml.go
-COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/go.mod $(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/go.sum $(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/vendor/modules.txt $(ARTIFACTS_DIR)/ironbank/LICENSE $(ARTIFACTS_DIR)/ironbank/README.md
+COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint $(ARTIFACTS_DIR)/ironbank/scripts/java/Env2Yaml.java
+COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/java/env2yaml $(ARTIFACTS_DIR)/ironbank/LICENSE $(ARTIFACTS_DIR)/ironbank/README.md
 
 $(ARTIFACTS_DIR)/ironbank/scripts/config/pipelines.yml: data/logstash/config/pipelines.yml
 $(ARTIFACTS_DIR)/ironbank/scripts/config/logstash.yml: data/logstash/config/logstash-full.yml
@@ -104,10 +103,8 @@ $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.file.properties: data/logstash/c
 $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.properties: data/logstash/config/log4j2.properties
 $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf: data/logstash/pipeline/default.conf
 $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint: data/logstash/bin/docker-entrypoint
-$(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/env2yaml.go: data/logstash/env2yaml/env2yaml.go
-$(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/go.mod: ironbank/go/src/env2yaml/go.mod
-$(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/go.sum: ironbank/go/src/env2yaml/go.sum
-$(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/vendor/modules.txt: ironbank/go/src/env2yaml/vendor/modules.txt
+$(ARTIFACTS_DIR)/ironbank/scripts/java/Env2Yaml.java: data/logstash/env2yaml/Env2Yaml.java
+$(ARTIFACTS_DIR)/ironbank/scripts/java/env2yaml: data/logstash/env2yaml/env2yaml
 $(ARTIFACTS_DIR)/ironbank/LICENSE: ironbank/LICENSE
 $(ARTIFACTS_DIR)/ironbank/README.md: ironbank/README.md
 
@@ -119,7 +116,7 @@ ironbank_docker_paths:
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/bin
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/config
-	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/go/src/env2yaml/vendor
+	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/java
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/pipeline
 
 public-dockerfiles: public-dockerfiles_oss public-dockerfiles_full public-dockerfiles_wolfi public-dockerfiles_observability-sre public-dockerfiles_ironbank
diff --git a/docker/data/logstash/env2yaml/Env2Yaml.java b/docker/data/logstash/env2yaml/Env2Yaml.java
new file mode 100644
index 00000000000..865237da0e3
--- /dev/null
+++ b/docker/data/logstash/env2yaml/Env2Yaml.java
@@ -0,0 +1,193 @@
+import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.DumperOptions;
+import java.io.*;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.*;
+import java.nio.file.attribute.*;
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+import java.util.*;
+
+/**
+ * Environment variable to YAML configuration merger
+ *
+ * Takes environment variables and merges them into logstash.yml
+ * Example: docker run -e pipeline.workers=6
+ * or: docker run -e PIPELINE_WORKERS=6
+ * Result: pipeline.workers: 6 in logstash.yml
+ */
+public class Env2Yaml {
+    private static final DateTimeFormatter TIMESTAMP_FORMAT = DateTimeFormatter.ofPattern("yyyy/MM/dd HH:mm:ss");
+    private static class SettingValidator {
+        private final Map<String, String> normalizedToCanonical;
+
+        public SettingValidator() {
+            this.normalizedToCanonical = buildSettingMap();
+        }
+
+        private Map<String, String> buildSettingMap() {
+            Map<String, String> map = new HashMap<>();
+            String[] allowedConfigs = {
+                "api.enabled", "api.http.host", "api.http.port", "api.environment",
+                "node.name", "path.data", "pipeline.id", "pipeline.workers",
+                "pipeline.output.workers", "pipeline.batch.size", "pipeline.batch.delay",
+                "pipeline.unsafe_shutdown", "pipeline.ecs_compatibility", "pipeline.ordered",
+                "pipeline.plugin_classloaders", "pipeline.separate_logs", "path.config",
+                "config.string", "config.test_and_exit", "config.reload.automatic",
+                "config.reload.interval", "config.debug", "config.support_escapes",
+                "config.field_reference.escape_style", "queue.type", "path.queue",
+                "queue.page_capacity", "queue.max_events", "queue.max_bytes",
+                "queue.checkpoint.acks", "queue.checkpoint.writes", "queue.checkpoint.interval",
+                "queue.compression", "queue.drain", "dead_letter_queue.enable",
+                "dead_letter_queue.max_bytes", "dead_letter_queue.flush_interval",
+                "dead_letter_queue.storage_policy", "dead_letter_queue.retain.age",
+                "path.dead_letter_queue", "log.level", "log.format",
+                "log.format.json.fix_duplicate_message_fields", "metric.collect",
+                "path.logs", "path.plugins", "api.auth.type", "api.auth.basic.username",
+                "api.auth.basic.password", "api.auth.basic.password_policy.mode",
+                "api.auth.basic.password_policy.length.minimum", "api.auth.basic.password_policy.include.upper",
+                "api.auth.basic.password_policy.include.lower", "api.auth.basic.password_policy.include.digit",
+                "api.auth.basic.password_policy.include.symbol", "allow_superuser",
+                "monitoring.cluster_uuid", "xpack.monitoring.allow_legacy_collection",
+                "xpack.monitoring.enabled", "xpack.monitoring.collection.interval",
+                "xpack.monitoring.elasticsearch.hosts", "xpack.monitoring.elasticsearch.username",
+                "xpack.monitoring.elasticsearch.password", "xpack.monitoring.elasticsearch.proxy",
+                "xpack.monitoring.elasticsearch.api_key", "xpack.monitoring.elasticsearch.cloud_auth",
+                "xpack.monitoring.elasticsearch.cloud_id", "xpack.monitoring.elasticsearch.sniffing",
+                "xpack.monitoring.elasticsearch.ssl.certificate_authority", "xpack.monitoring.elasticsearch.ssl.ca_trusted_fingerprint",
+                "xpack.monitoring.elasticsearch.ssl.verification_mode", "xpack.monitoring.elasticsearch.ssl.truststore.path",
+                "xpack.monitoring.elasticsearch.ssl.truststore.password", "xpack.monitoring.elasticsearch.ssl.keystore.path",
+                "xpack.monitoring.elasticsearch.ssl.keystore.password", "xpack.monitoring.elasticsearch.ssl.certificate",
+                "xpack.monitoring.elasticsearch.ssl.key", "xpack.monitoring.elasticsearch.ssl.cipher_suites",
+                "xpack.management.enabled", "xpack.management.logstash.poll_interval",
+                "xpack.management.pipeline.id", "xpack.management.elasticsearch.hosts",
+                "xpack.management.elasticsearch.username", "xpack.management.elasticsearch.password",
+                "xpack.management.elasticsearch.proxy", "xpack.management.elasticsearch.api_key",
+                "xpack.management.elasticsearch.cloud_auth", "xpack.management.elasticsearch.cloud_id",
+                "xpack.management.elasticsearch.sniffing", "xpack.management.elasticsearch.ssl.certificate_authority",
+                "xpack.management.elasticsearch.ssl.ca_trusted_fingerprint", "xpack.management.elasticsearch.ssl.verification_mode",
+                "xpack.management.elasticsearch.ssl.truststore.path", "xpack.management.elasticsearch.ssl.truststore.password",
+                "xpack.management.elasticsearch.ssl.keystore.path", "xpack.management.elasticsearch.ssl.keystore.password",
+                "xpack.management.elasticsearch.ssl.certificate", "xpack.management.elasticsearch.ssl.key",
+                "xpack.management.elasticsearch.ssl.cipher_suites", "xpack.geoip.download.endpoint",
+                "xpack.geoip.downloader.enabled"
+            };
+
+            for (String configName : allowedConfigs) {
+                String normalizedKey = normalizeKey(configName);
+                map.put(normalizedKey, configName);
+            }
+            return map;
+        }
+
+        public String findCanonicalSetting(String envVarName) {
+            String normalized = normalizeKey(envVarName);
+            return normalizedToCanonical.get(normalized);
+        }
+    }
+
+    private static String normalizeKey(String key) {
+        return key.toLowerCase()
+                 .replace(".", "")
+                 .replace("_", "");
+    }
+
+    public static void main(String[] args) {
+        if (args.length != 1) {
+            System.err.println("usage: env2yaml FILENAME");
+            System.exit(1);
+        }
+
+        try {
+            new Env2Yaml().processConfigFile(args[0]);
+        } catch (Exception e) {
+            System.err.println("error: " + e.getMessage());
+            System.exit(1);
+        }
+    }
+
+    private void processConfigFile(String configPath) throws Exception {
+        Path fileLocation = Paths.get(configPath);
+        Yaml yamlProcessor = new Yaml();
+
+        Map<String, Object> configData = loadExistingConfig(fileLocation, yamlProcessor);
+
+        SettingValidator validator = new SettingValidator();
+        boolean addedNewConfigs = incorporateEnvironmentVars(configData, validator);
+
+        if (addedNewConfigs) {
+            saveUpdatedConfig(fileLocation, yamlProcessor, configData);
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    private Map<String, Object> loadExistingConfig(Path fileLocation, Yaml yamlProcessor) throws Exception {
+        if (!Files.exists(fileLocation)) {
+            return new HashMap<>();
+        }
+
+        try (InputStream fileInput = Files.newInputStream(fileLocation)) {
+            Object parsedData = yamlProcessor.load(fileInput);
+            return parsedData instanceof Map ? (Map<String, Object>) parsedData : new HashMap<>();
+        }
+    }
+
+    private boolean incorporateEnvironmentVars(Map<String, Object> configData, SettingValidator validator) {
+        boolean addedNewConfigs = false;
+
+        for (Map.Entry<String, String> envEntry : System.getenv().entrySet()) {
+            String envVarName = envEntry.getKey();
+            String envValue = envEntry.getValue();
+            // Skip empty values like Go version does
+            if (envValue == null || envValue.trim().isEmpty()) {
+                continue;
+            }
+            String canonicalSetting = validator.findCanonicalSetting(envVarName);
+
+            if (canonicalSetting != null) {
+                addedNewConfigs = true;
+                System.err.println(LocalDateTime.now().format(TIMESTAMP_FORMAT) + " Setting '" + canonicalSetting + "' from environment.");
+                configData.put(canonicalSetting, "${" + envVarName + "}");
+            }
+        }
+
+        return addedNewConfigs;
+    }
+
+    private void saveUpdatedConfig(Path fileLocation, Yaml yamlProcessor, Map<String, Object> configData) throws Exception {
+        // Configure YAML output to match Go version formatting (block style)
+        DumperOptions options = new DumperOptions();
+        options.setDefaultFlowStyle(DumperOptions.FlowStyle.BLOCK);
+        options.setPrettyFlow(true);
+        options.setIndent(2);
+
+        Yaml blockYaml = new Yaml(options);
+        String yamlOutput = blockYaml.dump(configData);
+
+        Set<PosixFilePermission> existingPermissions = getFilePermissions(fileLocation);
+
+        Files.write(fileLocation, yamlOutput.getBytes(StandardCharsets.UTF_8), StandardOpenOption.WRITE, StandardOpenOption.TRUNCATE_EXISTING);
+
+        applyFilePermissions(fileLocation, existingPermissions);
+    }
+
+    private Set<PosixFilePermission> getFilePermissions(Path fileLocation) {
+        try {
+            return Files.getPosixFilePermissions(fileLocation);
+        } catch (UnsupportedOperationException e) {
+            return null;
+        } catch (Exception e) {
+            return null;
+        }
+    }
+
+    private void applyFilePermissions(Path fileLocation, Set<PosixFilePermission> existingPermissions) {
+        if (existingPermissions != null) {
+            try {
+                Files.setPosixFilePermissions(fileLocation, existingPermissions);
+            } catch (Exception e) {
+                // Ignore failures
+            }
+        }
+    }
+}
diff --git a/docker/data/logstash/env2yaml/env2yaml b/docker/data/logstash/env2yaml/env2yaml
new file mode 100644
index 00000000000..224ea1919b5
--- /dev/null
+++ b/docker/data/logstash/env2yaml/env2yaml
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Execute Java env2yaml using Logstash's bundled JDK and SnakeYAML
+# The .class file is compiled during Docker build and placed in /usr/local/bin
+
+exec /usr/share/logstash/jdk/bin/java \
+    -cp "/usr/share/logstash/logstash-core/lib/jars/*:/usr/local/bin" \
+    Env2Yaml "$@"
\ No newline at end of file
diff --git a/docker/data/logstash/env2yaml/env2yaml.go b/docker/data/logstash/env2yaml/env2yaml.go
deleted file mode 100644
index d1e976bbab1..00000000000
--- a/docker/data/logstash/env2yaml/env2yaml.go
+++ /dev/null
@@ -1,199 +0,0 @@
-// env2yaml
-//
-// Merge environment variables into logstash.yml.
-// For example, running Docker with:
-//
-//	docker run -e pipeline.workers=6
-//
-// or
-//
-//	docker run -e PIPELINE_WORKERS=6
-//
-// will cause logstash.yml to contain the line:
-//
-//	pipeline.workers: 6
-package main
-
-import (
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"log"
-	"os"
-	"strings"
-
-	"gopkg.in/yaml.v2"
-)
-
-var validSettings = []string{
-	"api.enabled",
-	"api.http.host",
-	"api.http.port",
-	"api.environment",
-	"node.name",
-	"path.data",
-	"pipeline.id",
-	"pipeline.workers",
-	"pipeline.output.workers",
-	"pipeline.batch.size",
-	"pipeline.batch.delay",
-	"pipeline.unsafe_shutdown",
-	"pipeline.ecs_compatibility",
-	"pipeline.ordered",
-	"pipeline.plugin_classloaders",
-	"pipeline.separate_logs",
-	"path.config",
-	"config.string",
-	"config.test_and_exit",
-	"config.reload.automatic",
-	"config.reload.interval",
-	"config.debug",
-	"config.support_escapes",
-	"config.field_reference.escape_style",
-	"queue.type",
-	"path.queue",
-	"queue.page_capacity",
-	"queue.max_events",
-	"queue.max_bytes",
-	"queue.checkpoint.acks",
-	"queue.checkpoint.writes",
-	"queue.checkpoint.interval", // remove it for #17155
-	"queue.compression",
-	"queue.drain",
-	"dead_letter_queue.enable",
-	"dead_letter_queue.max_bytes",
-	"dead_letter_queue.flush_interval",
-	"dead_letter_queue.storage_policy",
-	"dead_letter_queue.retain.age",
-	"path.dead_letter_queue",
-	"log.level",
-	"log.format",
-	"log.format.json.fix_duplicate_message_fields",
-	"metric.collect",
-	"path.logs",
-	"path.plugins",
-	"api.auth.type",
-	"api.auth.basic.username",
-	"api.auth.basic.password",
-	"api.auth.basic.password_policy.mode",
-	"api.auth.basic.password_policy.length.minimum",
-	"api.auth.basic.password_policy.include.upper",
-	"api.auth.basic.password_policy.include.lower",
-	"api.auth.basic.password_policy.include.digit",
-	"api.auth.basic.password_policy.include.symbol",
-	"allow_superuser",
-	"monitoring.cluster_uuid",
-	"xpack.monitoring.allow_legacy_collection",
-	"xpack.monitoring.enabled",
-	"xpack.monitoring.collection.interval",
-	"xpack.monitoring.elasticsearch.hosts",
-	"xpack.monitoring.elasticsearch.username",
-	"xpack.monitoring.elasticsearch.password",
-	"xpack.monitoring.elasticsearch.proxy",
-	"xpack.monitoring.elasticsearch.api_key",
-	"xpack.monitoring.elasticsearch.cloud_auth",
-	"xpack.monitoring.elasticsearch.cloud_id",
-	"xpack.monitoring.elasticsearch.sniffing",
-	"xpack.monitoring.elasticsearch.ssl.certificate_authority",
-	"xpack.monitoring.elasticsearch.ssl.ca_trusted_fingerprint",
-	"xpack.monitoring.elasticsearch.ssl.verification_mode",
-	"xpack.monitoring.elasticsearch.ssl.truststore.path",
-	"xpack.monitoring.elasticsearch.ssl.truststore.password",
-	"xpack.monitoring.elasticsearch.ssl.keystore.path",
-	"xpack.monitoring.elasticsearch.ssl.keystore.password",
-	"xpack.monitoring.elasticsearch.ssl.certificate",
-	"xpack.monitoring.elasticsearch.ssl.key",
-	"xpack.monitoring.elasticsearch.ssl.cipher_suites",
-	"xpack.management.enabled",
-	"xpack.management.logstash.poll_interval",
-	"xpack.management.pipeline.id",
-	"xpack.management.elasticsearch.hosts",
-	"xpack.management.elasticsearch.username",
-	"xpack.management.elasticsearch.password",
-	"xpack.management.elasticsearch.proxy",
-	"xpack.management.elasticsearch.api_key",
-	"xpack.management.elasticsearch.cloud_auth",
-	"xpack.management.elasticsearch.cloud_id",
-	"xpack.management.elasticsearch.sniffing",
-	"xpack.management.elasticsearch.ssl.certificate_authority",
-	"xpack.management.elasticsearch.ssl.ca_trusted_fingerprint",
-	"xpack.management.elasticsearch.ssl.verification_mode",
-	"xpack.management.elasticsearch.ssl.truststore.path",
-	"xpack.management.elasticsearch.ssl.truststore.password",
-	"xpack.management.elasticsearch.ssl.keystore.path",
-	"xpack.management.elasticsearch.ssl.keystore.password",
-	"xpack.management.elasticsearch.ssl.certificate",
-	"xpack.management.elasticsearch.ssl.key",
-	"xpack.management.elasticsearch.ssl.cipher_suites",
-	"xpack.geoip.download.endpoint",
-	"xpack.geoip.downloader.enabled",
-}
-
-// Given a setting name, return a downcased version with delimiters removed.
-func squashSetting(setting string) string {
-	downcased := strings.ToLower(setting)
-	de_dotted := strings.Replace(downcased, ".", "", -1)
-	de_underscored := strings.Replace(de_dotted, "_", "", -1)
-	return de_underscored
-}
-
-// Given a setting name like "pipeline.workers" or "PIPELINE_UNSAFE_SHUTDOWN",
-// return the canonical setting name. eg. 'pipeline.unsafe_shutdown'
-func normalizeSetting(setting string) (string, error) {
-	for _, validSetting := range validSettings {
-		if squashSetting(setting) == squashSetting(validSetting) {
-			return validSetting, nil
-		}
-	}
-	return "", errors.New("Invalid setting: " + setting)
-}
-
-func main() {
-	if len(os.Args) != 2 {
-		log.Fatalf("usage: env2yaml FILENAME")
-	}
-	settingsFilePath := os.Args[1]
-
-	settingsFile, err := ioutil.ReadFile(settingsFilePath)
-	if err != nil {
-		log.Fatalf("error: %v", err)
-	}
-
-	// Read the original settings file into a map.
-	settings := make(map[string]interface{})
-	err = yaml.Unmarshal(settingsFile, &settings)
-	if err != nil {
-		log.Fatalf("error: %v", err)
-	}
-
-	// Merge any valid settings found in the environment.
-	foundNewSettings := false
-	for _, line := range os.Environ() {
-		kv := strings.SplitN(line, "=", 2)
-		key := kv[0]
-		setting, err := normalizeSetting(key)
-		if err == nil {
-			foundNewSettings = true
-			log.Printf("Setting '%s' from environment.", setting)
-			// we need to keep ${KEY} in the logstash.yml to let Logstash decide using ${KEY}'s value from either keystore or environment
-			settings[setting] = fmt.Sprintf("${%s}", key)
-		}
-	}
-
-	if foundNewSettings {
-		output, err := yaml.Marshal(&settings)
-		if err != nil {
-			log.Fatalf("error: %v", err)
-		}
-
-		stat, err := os.Stat(settingsFilePath)
-		if err != nil {
-			log.Fatalf("error: %v", err)
-		}
-
-		err = ioutil.WriteFile(settingsFilePath, output, stat.Mode())
-		if err != nil {
-			log.Fatalf("error: %v", err)
-		}
-	}
-}
diff --git a/docker/templates/Dockerfile.erb b/docker/templates/Dockerfile.erb
index 355a76cff25..21f4845e5ad 100644
--- a/docker/templates/Dockerfile.erb
+++ b/docker/templates/Dockerfile.erb
@@ -33,17 +33,6 @@
 <% end -%>
 <%   locale = 'C.UTF-8' -%>
 
-# Build env2yaml
-FROM <%= go_image %> AS builder-env2yaml
-
-COPY env2yaml/env2yaml.go env2yaml/go.mod env2yaml/go.sum /tmp/go/src/env2yaml/
-
-WORKDIR /tmp/go/src/env2yaml
-
-RUN go build -trimpath
-
-# Build main image
-# Minimal distributions do not ship with en language packs.
 FROM <%= base_image %>
 
 ENV ELASTIC_CONTAINER=true
@@ -96,7 +85,10 @@ RUN addgroup -g 1000 logstash && \
   find /usr/share/logstash -type d -exec chmod g+s {} \; && \
   ln -s /usr/share/logstash /opt/logstash
 
-COPY --from=builder-env2yaml /tmp/go/src/env2yaml/env2yaml /usr/local/bin/env2yaml
+# Copy and compile Java env2yaml using Logstash's bundled JDK
+COPY env2yaml/Env2Yaml.java /tmp/
+RUN /usr/share/logstash/jdk/bin/javac -cp "/usr/share/logstash/logstash-core/lib/jars/*" /tmp/Env2Yaml.java -d /usr/local/bin/
+COPY --chmod=0755 env2yaml/env2yaml /usr/local/bin/env2yaml
 COPY --chown=logstash:root config/pipelines.yml config/log4j2.properties config/log4j2.file.properties /usr/share/logstash/config/
 <% if image_flavor == 'oss' -%>
 COPY --chown=logstash:root config/logstash-oss.yml /usr/share/logstash/config/logstash.yml

From 61a2ef4b57e32ce279e9caf88710bda577dd3169 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Wed, 12 Nov 2025 11:19:20 -0800
Subject: [PATCH 02/14] Use TreeMap in java to try to replicate lexicographical
 order

---
 docker/data/logstash/env2yaml/Env2Yaml.java | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/docker/data/logstash/env2yaml/Env2Yaml.java b/docker/data/logstash/env2yaml/Env2Yaml.java
index 865237da0e3..44b48b3a6c6 100644
--- a/docker/data/logstash/env2yaml/Env2Yaml.java
+++ b/docker/data/logstash/env2yaml/Env2Yaml.java
@@ -123,12 +123,16 @@ private void processConfigFile(String configPath) throws Exception {
     @SuppressWarnings("unchecked")
     private Map<String, Object> loadExistingConfig(Path fileLocation, Yaml yamlProcessor) throws Exception {
         if (!Files.exists(fileLocation)) {
-            return new HashMap<>();
+            return new TreeMap<>();
         }
 
         try (InputStream fileInput = Files.newInputStream(fileLocation)) {
             Object parsedData = yamlProcessor.load(fileInput);
-            return parsedData instanceof Map ? (Map<String, Object>) parsedData : new HashMap<>();
+            if (parsedData instanceof Map) {
+                // Convert to TreeMap to ensure alphabetical ordering like Go version
+                return new TreeMap<>((Map<String, Object>) parsedData);
+            }
+            return new TreeMap<>();
         }
     }
 

From aa61b56bca5f10c6759841c0b04803a0cbcac409 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Wed, 12 Nov 2025 11:49:14 -0800
Subject: [PATCH 03/14] Explicit imports and TreeMap everywher

---
 docker/data/logstash/env2yaml/Env2Yaml.java | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/docker/data/logstash/env2yaml/Env2Yaml.java b/docker/data/logstash/env2yaml/Env2Yaml.java
index 44b48b3a6c6..41aa567d174 100644
--- a/docker/data/logstash/env2yaml/Env2Yaml.java
+++ b/docker/data/logstash/env2yaml/Env2Yaml.java
@@ -1,12 +1,17 @@
 import org.yaml.snakeyaml.Yaml;
 import org.yaml.snakeyaml.DumperOptions;
-import java.io.*;
+import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
-import java.nio.file.*;
-import java.nio.file.attribute.*;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.StandardOpenOption;
+import java.nio.file.attribute.PosixFilePermission;
 import java.time.LocalDateTime;
 import java.time.format.DateTimeFormatter;
-import java.util.*;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeMap;
 
 /**
  * Environment variable to YAML configuration merger
@@ -26,7 +31,7 @@ public SettingValidator() {
         }
 
         private Map<String, String> buildSettingMap() {
-            Map<String, String> map = new HashMap<>();
+            Map<String, String> map = new TreeMap<>();
             String[] allowedConfigs = {
                 "api.enabled", "api.http.host", "api.http.port", "api.environment",
                 "node.name", "path.data", "pipeline.id", "pipeline.workers",
@@ -99,7 +104,8 @@ public static void main(String[] args) {
         }
 
         try {
-            new Env2Yaml().processConfigFile(args[0]);
+            String configPath = args[0];
+            new Env2Yaml().processConfigFile(configPath);
         } catch (Exception e) {
             System.err.println("error: " + e.getMessage());
             System.exit(1);

From 581ab713f0a9c285c71b9c6658f5455ef2d2d811 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Thu, 13 Nov 2025 13:27:26 -0800
Subject: [PATCH 04/14] Go removals and ironbank workflow update

---
 docker/Makefile                               | 10 ++++-----
 docker/data/logstash/env2yaml/go.mod          |  5 -----
 docker/data/logstash/env2yaml/go.sum          |  3 ---
 docker/ironbank/go/src/env2yaml/go.mod        |  5 -----
 docker/ironbank/go/src/env2yaml/go.sum        |  3 ---
 .../go/src/env2yaml/vendor/modules.txt        |  2 --
 docker/templates/Dockerfile.erb               |  3 ---
 docker/templates/IronbankDockerfile.erb       | 21 +++++--------------
 8 files changed, 10 insertions(+), 42 deletions(-)
 delete mode 100644 docker/data/logstash/env2yaml/go.mod
 delete mode 100644 docker/data/logstash/env2yaml/go.sum
 delete mode 100644 docker/ironbank/go/src/env2yaml/go.mod
 delete mode 100644 docker/ironbank/go/src/env2yaml/go.sum
 delete mode 100644 docker/ironbank/go/src/env2yaml/vendor/modules.txt

diff --git a/docker/Makefile b/docker/Makefile
index 644ca4e7a6e..43eb7995e44 100644
--- a/docker/Makefile
+++ b/docker/Makefile
@@ -94,8 +94,8 @@ docker_paths:
 
 COPY_IRONBANK_FILES := $(ARTIFACTS_DIR)/ironbank/scripts/config/pipelines.yml $(ARTIFACTS_DIR)/ironbank/scripts/config/logstash.yml
 COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.file.properties $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.properties
-COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint $(ARTIFACTS_DIR)/ironbank/scripts/java/Env2Yaml.java
-COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/java/env2yaml $(ARTIFACTS_DIR)/ironbank/LICENSE $(ARTIFACTS_DIR)/ironbank/README.md
+COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/Env2Yaml.java
+COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/env2yaml $(ARTIFACTS_DIR)/ironbank/LICENSE $(ARTIFACTS_DIR)/ironbank/README.md
 
 $(ARTIFACTS_DIR)/ironbank/scripts/config/pipelines.yml: data/logstash/config/pipelines.yml
 $(ARTIFACTS_DIR)/ironbank/scripts/config/logstash.yml: data/logstash/config/logstash-full.yml
@@ -103,8 +103,8 @@ $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.file.properties: data/logstash/c
 $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.properties: data/logstash/config/log4j2.properties
 $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf: data/logstash/pipeline/default.conf
 $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint: data/logstash/bin/docker-entrypoint
-$(ARTIFACTS_DIR)/ironbank/scripts/java/Env2Yaml.java: data/logstash/env2yaml/Env2Yaml.java
-$(ARTIFACTS_DIR)/ironbank/scripts/java/env2yaml: data/logstash/env2yaml/env2yaml
+$(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/Env2Yaml.java: data/logstash/env2yaml/Env2Yaml.java
+$(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/env2yaml: data/logstash/env2yaml/env2yaml
 $(ARTIFACTS_DIR)/ironbank/LICENSE: ironbank/LICENSE
 $(ARTIFACTS_DIR)/ironbank/README.md: ironbank/README.md
 
@@ -116,7 +116,7 @@ ironbank_docker_paths:
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/bin
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/config
-	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/java
+	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/pipeline
 
 public-dockerfiles: public-dockerfiles_oss public-dockerfiles_full public-dockerfiles_wolfi public-dockerfiles_observability-sre public-dockerfiles_ironbank
diff --git a/docker/data/logstash/env2yaml/go.mod b/docker/data/logstash/env2yaml/go.mod
deleted file mode 100644
index 7600007420d..00000000000
--- a/docker/data/logstash/env2yaml/go.mod
+++ /dev/null
@@ -1,5 +0,0 @@
-module logstash/env2yaml
-
-go 1.21
-
-require gopkg.in/yaml.v2 v2.4.0
diff --git a/docker/data/logstash/env2yaml/go.sum b/docker/data/logstash/env2yaml/go.sum
deleted file mode 100644
index 75346616b19..00000000000
--- a/docker/data/logstash/env2yaml/go.sum
+++ /dev/null
@@ -1,3 +0,0 @@
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
diff --git a/docker/ironbank/go/src/env2yaml/go.mod b/docker/ironbank/go/src/env2yaml/go.mod
deleted file mode 100644
index a21d1f1af29..00000000000
--- a/docker/ironbank/go/src/env2yaml/go.mod
+++ /dev/null
@@ -1,5 +0,0 @@
-module env2yaml
-
-go 1.13
-
-require gopkg.in/yaml.v2 v2.3.0
diff --git a/docker/ironbank/go/src/env2yaml/go.sum b/docker/ironbank/go/src/env2yaml/go.sum
deleted file mode 100644
index 8fabe8daafe..00000000000
--- a/docker/ironbank/go/src/env2yaml/go.sum
+++ /dev/null
@@ -1,3 +0,0 @@
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/docker/ironbank/go/src/env2yaml/vendor/modules.txt b/docker/ironbank/go/src/env2yaml/vendor/modules.txt
deleted file mode 100644
index bdd2db2d793..00000000000
--- a/docker/ironbank/go/src/env2yaml/vendor/modules.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-# gopkg.in/yaml.v2 v2.3.0
-gopkg.in/yaml.v2
diff --git a/docker/templates/Dockerfile.erb b/docker/templates/Dockerfile.erb
index 21f4845e5ad..17c80203040 100644
--- a/docker/templates/Dockerfile.erb
+++ b/docker/templates/Dockerfile.erb
@@ -20,15 +20,12 @@
 <% end -%>
 <% if image_flavor == 'full' || image_flavor == 'oss' -%>
   <%   base_image = 'redhat/ubi9-minimal:latest' -%>
-  <%   go_image = 'golang:1.25' -%>
   <%   package_manager = 'microdnf' -%>
 <% elsif image_flavor == 'observability-sre' -%>
   <%   base_image = 'docker.elastic.co/wolfi/chainguard-base-fips' -%>
-  <%   go_image = 'docker.elastic.co/wolfi/go:1.25' -%>
   <%   package_manager = 'apk' -%>
 <% else -%>
   <%   base_image = 'docker.elastic.co/wolfi/chainguard-base' -%>
-  <%   go_image = 'docker.elastic.co/wolfi/go:1.25' -%>
   <%   package_manager = 'apk' -%>
 <% end -%>
 <%   locale = 'C.UTF-8' -%>
diff --git a/docker/templates/IronbankDockerfile.erb b/docker/templates/IronbankDockerfile.erb
index 1f46007382a..23c51659414 100644
--- a/docker/templates/IronbankDockerfile.erb
+++ b/docker/templates/IronbankDockerfile.erb
@@ -4,22 +4,7 @@ ARG BASE_REGISTRY=registry1.dso.mil
 ARG BASE_IMAGE=ironbank/redhat/ubi/ubi9
 ARG BASE_TAG=9.6
 ARG LOGSTASH_VERSION=<%= elastic_version %>
-ARG GOLANG_VERSION=1.25.0
 
-# stage 1: build env2yaml
-FROM ${BASE_REGISTRY}/google/golang/ubi9/golang-1.25:${GOLANG_VERSION} AS env2yaml
-
-ENV GOPATH=/go
-
-COPY scripts/go /go
-
-USER root
-
-RUN dnf-3 -y upgrade && dnf-3 install -y git && \
-  cd /go/src/env2yaml && \
-  go build
-
-# Final stage
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
 
 ARG LOGSTASH_VERSION
@@ -29,7 +14,6 @@ ENV PATH=/usr/share/logstash/bin:$PATH
 
 WORKDIR /usr/share
 
-COPY --from=env2yaml /go/src/env2yaml/env2yaml /usr/local/bin/env2yaml
 COPY scripts/config/* config/
 COPY scripts/pipeline/default.conf pipeline/logstash.conf
 COPY scripts/bin/docker-entrypoint /usr/local/bin/
@@ -56,6 +40,11 @@ RUN dnf -y upgrade && \
   rmdir config && \
   rm /tmp/logstash.tar.gz
 
+# Copy and compile Java env2yaml using Logstash's bundled JDK
+COPY scripts/env2yaml/Env2Yaml.java /tmp/
+RUN /usr/share/logstash/jdk/bin/javac -cp "/usr/share/logstash/logstash-core/lib/jars/*" /tmp/Env2Yaml.java -d /usr/local/bin/
+COPY --chmod=0755 scripts/env2yaml/env2yaml /usr/local/bin/env2yaml
+
 WORKDIR /usr/share/logstash
 
 USER 1000

From 58839e6ec64730e5b2104d8e66134eec5f917687 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Thu, 13 Nov 2025 14:07:11 -0800
Subject: [PATCH 05/14] More non-code removals

---
 .gitignore                                   | 1 -
 docker/templates/hardening_manifest.yaml.erb | 1 -
 2 files changed, 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index cc0ab0db4c0..883206a8ab3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,7 +16,6 @@ out
 local
 test/setup/elasticsearch/elasticsearch-*
 vendor
-!docker/ironbank/go/src/env2yaml/vendor
 .sass-cache
 /data
 .buildpath
diff --git a/docker/templates/hardening_manifest.yaml.erb b/docker/templates/hardening_manifest.yaml.erb
index d289077b7d6..aaf88afe3a5 100644
--- a/docker/templates/hardening_manifest.yaml.erb
+++ b/docker/templates/hardening_manifest.yaml.erb
@@ -16,7 +16,6 @@ args:
   BASE_IMAGE: "redhat/ubi/ubi9"
   BASE_TAG: "9.6"
   LOGSTASH_VERSION: "<%= elastic_version %>"
-  GOLANG_VERSION: "1.21.8"
 
 # Docker image labels
 labels:

From ac0e24d541ac9556a539ddd805bf94ffc4287a53 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Fri, 14 Nov 2025 15:12:53 -0800
Subject: [PATCH 06/14] Update based on codereview

Use snakeyaml-engine and some java flags for faster execution
---
 docker/data/logstash/env2yaml/Env2Yaml.java | 37 +++++++++++----------
 docker/data/logstash/env2yaml/env2yaml      |  9 +++--
 docker/templates/Dockerfile.erb             |  2 +-
 docker/templates/IronbankDockerfile.erb     |  2 +-
 4 files changed, 28 insertions(+), 22 deletions(-)

diff --git a/docker/data/logstash/env2yaml/Env2Yaml.java b/docker/data/logstash/env2yaml/Env2Yaml.java
index 41aa567d174..67be2c37937 100644
--- a/docker/data/logstash/env2yaml/Env2Yaml.java
+++ b/docker/data/logstash/env2yaml/Env2Yaml.java
@@ -1,5 +1,9 @@
-import org.yaml.snakeyaml.Yaml;
-import org.yaml.snakeyaml.DumperOptions;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
+import org.snakeyaml.engine.v2.api.Dump;
+import org.snakeyaml.engine.v2.api.DumpSettings;
+import org.snakeyaml.engine.v2.common.FlowStyle;
+import org.snakeyaml.engine.v2.common.ScalarStyle;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
@@ -114,26 +118,25 @@ public static void main(String[] args) {
 
     private void processConfigFile(String configPath) throws Exception {
         Path fileLocation = Paths.get(configPath);
-        Yaml yamlProcessor = new Yaml();
-
-        Map<String, Object> configData = loadExistingConfig(fileLocation, yamlProcessor);
+        Map<String, Object> configData = loadExistingConfig(fileLocation);
 
         SettingValidator validator = new SettingValidator();
         boolean addedNewConfigs = incorporateEnvironmentVars(configData, validator);
 
         if (addedNewConfigs) {
-            saveUpdatedConfig(fileLocation, yamlProcessor, configData);
+            saveUpdatedConfig(fileLocation, configData);
         }
     }
 
     @SuppressWarnings("unchecked")
-    private Map<String, Object> loadExistingConfig(Path fileLocation, Yaml yamlProcessor) throws Exception {
+    private Map<String, Object> loadExistingConfig(Path fileLocation) throws Exception {
         if (!Files.exists(fileLocation)) {
             return new TreeMap<>();
         }
-
+        LoadSettings loadSettings = LoadSettings.builder().build();
+        Load loader = new Load(loadSettings);
         try (InputStream fileInput = Files.newInputStream(fileLocation)) {
-            Object parsedData = yamlProcessor.load(fileInput);
+            Object parsedData = loader.loadFromInputStream(fileInput);
             if (parsedData instanceof Map) {
                 // Convert to TreeMap to ensure alphabetical ordering like Go version
                 return new TreeMap<>((Map<String, Object>) parsedData);
@@ -164,15 +167,15 @@ private boolean incorporateEnvironmentVars(Map<String, Object> configData, Setti
         return addedNewConfigs;
     }
 
-    private void saveUpdatedConfig(Path fileLocation, Yaml yamlProcessor, Map<String, Object> configData) throws Exception {
+    private void saveUpdatedConfig(Path fileLocation, Map<String, Object> configData) throws Exception {
         // Configure YAML output to match Go version formatting (block style)
-        DumperOptions options = new DumperOptions();
-        options.setDefaultFlowStyle(DumperOptions.FlowStyle.BLOCK);
-        options.setPrettyFlow(true);
-        options.setIndent(2);
-
-        Yaml blockYaml = new Yaml(options);
-        String yamlOutput = blockYaml.dump(configData);
+        DumpSettings dumpSettings = DumpSettings.builder()
+            .setDefaultFlowStyle(FlowStyle.BLOCK)
+            .setDefaultScalarStyle(ScalarStyle.PLAIN)
+            .setIndent(2)
+            .build();
+        Dump dumper = new Dump(dumpSettings);
+        String yamlOutput = dumper.dumpToString(configData);
 
         Set<PosixFilePermission> existingPermissions = getFilePermissions(fileLocation);
 
diff --git a/docker/data/logstash/env2yaml/env2yaml b/docker/data/logstash/env2yaml/env2yaml
index 224ea1919b5..27bcffbde13 100644
--- a/docker/data/logstash/env2yaml/env2yaml
+++ b/docker/data/logstash/env2yaml/env2yaml
@@ -1,8 +1,11 @@
 #!/bin/bash
 
-# Execute Java env2yaml using Logstash's bundled JDK and SnakeYAML
+# Execute Java env2yaml using Logstash's bundled JDK and snakeyaml-engine from jruby
 # The .class file is compiled during Docker build and placed in /usr/local/bin
 
 exec /usr/share/logstash/jdk/bin/java \
-    -cp "/usr/share/logstash/logstash-core/lib/jars/*:/usr/local/bin" \
-    Env2Yaml "$@"
\ No newline at end of file
+    -XX:+UseSerialGC \
+    -Xms32m \
+    -Xmx32m \
+    -cp "/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine/2.9/*:/usr/local/bin" \
+    Env2Yaml "$@"
diff --git a/docker/templates/Dockerfile.erb b/docker/templates/Dockerfile.erb
index 17c80203040..da3a6f25c08 100644
--- a/docker/templates/Dockerfile.erb
+++ b/docker/templates/Dockerfile.erb
@@ -84,7 +84,7 @@ RUN addgroup -g 1000 logstash && \
 
 # Copy and compile Java env2yaml using Logstash's bundled JDK
 COPY env2yaml/Env2Yaml.java /tmp/
-RUN /usr/share/logstash/jdk/bin/javac -cp "/usr/share/logstash/logstash-core/lib/jars/*" /tmp/Env2Yaml.java -d /usr/local/bin/
+RUN /usr/share/logstash/jdk/bin/javac -cp "/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine/2.9/*" /tmp/Env2Yaml.java -d /usr/local/bin/
 COPY --chmod=0755 env2yaml/env2yaml /usr/local/bin/env2yaml
 COPY --chown=logstash:root config/pipelines.yml config/log4j2.properties config/log4j2.file.properties /usr/share/logstash/config/
 <% if image_flavor == 'oss' -%>
diff --git a/docker/templates/IronbankDockerfile.erb b/docker/templates/IronbankDockerfile.erb
index 23c51659414..df91305e076 100644
--- a/docker/templates/IronbankDockerfile.erb
+++ b/docker/templates/IronbankDockerfile.erb
@@ -42,7 +42,7 @@ RUN dnf -y upgrade && \
 
 # Copy and compile Java env2yaml using Logstash's bundled JDK
 COPY scripts/env2yaml/Env2Yaml.java /tmp/
-RUN /usr/share/logstash/jdk/bin/javac -cp "/usr/share/logstash/logstash-core/lib/jars/*" /tmp/Env2Yaml.java -d /usr/local/bin/
+RUN /usr/share/logstash/jdk/bin/javac -cp "/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine/2.9/*"/tmp/Env2Yaml.java -d /usr/local/bin/
 COPY --chmod=0755 scripts/env2yaml/env2yaml /usr/local/bin/env2yaml
 
 WORKDIR /usr/share/logstash

From 501ea9e577c8654dafa4cad2523663d66bbf8569 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Mon, 17 Nov 2025 13:04:16 -0800
Subject: [PATCH 07/14] Build env2yaml in stage

Build env2yaml in a separate build stage for container artifacts. Include
its dependencies and manage separately from logstash. Continue to use the
java runtime in the final container to run the program, but manage the classpath
separately. Note this did not use gradle for dependency management because installing
that as a depdendcy was not worth it compared with downloading a jar directly.
---
 docker/data/logstash/env2yaml/env2yaml  |  5 ++---
 docker/templates/Dockerfile.erb         | 20 +++++++++++++++++---
 docker/templates/IronbankDockerfile.erb | 24 +++++++++++++++++++++---
 3 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/docker/data/logstash/env2yaml/env2yaml b/docker/data/logstash/env2yaml/env2yaml
index 27bcffbde13..eb5d0cca7bd 100644
--- a/docker/data/logstash/env2yaml/env2yaml
+++ b/docker/data/logstash/env2yaml/env2yaml
@@ -1,11 +1,10 @@
 #!/bin/bash
 
-# Execute Java env2yaml using Logstash's bundled JDK and snakeyaml-engine from jruby
-# The .class file is compiled during Docker build and placed in /usr/local/bin
+# Execute the env2yaml java program. Ensure the snakeyaml-engine jar is in the classpath.
 
 exec /usr/share/logstash/jdk/bin/java \
     -XX:+UseSerialGC \
     -Xms32m \
     -Xmx32m \
-    -cp "/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine/2.9/*:/usr/local/bin" \
+    -cp "/usr/share/logstash/env2yaml/snakeyaml-engine-2.9.jar:/usr/share/logstash/env2yaml" \
     Env2Yaml "$@"
diff --git a/docker/templates/Dockerfile.erb b/docker/templates/Dockerfile.erb
index da3a6f25c08..2e92acac856 100644
--- a/docker/templates/Dockerfile.erb
+++ b/docker/templates/Dockerfile.erb
@@ -30,6 +30,19 @@
 <% end -%>
 <%   locale = 'C.UTF-8' -%>
 
+# Build env2yaml
+FROM eclipse-temurin:21-jdk-alpine AS builder-env2yaml
+
+WORKDIR /tmp
+
+# Use snakeyaml-engine for env2yaml program as its more compact than snakeyaml
+RUN wget -q https://repo1.maven.org/maven2/org/snakeyaml/snakeyaml-engine/2.9/snakeyaml-engine-2.9.jar
+
+COPY env2yaml/Env2Yaml.java .
+
+# Compile env2yaml
+RUN javac -cp snakeyaml-engine-2.9.jar Env2Yaml.java
+
 FROM <%= base_image %>
 
 ENV ELASTIC_CONTAINER=true
@@ -82,9 +95,10 @@ RUN addgroup -g 1000 logstash && \
   find /usr/share/logstash -type d -exec chmod g+s {} \; && \
   ln -s /usr/share/logstash /opt/logstash
 
-# Copy and compile Java env2yaml using Logstash's bundled JDK
-COPY env2yaml/Env2Yaml.java /tmp/
-RUN /usr/share/logstash/jdk/bin/javac -cp "/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine/2.9/*" /tmp/Env2Yaml.java -d /usr/local/bin/
+# Copy env2yaml and snakeyaml-engine from builder stage
+RUN mkdir -p /usr/share/logstash/env2yaml
+COPY --from=builder-env2yaml /tmp/*.class /usr/share/logstash/env2yaml/
+COPY --from=builder-env2yaml /tmp/snakeyaml-engine-2.9.jar /usr/share/logstash/env2yaml/
 COPY --chmod=0755 env2yaml/env2yaml /usr/local/bin/env2yaml
 COPY --chown=logstash:root config/pipelines.yml config/log4j2.properties config/log4j2.file.properties /usr/share/logstash/config/
 <% if image_flavor == 'oss' -%>
diff --git a/docker/templates/IronbankDockerfile.erb b/docker/templates/IronbankDockerfile.erb
index df91305e076..4cd598dd975 100644
--- a/docker/templates/IronbankDockerfile.erb
+++ b/docker/templates/IronbankDockerfile.erb
@@ -5,6 +5,23 @@ ARG BASE_IMAGE=ironbank/redhat/ubi/ubi9
 ARG BASE_TAG=9.6
 ARG LOGSTASH_VERSION=<%= elastic_version %>
 
+# Build env2yaml
+FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS builder-env2yaml
+
+RUN dnf -y upgrade && \
+    dnf -y install java-21-openjdk-devel wget && \
+    dnf clean all
+
+WORKDIR /tmp
+
+# Use snakeyaml-engine for env2yaml program as its more compact than snakeyaml
+RUN wget -q https://repo1.maven.org/maven2/org/snakeyaml/snakeyaml-engine/2.9/snakeyaml-engine-2.9.jar
+
+COPY scripts/env2yaml/Env2Yaml.java .
+
+# Compile env2yaml
+RUN javac -cp snakeyaml-engine-2.9.jar Env2Yaml.java
+
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
 
 ARG LOGSTASH_VERSION
@@ -40,9 +57,10 @@ RUN dnf -y upgrade && \
   rmdir config && \
   rm /tmp/logstash.tar.gz
 
-# Copy and compile Java env2yaml using Logstash's bundled JDK
-COPY scripts/env2yaml/Env2Yaml.java /tmp/
-RUN /usr/share/logstash/jdk/bin/javac -cp "/usr/share/logstash/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine/2.9/*"/tmp/Env2Yaml.java -d /usr/local/bin/
+# Copy env2yaml and snakeyaml-engine from builder stage
+RUN mkdir -p /usr/share/logstash/env2yaml
+COPY --from=builder-env2yaml /tmp/*.class /usr/share/logstash/env2yaml/
+COPY --from=builder-env2yaml /tmp/snakeyaml-engine-2.9.jar /usr/share/logstash/env2yaml/
 COPY --chmod=0755 scripts/env2yaml/env2yaml /usr/local/bin/env2yaml
 
 WORKDIR /usr/share/logstash

From ab8da507c725f0bd1c70bf69652897f05dd6f985 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Tue, 18 Nov 2025 14:53:03 -0800
Subject: [PATCH 08/14] Use gradle to manage snakeyaml-engine dependency

Use gradle (and a dedicated gradle base image) for building env2yaml
---
 docker/Makefile                               | 16 +++++++----
 docker/data/logstash/env2yaml/build.gradle    | 28 +++++++++++++++++++
 docker/data/logstash/env2yaml/env2yaml        |  4 +--
 docker/data/logstash/env2yaml/settings.gradle |  0
 .../java/org/logstash/env2yaml}/Env2Yaml.java | 14 ++++++----
 docker/templates/Dockerfile.erb               | 16 +++++------
 docker/templates/IronbankDockerfile.erb       | 21 ++++++--------
 7 files changed, 66 insertions(+), 33 deletions(-)
 create mode 100644 docker/data/logstash/env2yaml/build.gradle
 create mode 100644 docker/data/logstash/env2yaml/settings.gradle
 rename docker/data/logstash/env2yaml/{ => src/main/java/org/logstash/env2yaml}/Env2Yaml.java (99%)

diff --git a/docker/Makefile b/docker/Makefile
index 43eb7995e44..137b42f80b3 100644
--- a/docker/Makefile
+++ b/docker/Makefile
@@ -69,7 +69,8 @@ build-from-local-observability-sre-artifacts: dockerfile
 
 COPY_FILES := $(ARTIFACTS_DIR)/docker/config/pipelines.yml $(ARTIFACTS_DIR)/docker/config/logstash-oss.yml $(ARTIFACTS_DIR)/docker/config/logstash-full.yml
 COPY_FILES += $(ARTIFACTS_DIR)/docker/config/log4j2.file.properties $(ARTIFACTS_DIR)/docker/config/log4j2.properties
-COPY_FILES += $(ARTIFACTS_DIR)/docker/env2yaml/Env2Yaml.java $(ARTIFACTS_DIR)/docker/env2yaml/env2yaml
+COPY_FILES += $(ARTIFACTS_DIR)/docker/env2yaml/build.gradle $(ARTIFACTS_DIR)/docker/env2yaml/settings.gradle
+COPY_FILES += $(ARTIFACTS_DIR)/docker/env2yaml/env2yaml
 COPY_FILES += $(ARTIFACTS_DIR)/docker/pipeline/default.conf $(ARTIFACTS_DIR)/docker/bin/docker-entrypoint
 
 $(ARTIFACTS_DIR)/docker/config/pipelines.yml: data/logstash/config/pipelines.yml
@@ -79,7 +80,8 @@ $(ARTIFACTS_DIR)/docker/config/log4j2.file.properties: data/logstash/config/log4
 $(ARTIFACTS_DIR)/docker/config/log4j2.properties: data/logstash/config/log4j2.properties
 $(ARTIFACTS_DIR)/docker/pipeline/default.conf: data/logstash/pipeline/default.conf
 $(ARTIFACTS_DIR)/docker/bin/docker-entrypoint: data/logstash/bin/docker-entrypoint
-$(ARTIFACTS_DIR)/docker/env2yaml/Env2Yaml.java: data/logstash/env2yaml/Env2Yaml.java
+$(ARTIFACTS_DIR)/docker/env2yaml/build.gradle: data/logstash/env2yaml/build.gradle
+$(ARTIFACTS_DIR)/docker/env2yaml/settings.gradle: data/logstash/env2yaml/settings.gradle
 $(ARTIFACTS_DIR)/docker/env2yaml/env2yaml: data/logstash/env2yaml/env2yaml
 
 $(ARTIFACTS_DIR)/docker/%:
@@ -91,11 +93,13 @@ docker_paths:
 	mkdir -p $(ARTIFACTS_DIR)/docker/config
 	mkdir -p $(ARTIFACTS_DIR)/docker/env2yaml
 	mkdir -p $(ARTIFACTS_DIR)/docker/pipeline
+	cp -r data/logstash/env2yaml/src $(ARTIFACTS_DIR)/docker/env2yaml/
 
 COPY_IRONBANK_FILES := $(ARTIFACTS_DIR)/ironbank/scripts/config/pipelines.yml $(ARTIFACTS_DIR)/ironbank/scripts/config/logstash.yml
 COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.file.properties $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.properties
-COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/Env2Yaml.java
-COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/env2yaml $(ARTIFACTS_DIR)/ironbank/LICENSE $(ARTIFACTS_DIR)/ironbank/README.md
+COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint
+COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/build.gradle $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/settings.gradle $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/env2yaml
+COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/LICENSE $(ARTIFACTS_DIR)/ironbank/README.md
 
 $(ARTIFACTS_DIR)/ironbank/scripts/config/pipelines.yml: data/logstash/config/pipelines.yml
 $(ARTIFACTS_DIR)/ironbank/scripts/config/logstash.yml: data/logstash/config/logstash-full.yml
@@ -103,7 +107,8 @@ $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.file.properties: data/logstash/c
 $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.properties: data/logstash/config/log4j2.properties
 $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf: data/logstash/pipeline/default.conf
 $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint: data/logstash/bin/docker-entrypoint
-$(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/Env2Yaml.java: data/logstash/env2yaml/Env2Yaml.java
+$(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/build.gradle: data/logstash/env2yaml/build.gradle
+$(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/settings.gradle: data/logstash/env2yaml/settings.gradle
 $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/env2yaml: data/logstash/env2yaml/env2yaml
 $(ARTIFACTS_DIR)/ironbank/LICENSE: ironbank/LICENSE
 $(ARTIFACTS_DIR)/ironbank/README.md: ironbank/README.md
@@ -118,6 +123,7 @@ ironbank_docker_paths:
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/config
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/pipeline
+	cp -r data/logstash/env2yaml/src $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/
 
 public-dockerfiles: public-dockerfiles_oss public-dockerfiles_full public-dockerfiles_wolfi public-dockerfiles_observability-sre public-dockerfiles_ironbank
 
diff --git a/docker/data/logstash/env2yaml/build.gradle b/docker/data/logstash/env2yaml/build.gradle
new file mode 100644
index 00000000000..f3c19cf9877
--- /dev/null
+++ b/docker/data/logstash/env2yaml/build.gradle
@@ -0,0 +1,28 @@
+plugins {
+    id 'java'
+}
+
+repositories {
+    mavenCentral()
+}
+
+dependencies {
+    implementation 'org.snakeyaml:snakeyaml-engine:2.7'
+}
+
+tasks.register('copyBootstrapDeps', Copy) {
+    from configurations.runtimeClasspath
+    into "$buildDir/bootstrap-libs"
+}
+
+tasks.register('copyBootstrapClasses') {
+    dependsOn classes
+    doLast {
+        copy {
+            from "$buildDir/classes/java/main"
+            into "$buildDir/bootstrap-classes"
+        }
+    }
+}
+
+jar.enabled = false
\ No newline at end of file
diff --git a/docker/data/logstash/env2yaml/env2yaml b/docker/data/logstash/env2yaml/env2yaml
index eb5d0cca7bd..1ffdafdf58f 100644
--- a/docker/data/logstash/env2yaml/env2yaml
+++ b/docker/data/logstash/env2yaml/env2yaml
@@ -6,5 +6,5 @@ exec /usr/share/logstash/jdk/bin/java \
     -XX:+UseSerialGC \
     -Xms32m \
     -Xmx32m \
-    -cp "/usr/share/logstash/env2yaml/snakeyaml-engine-2.9.jar:/usr/share/logstash/env2yaml" \
-    Env2Yaml "$@"
+    -cp "/usr/share/logstash/env2yaml/classes:/usr/share/logstash/env2yaml/libs/*" \
+    org.logstash.env2yaml.Env2Yaml "$@"
diff --git a/docker/data/logstash/env2yaml/settings.gradle b/docker/data/logstash/env2yaml/settings.gradle
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/docker/data/logstash/env2yaml/Env2Yaml.java b/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java
similarity index 99%
rename from docker/data/logstash/env2yaml/Env2Yaml.java
rename to docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java
index 67be2c37937..1128f6e557c 100644
--- a/docker/data/logstash/env2yaml/Env2Yaml.java
+++ b/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java
@@ -1,9 +1,5 @@
-import org.snakeyaml.engine.v2.api.Load;
-import org.snakeyaml.engine.v2.api.LoadSettings;
-import org.snakeyaml.engine.v2.api.Dump;
-import org.snakeyaml.engine.v2.api.DumpSettings;
-import org.snakeyaml.engine.v2.common.FlowStyle;
-import org.snakeyaml.engine.v2.common.ScalarStyle;
+package org.logstash.env2yaml;
+
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
@@ -16,6 +12,12 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.TreeMap;
+import org.snakeyaml.engine.v2.api.Dump;
+import org.snakeyaml.engine.v2.api.DumpSettings;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
+import org.snakeyaml.engine.v2.common.FlowStyle;
+import org.snakeyaml.engine.v2.common.ScalarStyle;
 
 /**
  * Environment variable to YAML configuration merger
diff --git a/docker/templates/Dockerfile.erb b/docker/templates/Dockerfile.erb
index 2e92acac856..bca4a88ec64 100644
--- a/docker/templates/Dockerfile.erb
+++ b/docker/templates/Dockerfile.erb
@@ -31,17 +31,17 @@
 <%   locale = 'C.UTF-8' -%>
 
 # Build env2yaml
-FROM eclipse-temurin:21-jdk-alpine AS builder-env2yaml
+FROM gradle:9-jdk21 AS builder-env2yaml
 
 WORKDIR /tmp
 
-# Use snakeyaml-engine for env2yaml program as its more compact than snakeyaml
-RUN wget -q https://repo1.maven.org/maven2/org/snakeyaml/snakeyaml-engine/2.9/snakeyaml-engine-2.9.jar
-
-COPY env2yaml/Env2Yaml.java .
+COPY env2yaml/env2yaml .
+COPY env2yaml/build.gradle .
+COPY env2yaml/settings.gradle .
+COPY env2yaml/src ./src
 
 # Compile env2yaml
-RUN javac -cp snakeyaml-engine-2.9.jar Env2Yaml.java
+RUN gradle copyBootstrapClasses copyBootstrapDeps
 
 FROM <%= base_image %>
 
@@ -97,8 +97,8 @@ RUN addgroup -g 1000 logstash && \
 
 # Copy env2yaml and snakeyaml-engine from builder stage
 RUN mkdir -p /usr/share/logstash/env2yaml
-COPY --from=builder-env2yaml /tmp/*.class /usr/share/logstash/env2yaml/
-COPY --from=builder-env2yaml /tmp/snakeyaml-engine-2.9.jar /usr/share/logstash/env2yaml/
+COPY --from=builder-env2yaml /tmp/build/bootstrap-classes/ /usr/share/logstash/env2yaml/classes/
+COPY --from=builder-env2yaml /tmp/build/bootstrap-libs/ /usr/share/logstash/env2yaml/libs/
 COPY --chmod=0755 env2yaml/env2yaml /usr/local/bin/env2yaml
 COPY --chown=logstash:root config/pipelines.yml config/log4j2.properties config/log4j2.file.properties /usr/share/logstash/config/
 <% if image_flavor == 'oss' -%>
diff --git a/docker/templates/IronbankDockerfile.erb b/docker/templates/IronbankDockerfile.erb
index 4cd598dd975..df5a10c00f1 100644
--- a/docker/templates/IronbankDockerfile.erb
+++ b/docker/templates/IronbankDockerfile.erb
@@ -6,22 +6,19 @@ ARG BASE_TAG=9.6
 ARG LOGSTASH_VERSION=<%= elastic_version %>
 
 # Build env2yaml
-FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} AS builder-env2yaml
-
-RUN dnf -y upgrade && \
-    dnf -y install java-21-openjdk-devel wget && \
-    dnf clean all
+FROM gradle:9-jdk21 AS builder-env2yaml
 
 WORKDIR /tmp
 
-# Use snakeyaml-engine for env2yaml program as its more compact than snakeyaml
-RUN wget -q https://repo1.maven.org/maven2/org/snakeyaml/snakeyaml-engine/2.9/snakeyaml-engine-2.9.jar
-
-COPY scripts/env2yaml/Env2Yaml.java .
+COPY scripts/env2yaml/env2yaml .
+COPY scripts/env2yaml/build.gradle .
+COPY scripts/env2yaml/settings.gradle .
+COPY scripts/env2yaml/src ./src
 
 # Compile env2yaml
-RUN javac -cp snakeyaml-engine-2.9.jar Env2Yaml.java
+RUN gradle copyBootstrapClasses copyBootstrapDeps
 
+# Final stage
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
 
 ARG LOGSTASH_VERSION
@@ -59,8 +56,8 @@ RUN dnf -y upgrade && \
 
 # Copy env2yaml and snakeyaml-engine from builder stage
 RUN mkdir -p /usr/share/logstash/env2yaml
-COPY --from=builder-env2yaml /tmp/*.class /usr/share/logstash/env2yaml/
-COPY --from=builder-env2yaml /tmp/snakeyaml-engine-2.9.jar /usr/share/logstash/env2yaml/
+COPY --from=builder-env2yaml /tmp/build/bootstrap-classes/ /usr/share/logstash/env2yaml/classes/
+COPY --from=builder-env2yaml /tmp/build/bootstrap-libs/ /usr/share/logstash/env2yaml/libs/
 COPY --chmod=0755 scripts/env2yaml/env2yaml /usr/local/bin/env2yaml
 
 WORKDIR /usr/share/logstash

From 8734db35af71a90bf95980f31458e82612ccb380 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Wed, 19 Nov 2025 16:52:39 -0800
Subject: [PATCH 09/14] Refactor to build env2yaml with gradle rather than in
 docker build

Dont rely on compiling at docker build time, rather do it when logstash
compilation is done.
---
 build.gradle                               |  7 +++++
 docker/Makefile                            | 11 ++-----
 docker/data/logstash/env2yaml/build.gradle | 34 +++++++++++++---------
 docker/data/logstash/env2yaml/env2yaml     |  4 ++-
 docker/templates/Dockerfile.erb            | 19 ++----------
 docker/templates/IronbankDockerfile.erb    | 20 ++-----------
 rakelib/artifacts.rake                     | 31 +++++++++++++++++---
 settings.gradle                            |  2 +-
 8 files changed, 66 insertions(+), 62 deletions(-)

diff --git a/build.gradle b/build.gradle
index a238e899729..bf7e8ae6577 100644
--- a/build.gradle
+++ b/build.gradle
@@ -302,6 +302,13 @@ tasks.register("bootstrap") {
 }
 
 
+
+task dockerBootstrap {
+    description = "Docker bootstrap ensures env2yaml java is compiled and staged for inclusion in tarballs"
+    dependsOn bootstrap
+    dependsOn ':docker:data:logstash:env2yaml:compileJava'
+}
+
 tasks.register("installDefaultGems") {
     dependsOn bootstrap
     doLast {
diff --git a/docker/Makefile b/docker/Makefile
index 137b42f80b3..6bd91567124 100644
--- a/docker/Makefile
+++ b/docker/Makefile
@@ -69,7 +69,6 @@ build-from-local-observability-sre-artifacts: dockerfile
 
 COPY_FILES := $(ARTIFACTS_DIR)/docker/config/pipelines.yml $(ARTIFACTS_DIR)/docker/config/logstash-oss.yml $(ARTIFACTS_DIR)/docker/config/logstash-full.yml
 COPY_FILES += $(ARTIFACTS_DIR)/docker/config/log4j2.file.properties $(ARTIFACTS_DIR)/docker/config/log4j2.properties
-COPY_FILES += $(ARTIFACTS_DIR)/docker/env2yaml/build.gradle $(ARTIFACTS_DIR)/docker/env2yaml/settings.gradle
 COPY_FILES += $(ARTIFACTS_DIR)/docker/env2yaml/env2yaml
 COPY_FILES += $(ARTIFACTS_DIR)/docker/pipeline/default.conf $(ARTIFACTS_DIR)/docker/bin/docker-entrypoint
 
@@ -80,8 +79,6 @@ $(ARTIFACTS_DIR)/docker/config/log4j2.file.properties: data/logstash/config/log4
 $(ARTIFACTS_DIR)/docker/config/log4j2.properties: data/logstash/config/log4j2.properties
 $(ARTIFACTS_DIR)/docker/pipeline/default.conf: data/logstash/pipeline/default.conf
 $(ARTIFACTS_DIR)/docker/bin/docker-entrypoint: data/logstash/bin/docker-entrypoint
-$(ARTIFACTS_DIR)/docker/env2yaml/build.gradle: data/logstash/env2yaml/build.gradle
-$(ARTIFACTS_DIR)/docker/env2yaml/settings.gradle: data/logstash/env2yaml/settings.gradle
 $(ARTIFACTS_DIR)/docker/env2yaml/env2yaml: data/logstash/env2yaml/env2yaml
 
 $(ARTIFACTS_DIR)/docker/%:
@@ -93,12 +90,12 @@ docker_paths:
 	mkdir -p $(ARTIFACTS_DIR)/docker/config
 	mkdir -p $(ARTIFACTS_DIR)/docker/env2yaml
 	mkdir -p $(ARTIFACTS_DIR)/docker/pipeline
-	cp -r data/logstash/env2yaml/src $(ARTIFACTS_DIR)/docker/env2yaml/
+	cp -r data/logstash/env2yaml/classes $(ARTIFACTS_DIR)/docker/env2yaml/
 
 COPY_IRONBANK_FILES := $(ARTIFACTS_DIR)/ironbank/scripts/config/pipelines.yml $(ARTIFACTS_DIR)/ironbank/scripts/config/logstash.yml
 COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.file.properties $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.properties
 COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint
-COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/build.gradle $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/settings.gradle $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/env2yaml
+COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/env2yaml
 COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/LICENSE $(ARTIFACTS_DIR)/ironbank/README.md
 
 $(ARTIFACTS_DIR)/ironbank/scripts/config/pipelines.yml: data/logstash/config/pipelines.yml
@@ -107,8 +104,6 @@ $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.file.properties: data/logstash/c
 $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.properties: data/logstash/config/log4j2.properties
 $(ARTIFACTS_DIR)/ironbank/scripts/pipeline/default.conf: data/logstash/pipeline/default.conf
 $(ARTIFACTS_DIR)/ironbank/scripts/bin/docker-entrypoint: data/logstash/bin/docker-entrypoint
-$(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/build.gradle: data/logstash/env2yaml/build.gradle
-$(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/settings.gradle: data/logstash/env2yaml/settings.gradle
 $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/env2yaml: data/logstash/env2yaml/env2yaml
 $(ARTIFACTS_DIR)/ironbank/LICENSE: ironbank/LICENSE
 $(ARTIFACTS_DIR)/ironbank/README.md: ironbank/README.md
@@ -123,7 +118,7 @@ ironbank_docker_paths:
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/config
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/pipeline
-	cp -r data/logstash/env2yaml/src $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/
+	cp -r data/logstash/env2yaml/classes $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/
 
 public-dockerfiles: public-dockerfiles_oss public-dockerfiles_full public-dockerfiles_wolfi public-dockerfiles_observability-sre public-dockerfiles_ironbank
 
diff --git a/docker/data/logstash/env2yaml/build.gradle b/docker/data/logstash/env2yaml/build.gradle
index f3c19cf9877..ac0c5759e19 100644
--- a/docker/data/logstash/env2yaml/build.gradle
+++ b/docker/data/logstash/env2yaml/build.gradle
@@ -2,27 +2,35 @@ plugins {
     id 'java'
 }
 
-repositories {
-    mavenCentral()
+// Ensure JRuby is downloaded before we try to compile (since we depend on a JAR from it)
+compileJava {
+    dependsOn ':downloadAndInstallJRuby'
+    // Put compiled classes directly in the project directory, not under build/
+    destinationDirectory = file("${projectDir}/classes")
 }
 
 dependencies {
-    implementation 'org.snakeyaml:snakeyaml-engine:2.7'
+    // Use the snakeyaml-engine JAR that ships with JRuby
+    def snakeyamlDir = file("${rootProject.projectDir}/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine")
+    def snakeyamlJar = fileTree(snakeyamlDir).matching { include '**/snakeyaml-engine-*.jar' }.singleFile
+    implementation files(snakeyamlJar)
 }
 
-tasks.register('copyBootstrapDeps', Copy) {
-    from configurations.runtimeClasspath
-    into "$buildDir/bootstrap-libs"
-}
-
-tasks.register('copyBootstrapClasses') {
-    dependsOn classes
+// Copy snakeyaml-engine jar to env2yaml directory for runtime use
+tasks.register('copySnakeyamlJar') {
+    dependsOn compileJava
     doLast {
+        def snakeyamlJar = fileTree("${rootProject.projectDir}/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine").matching { 
+            include '**/snakeyaml-engine-*.jar'
+        }.singleFile
+
         copy {
-            from "$buildDir/classes/java/main"
-            into "$buildDir/bootstrap-classes"
+            from snakeyamlJar
+            into "${projectDir}/classes"
+            // Give the jar a predictable name to reference explicitly in classpath for env2yaml wrapper script
+            rename { 'snakeyaml-engine.jar' }
         }
     }
 }
-
+compileJava.finalizedBy copySnakeyamlJar
 jar.enabled = false
\ No newline at end of file
diff --git a/docker/data/logstash/env2yaml/env2yaml b/docker/data/logstash/env2yaml/env2yaml
index 1ffdafdf58f..7833a2b76c7 100644
--- a/docker/data/logstash/env2yaml/env2yaml
+++ b/docker/data/logstash/env2yaml/env2yaml
@@ -6,5 +6,7 @@ exec /usr/share/logstash/jdk/bin/java \
     -XX:+UseSerialGC \
     -Xms32m \
     -Xmx32m \
-    -cp "/usr/share/logstash/env2yaml/classes:/usr/share/logstash/env2yaml/libs/*" \
+    -cp "/usr/share/logstash/env2yaml/classes:/usr/share/logstash/env2yaml/classes/snakeyaml-engine.jar" \
     org.logstash.env2yaml.Env2Yaml "$@"
+
+
diff --git a/docker/templates/Dockerfile.erb b/docker/templates/Dockerfile.erb
index bca4a88ec64..af87813d03e 100644
--- a/docker/templates/Dockerfile.erb
+++ b/docker/templates/Dockerfile.erb
@@ -30,19 +30,6 @@
 <% end -%>
 <%   locale = 'C.UTF-8' -%>
 
-# Build env2yaml
-FROM gradle:9-jdk21 AS builder-env2yaml
-
-WORKDIR /tmp
-
-COPY env2yaml/env2yaml .
-COPY env2yaml/build.gradle .
-COPY env2yaml/settings.gradle .
-COPY env2yaml/src ./src
-
-# Compile env2yaml
-RUN gradle copyBootstrapClasses copyBootstrapDeps
-
 FROM <%= base_image %>
 
 ENV ELASTIC_CONTAINER=true
@@ -95,10 +82,8 @@ RUN addgroup -g 1000 logstash && \
   find /usr/share/logstash -type d -exec chmod g+s {} \; && \
   ln -s /usr/share/logstash /opt/logstash
 
-# Copy env2yaml and snakeyaml-engine from builder stage
-RUN mkdir -p /usr/share/logstash/env2yaml
-COPY --from=builder-env2yaml /tmp/build/bootstrap-classes/ /usr/share/logstash/env2yaml/classes/
-COPY --from=builder-env2yaml /tmp/build/bootstrap-libs/ /usr/share/logstash/env2yaml/libs/
+# Copy env2yaml from tarball (pre-compiled by Gradle)
+COPY --chown=logstash:root env2yaml/classes /usr/share/logstash/env2yaml/classes/
 COPY --chmod=0755 env2yaml/env2yaml /usr/local/bin/env2yaml
 COPY --chown=logstash:root config/pipelines.yml config/log4j2.properties config/log4j2.file.properties /usr/share/logstash/config/
 <% if image_flavor == 'oss' -%>
diff --git a/docker/templates/IronbankDockerfile.erb b/docker/templates/IronbankDockerfile.erb
index df5a10c00f1..bd916d4d901 100644
--- a/docker/templates/IronbankDockerfile.erb
+++ b/docker/templates/IronbankDockerfile.erb
@@ -5,20 +5,6 @@ ARG BASE_IMAGE=ironbank/redhat/ubi/ubi9
 ARG BASE_TAG=9.6
 ARG LOGSTASH_VERSION=<%= elastic_version %>
 
-# Build env2yaml
-FROM gradle:9-jdk21 AS builder-env2yaml
-
-WORKDIR /tmp
-
-COPY scripts/env2yaml/env2yaml .
-COPY scripts/env2yaml/build.gradle .
-COPY scripts/env2yaml/settings.gradle .
-COPY scripts/env2yaml/src ./src
-
-# Compile env2yaml
-RUN gradle copyBootstrapClasses copyBootstrapDeps
-
-# Final stage
 FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
 
 ARG LOGSTASH_VERSION
@@ -54,10 +40,8 @@ RUN dnf -y upgrade && \
   rmdir config && \
   rm /tmp/logstash.tar.gz
 
-# Copy env2yaml and snakeyaml-engine from builder stage
-RUN mkdir -p /usr/share/logstash/env2yaml
-COPY --from=builder-env2yaml /tmp/build/bootstrap-classes/ /usr/share/logstash/env2yaml/classes/
-COPY --from=builder-env2yaml /tmp/build/bootstrap-libs/ /usr/share/logstash/env2yaml/libs/
+# Copy env2yaml from build context (pre-compiled by Gradle)
+COPY --chown=logstash:root scripts/env2yaml/classes /usr/share/logstash/env2yaml/classes/
 COPY --chmod=0755 scripts/env2yaml/env2yaml /usr/local/bin/env2yaml
 
 WORKDIR /usr/share/logstash
diff --git a/rakelib/artifacts.rake b/rakelib/artifacts.rake
index 2739e1fc6a7..a7db737127a 100644
--- a/rakelib/artifacts.rake
+++ b/rakelib/artifacts.rake
@@ -113,6 +113,10 @@ namespace "artifact" do
     @exclude_paths << 'vendor/jruby/lib/ruby/gems/shared/specifications/net-imap-0.2.3.gemspec'
     @exclude_paths << 'vendor/jruby/lib/ruby/gems/shared/gems/net-imap-0.2.3/**/*'
 
+    # Exclude env2yaml source files - only compiled classes should be in tarball
+    @exclude_paths << 'docker/data/logstash/env2yaml/**/*.java'
+    @exclude_paths << 'docker/data/logstash/env2yaml/build.gradle'
+    @exclude_paths << 'docker/data/logstash/env2yaml/settings.gradle'
     @exclude_paths.freeze
   end
 
@@ -192,8 +196,9 @@ namespace "artifact" do
   task "archives_docker" => ["prepare", "generate_build_metadata"] do
     license_details = ['ELASTIC-LICENSE']
     @bundles_jdk = true
+    @building_docker = true
     create_archive_pack(license_details, ARCH, "linux")
-    safe_system("./gradlew bootstrap") # force the build of Logstash jars
+    safe_system("./gradlew dockerBootstrap") # force the build of Logstash jars + env2yaml
   end
 
   def create_archive_pack(license_details, arch, *oses, &tar_interceptor)
@@ -259,15 +264,17 @@ namespace "artifact" do
   task "archives_docker_oss" => ["prepare-oss", "generate_build_metadata"] do
     #with bundled JDKs
     @bundles_jdk = true
+    @building_docker = true
     license_details = ['APACHE-LICENSE-2.0', "-oss", oss_exclude_paths]
     create_archive_pack(license_details, ARCH, "linux")
-    safe_system("./gradlew bootstrap") # force the build of Logstash jars
+    safe_system("./gradlew dockerBootstrap") # force the build of Logstash jars + env2yaml
   end
 
   desc "Build jdk bundled tar.gz of observabilitySRE logstash plugins with all dependencies for docker"
   task "archives_docker_observabilitySRE" => ["prepare-observabilitySRE", "generate_build_metadata"] do
     #with bundled JDKs
     @bundles_jdk = true
+    @building_docker = true
     exclude_paths = default_exclude_paths + %w(
       bin/logstash-plugin
       bin/logstash-plugin.bat
@@ -280,7 +287,7 @@ namespace "artifact" do
       # copy additional files into the tarball
       puts "HELLO(#{dedicated_directory_tar})"
     end
-    safe_system("./gradlew bootstrap") # force the build of Logstash jars
+    safe_system("./gradlew dockerBootstrap") # force the build of Logstash jars + env2yaml
   end
 
   desc "Build an RPM of logstash with all dependencies"
@@ -563,7 +570,23 @@ namespace "artifact" do
       # add build.rb to tar
       metadata_file_path_in_tar = File.join("logstash-core", "lib", "logstash", "build.rb")
       dedicated_directory_tarball.write(BUILD_METADATA_FILE.path, metadata_file_path_in_tar)
-
+      # add env2yaml for docker builds
+      if @building_docker
+        env2yaml_classes = "docker/data/logstash/env2yaml/classes"
+        if File.directory?(env2yaml_classes)
+          # Add compiled class files
+          Dir.glob("#{env2yaml_classes}/**/*.class").each do |class_file|
+            relative_path = class_file.sub("#{env2yaml_classes}/", "")
+            dedicated_directory_tarball.write(class_file, "env2yaml/classes/#{relative_path}")
+          end
+          # Add snakeyaml-engine JAR
+          jar_file = "#{env2yaml_classes}/snakeyaml-engine.jar"
+          if File.exist?(jar_file)
+            dedicated_directory_tarball.write(jar_file, "env2yaml/classes/snakeyaml-engine.jar")
+          end
+        end
+        dedicated_directory_tarball.write("docker/data/logstash/env2yaml/env2yaml", "env2yaml/env2yaml") if File.exist?("docker/data/logstash/env2yaml/env2yaml")
+      end
       # yield to the tar interceptor if we have one
       yield(dedicated_directory_tarball) if block_given?
     end
diff --git a/settings.gradle b/settings.gradle
index d538972b85c..4ccc34a3c44 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -1,6 +1,6 @@
 rootProject.name = "logstash"
 
-include ':logstash-core', 'logstash-core-benchmarks', 'benchmark-cli', 'jvm-options-parser', 'logstash-integration-tests', 'dependencies-report'
+include ':logstash-core', 'logstash-core-benchmarks', 'benchmark-cli', 'jvm-options-parser', 'logstash-integration-tests', 'dependencies-report', 'docker:data:logstash:env2yaml'
 project(':logstash-core').projectDir = new File('./logstash-core')
 project(':logstash-core-benchmarks').projectDir = new File('./logstash-core/benchmarks')
 project(':logstash-integration-tests').projectDir = new File('./qa/integration')

From 3feb0544e271ac6e0ec3ca9de14ee0e5a24c403e Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Thu, 20 Nov 2025 11:19:20 -0800
Subject: [PATCH 10/14] Dont try to use snakeyaml from jruby

The complexity around trying to copy over the jar shipped with jruby is not worth
how easy it is to just manage it with gradle. This helps with keeping env2yaml contained.
---
 docker/Makefile                            |  2 ++
 docker/data/logstash/env2yaml/build.gradle | 33 +++++++---------------
 docker/templates/Dockerfile.erb            |  1 +
 docker/templates/IronbankDockerfile.erb    |  1 +
 rakelib/artifacts.rake                     |  7 ++---
 5 files changed, 17 insertions(+), 27 deletions(-)

diff --git a/docker/Makefile b/docker/Makefile
index 6bd91567124..a074ec2067a 100644
--- a/docker/Makefile
+++ b/docker/Makefile
@@ -91,6 +91,7 @@ docker_paths:
 	mkdir -p $(ARTIFACTS_DIR)/docker/env2yaml
 	mkdir -p $(ARTIFACTS_DIR)/docker/pipeline
 	cp -r data/logstash/env2yaml/classes $(ARTIFACTS_DIR)/docker/env2yaml/
+	cp -r data/logstash/env2yaml/lib $(ARTIFACTS_DIR)/docker/env2yaml/
 
 COPY_IRONBANK_FILES := $(ARTIFACTS_DIR)/ironbank/scripts/config/pipelines.yml $(ARTIFACTS_DIR)/ironbank/scripts/config/logstash.yml
 COPY_IRONBANK_FILES += $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.file.properties $(ARTIFACTS_DIR)/ironbank/scripts/config/log4j2.properties
@@ -119,6 +120,7 @@ ironbank_docker_paths:
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml
 	mkdir -p $(ARTIFACTS_DIR)/ironbank/scripts/pipeline
 	cp -r data/logstash/env2yaml/classes $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/
+	cp -r data/logstash/env2yaml/lib $(ARTIFACTS_DIR)/ironbank/scripts/env2yaml/
 
 public-dockerfiles: public-dockerfiles_oss public-dockerfiles_full public-dockerfiles_wolfi public-dockerfiles_observability-sre public-dockerfiles_ironbank
 
diff --git a/docker/data/logstash/env2yaml/build.gradle b/docker/data/logstash/env2yaml/build.gradle
index ac0c5759e19..406b55c73bf 100644
--- a/docker/data/logstash/env2yaml/build.gradle
+++ b/docker/data/logstash/env2yaml/build.gradle
@@ -2,35 +2,22 @@ plugins {
     id 'java'
 }
 
-// Ensure JRuby is downloaded before we try to compile (since we depend on a JAR from it)
 compileJava {
-    dependsOn ':downloadAndInstallJRuby'
-    // Put compiled classes directly in the project directory, not under build/
     destinationDirectory = file("${projectDir}/classes")
 }
 
+repositories {
+    mavenCentral()
+}
+
 dependencies {
-    // Use the snakeyaml-engine JAR that ships with JRuby
-    def snakeyamlDir = file("${rootProject.projectDir}/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine")
-    def snakeyamlJar = fileTree(snakeyamlDir).matching { include '**/snakeyaml-engine-*.jar' }.singleFile
-    implementation files(snakeyamlJar)
+    implementation 'org.snakeyaml:snakeyaml-engine:2.9'
 }
 
-// Copy snakeyaml-engine jar to env2yaml directory for runtime use
-tasks.register('copySnakeyamlJar') {
-    dependsOn compileJava
-    doLast {
-        def snakeyamlJar = fileTree("${rootProject.projectDir}/vendor/jruby/lib/ruby/stdlib/org/snakeyaml/snakeyaml-engine").matching { 
-            include '**/snakeyaml-engine-*.jar'
-        }.singleFile
+tasks.register('copyRuntimeLibs', Copy) {
+    from configurations.runtimeClasspath
+    into "${projectDir}/lib"
+ }
 
-        copy {
-            from snakeyamlJar
-            into "${projectDir}/classes"
-            // Give the jar a predictable name to reference explicitly in classpath for env2yaml wrapper script
-            rename { 'snakeyaml-engine.jar' }
-        }
-    }
-}
-compileJava.finalizedBy copySnakeyamlJar
+compileJava.finalizedBy copyRuntimeLibs
 jar.enabled = false
\ No newline at end of file
diff --git a/docker/templates/Dockerfile.erb b/docker/templates/Dockerfile.erb
index af87813d03e..b8f03b4aeae 100644
--- a/docker/templates/Dockerfile.erb
+++ b/docker/templates/Dockerfile.erb
@@ -84,6 +84,7 @@ RUN addgroup -g 1000 logstash && \
 
 # Copy env2yaml from tarball (pre-compiled by Gradle)
 COPY --chown=logstash:root env2yaml/classes /usr/share/logstash/env2yaml/classes/
+COPY --chown=logstash:root env2yaml/lib /usr/share/logstash/env2yaml/lib/
 COPY --chmod=0755 env2yaml/env2yaml /usr/local/bin/env2yaml
 COPY --chown=logstash:root config/pipelines.yml config/log4j2.properties config/log4j2.file.properties /usr/share/logstash/config/
 <% if image_flavor == 'oss' -%>
diff --git a/docker/templates/IronbankDockerfile.erb b/docker/templates/IronbankDockerfile.erb
index bd916d4d901..15f2bae3a22 100644
--- a/docker/templates/IronbankDockerfile.erb
+++ b/docker/templates/IronbankDockerfile.erb
@@ -42,6 +42,7 @@ RUN dnf -y upgrade && \
 
 # Copy env2yaml from build context (pre-compiled by Gradle)
 COPY --chown=logstash:root scripts/env2yaml/classes /usr/share/logstash/env2yaml/classes/
+COPY --chown=logstash:root scripts/env2yaml/lib /usr/share/logstash/env2yaml/lib/
 COPY --chmod=0755 scripts/env2yaml/env2yaml /usr/local/bin/env2yaml
 
 WORKDIR /usr/share/logstash
diff --git a/rakelib/artifacts.rake b/rakelib/artifacts.rake
index a7db737127a..248553b2708 100644
--- a/rakelib/artifacts.rake
+++ b/rakelib/artifacts.rake
@@ -579,10 +579,9 @@ namespace "artifact" do
             relative_path = class_file.sub("#{env2yaml_classes}/", "")
             dedicated_directory_tarball.write(class_file, "env2yaml/classes/#{relative_path}")
           end
-          # Add snakeyaml-engine JAR
-          jar_file = "#{env2yaml_classes}/snakeyaml-engine.jar"
-          if File.exist?(jar_file)
-            dedicated_directory_tarball.write(jar_file, "env2yaml/classes/snakeyaml-engine.jar")
+          # Add dependency JARs
+          Dir.glob("docker/data/logstash/env2yaml/lib/*.jar").each do |jar_file|
+            dedicated_directory_tarball.write(jar_file, "env2yaml/lib/#{File.basename(jar_file)}")
           end
         end
         dedicated_directory_tarball.write("docker/data/logstash/env2yaml/env2yaml", "env2yaml/env2yaml") if File.exist?("docker/data/logstash/env2yaml/env2yaml")

From 4f9cd7f180be47bc0b17c2c8c9b638ede09d23ef Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Thu, 20 Nov 2025 12:33:55 -0800
Subject: [PATCH 11/14] Add license for snakeyaml-engine

Licence from https://bitbucket.org/snakeyaml/snakeyaml-engine/src/master/LICENSE.txt
---
 .../src/main/resources/licenseMapping.csv     |   1 +
 .../org.snakeyaml!snakeyaml-engine-NOTICE.txt | 176 ++++++++++++++++++
 2 files changed, 177 insertions(+)
 create mode 100644 tools/dependencies-report/src/main/resources/notices/org.snakeyaml!snakeyaml-engine-NOTICE.txt

diff --git a/tools/dependencies-report/src/main/resources/licenseMapping.csv b/tools/dependencies-report/src/main/resources/licenseMapping.csv
index 14fb7c8c28a..6133921b5fa 100644
--- a/tools/dependencies-report/src/main/resources/licenseMapping.csv
+++ b/tools/dependencies-report/src/main/resources/licenseMapping.csv
@@ -174,6 +174,7 @@ dependency,dependencyUrl,licenseOverride,copyright,sourceURL
 "org.logstash:jvm-options-parser:",http://github.com/elastic/logstash,Apache-2.0
 "org.reflections:reflections:",https://github.com/ronmamo/reflections,BSD-2-Clause
 "org.slf4j:slf4j-api:",http://www.slf4j.org/,MIT
+"org.snakeyaml:snakeyaml-engine:2.9",https://bitbucket.org/snakeyaml/snakeyaml-engine,Apache-2.0
 "org.yaml:snakeyaml:",https://bitbucket.org/snakeyaml/snakeyaml/src/master/,Apache-2.0
 "ostruct:",https://github.com/ruby/ostruct,BSD-2-Clause
 "paquet:",https://github.com/elastic/logstash,Apache-2.0
diff --git a/tools/dependencies-report/src/main/resources/notices/org.snakeyaml!snakeyaml-engine-NOTICE.txt b/tools/dependencies-report/src/main/resources/notices/org.snakeyaml!snakeyaml-engine-NOTICE.txt
new file mode 100644
index 00000000000..2bb9ad240fa
--- /dev/null
+++ b/tools/dependencies-report/src/main/resources/notices/org.snakeyaml!snakeyaml-engine-NOTICE.txt
@@ -0,0 +1,176 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
\ No newline at end of file

From 9e81aa461129598e7715e85bf18d063bd281228c Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Fri, 21 Nov 2025 11:13:14 -0800
Subject: [PATCH 12/14] Cleanup and bugfix

---
 docker/data/logstash/env2yaml/env2yaml        | 2 +-
 docker/data/logstash/env2yaml/settings.gradle | 0
 docker/templates/Dockerfile.erb               | 2 +-
 docker/templates/IronbankDockerfile.erb       | 2 +-
 4 files changed, 3 insertions(+), 3 deletions(-)
 delete mode 100644 docker/data/logstash/env2yaml/settings.gradle

diff --git a/docker/data/logstash/env2yaml/env2yaml b/docker/data/logstash/env2yaml/env2yaml
index 7833a2b76c7..c709c30f86c 100644
--- a/docker/data/logstash/env2yaml/env2yaml
+++ b/docker/data/logstash/env2yaml/env2yaml
@@ -6,7 +6,7 @@ exec /usr/share/logstash/jdk/bin/java \
     -XX:+UseSerialGC \
     -Xms32m \
     -Xmx32m \
-    -cp "/usr/share/logstash/env2yaml/classes:/usr/share/logstash/env2yaml/classes/snakeyaml-engine.jar" \
+    -cp "/usr/share/logstash/env2yaml/classes:/usr/share/logstash/env2yaml/lib/*" \
     org.logstash.env2yaml.Env2Yaml "$@"
 
 
diff --git a/docker/data/logstash/env2yaml/settings.gradle b/docker/data/logstash/env2yaml/settings.gradle
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/docker/templates/Dockerfile.erb b/docker/templates/Dockerfile.erb
index b8f03b4aeae..1747a3c2386 100644
--- a/docker/templates/Dockerfile.erb
+++ b/docker/templates/Dockerfile.erb
@@ -82,7 +82,7 @@ RUN addgroup -g 1000 logstash && \
   find /usr/share/logstash -type d -exec chmod g+s {} \; && \
   ln -s /usr/share/logstash /opt/logstash
 
-# Copy env2yaml from tarball (pre-compiled by Gradle)
+<%# Copy env2yaml from tarball (pre-compiled by Gradle) %>
 COPY --chown=logstash:root env2yaml/classes /usr/share/logstash/env2yaml/classes/
 COPY --chown=logstash:root env2yaml/lib /usr/share/logstash/env2yaml/lib/
 COPY --chmod=0755 env2yaml/env2yaml /usr/local/bin/env2yaml
diff --git a/docker/templates/IronbankDockerfile.erb b/docker/templates/IronbankDockerfile.erb
index 15f2bae3a22..8c4eb27b6da 100644
--- a/docker/templates/IronbankDockerfile.erb
+++ b/docker/templates/IronbankDockerfile.erb
@@ -40,7 +40,7 @@ RUN dnf -y upgrade && \
   rmdir config && \
   rm /tmp/logstash.tar.gz
 
-# Copy env2yaml from build context (pre-compiled by Gradle)
+<%# Copy env2yaml from tarball (pre-compiled by Gradle) %>
 COPY --chown=logstash:root scripts/env2yaml/classes /usr/share/logstash/env2yaml/classes/
 COPY --chown=logstash:root scripts/env2yaml/lib /usr/share/logstash/env2yaml/lib/
 COPY --chmod=0755 scripts/env2yaml/env2yaml /usr/local/bin/env2yaml

From 09b27413977e6de8f47a63d068641d31299f2cad Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Wed, 26 Nov 2025 09:56:57 -0800
Subject: [PATCH 13/14] Stop skipping empty env vars

I mistakenly thought I had observed this behavior in the go version.
---
 .../src/main/java/org/logstash/env2yaml/Env2Yaml.java         | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java b/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java
index 1128f6e557c..71be1d195c6 100644
--- a/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java
+++ b/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java
@@ -153,10 +153,6 @@ private boolean incorporateEnvironmentVars(Map<String, Object> configData, Setti
         for (Map.Entry<String, String> envEntry : System.getenv().entrySet()) {
             String envVarName = envEntry.getKey();
             String envValue = envEntry.getValue();
-            // Skip empty values like Go version does
-            if (envValue == null || envValue.trim().isEmpty()) {
-                continue;
-            }
             String canonicalSetting = validator.findCanonicalSetting(envVarName);
 
             if (canonicalSetting != null) {

From 5eb0aa8c79eb5e007c290d7319d120c56e0897a5 Mon Sep 17 00:00:00 2001
From: donoghuc <cas.donoghue@gmail.com>
Date: Wed, 26 Nov 2025 10:46:02 -0800
Subject: [PATCH 14/14] Remove quotes from interpolated values

Even though we set `.setDefaultScalarStyle(ScalarStyle.PLAIN)` snakeyaml-engine
ends up quoting `${}` values. This commit removes them as this was not the behavior
with the go version.
---
 .../src/main/java/org/logstash/env2yaml/Env2Yaml.java         | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java b/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java
index 71be1d195c6..a697f12f9fb 100644
--- a/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java
+++ b/docker/data/logstash/env2yaml/src/main/java/org/logstash/env2yaml/Env2Yaml.java
@@ -174,7 +174,9 @@ private void saveUpdatedConfig(Path fileLocation, Map<String, Object> configData
             .build();
         Dump dumper = new Dump(dumpSettings);
         String yamlOutput = dumper.dumpToString(configData);
-
+        // Remove quotes (single or double) around ${VAR} to match Go behavior
+        // https://github.com/snakeyaml/snakeyaml-engine/blob/2070eb4e3d23bb1d81097875526a071003067877/src/main/java/org/snakeyaml/engine/v2/emitter/Emitter.java#L969-L996
+        yamlOutput = yamlOutput.replaceAll("(['\"])(\\$\\{[^}]+\\})\\1", "$2");
         Set<PosixFilePermission> existingPermissions = getFilePermissions(fileLocation);
 
         Files.write(fileLocation, yamlOutput.getBytes(StandardCharsets.UTF_8), StandardOpenOption.WRITE, StandardOpenOption.TRUNCATE_EXISTING);