From 25b51c32afd26bd213fbfba529db2e3c83326155 Mon Sep 17 00:00:00 2001
From: okliv <884634+okliv@users.noreply.github.com>
Date: Thu, 2 Oct 2025 05:34:42 +0300
Subject: [PATCH] Update elasticsearch.rb

raise error when search_api is not "search_after"
---
 lib/logstash/inputs/elasticsearch.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/logstash/inputs/elasticsearch.rb b/lib/logstash/inputs/elasticsearch.rb
index c16b714..a1cd620 100644
--- a/lib/logstash/inputs/elasticsearch.rb
+++ b/lib/logstash/inputs/elasticsearch.rb
@@ -708,9 +708,8 @@ def create_query_executor
 
   def setup_cursor_tracker
     return unless @tracking_field
-    return unless @query_executor.is_a?(LogStash::Inputs::Elasticsearch::SearchAfter)
 
-    if @resolved_search_api != "search_after" || @response_type != "hits"
+    if @resolved_search_api != "search_after" || @response_type != "hits" || !@query_executor.is_a?(LogStash::Inputs::Elasticsearch::SearchAfter)
       raise ConfigurationError.new("The `tracking_field` feature can only be used with `search_after` non-aggregation queries")
     end