fix(logstash source): harden ACK generation and decode-error handling

changelog.d/23346_logstash_ack_window_boundaries.fix.md

@@ -0,0 +1,3 @@
+Fixed the `logstash` source to delimit ACK windows by `WindowSize` frames rather than by counting events down to the advertised window size. The previous approach could lose a window boundary when a sender flushed a window with fewer events than advertised (legal, since `WindowSize` is a maximum) and a later window was coalesced into the same read, causing Vector to ACK a sequence number beyond the window the sender was waiting on. Beats/Filebeat reported this as `invalid sequence number received (seq=N, expected=M)`, leading to reconnects and duplicate retransmits.
+
+authors: graphcareful

changelog.d/23346_logstash_decode_error_fatal.fix.md

@@ -0,0 +1,3 @@
+Fixed the `logstash` source to close the connection on a malformed frame instead of attempting to continue. A failed JSON decode or decompression previously left the decoder desynchronized but still running, which could busy-loop and emit ACKs for bogus sequence numbers (surfacing as `invalid sequence number received` on the client). The source now treats any decode error as fatal and closes the connection — matching the upstream `logstash-input-beats` server — so the client reconnects and retransmits the unacknowledged window.
+
+authors: graphcareful

proptest-regressions/sources/logstash.txt

@@ -0,0 +1,7 @@
+# Seeds for failure cases proptest has generated in the past. It is
+# automatically read and these particular cases re-run before any
+# novel cases are generated.
+#
+# It is recommended to check this file in to source control so that
+# everyone who runs the test benefits from these saved cases.
+cc b3e438be44a9b6d3ad27dd1c5cf54f143e698ff1f01b178661869dffb67c7710 # shrinks to windows = [GenWindow { declared: 2, actual: 1, compressed: false }, GenWindow { declared: 2, actual: 2, compressed: false }], batch_sizes = [3]