diff --git a/logstash-core/build.gradle b/logstash-core/build.gradle
index fe758d3a3..057b140f1 100644
--- a/logstash-core/build.gradle
+++ b/logstash-core/build.gradle
@@ -224,7 +224,7 @@ dependencies {
     testImplementation "org.apache.logging.log4j:log4j-core:${log4jVersion}:tests"
     testImplementation 'org.hamcrest:hamcrest:2.2'
     testImplementation 'org.hamcrest:hamcrest-library:2.2'
-    testImplementation 'junit:junit:4.12'
+    testImplementation 'junit:junit:4.13.2'
     testImplementation 'net.javacrumbs.json-unit:json-unit:2.3.0'
     testImplementation 'org.elasticsearch:securemock:1.2'
     testImplementation 'org.assertj:assertj-core:3.11.1'
diff --git a/logstash-core/src/test/java/org/logstash/FieldReferenceTest.java b/logstash-core/src/test/java/org/logstash/FieldReferenceTest.java
index 652051b02..1a63e238d 100644
--- a/logstash-core/src/test/java/org/logstash/FieldReferenceTest.java
+++ b/logstash-core/src/test/java/org/logstash/FieldReferenceTest.java
@@ -31,10 +31,10 @@ import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.Suite;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
 
 @RunWith(Suite.class)
diff --git a/logstash-core/src/test/java/org/logstash/ValuefierTest.java b/logstash-core/src/test/java/org/logstash/ValuefierTest.java
index a887b3cd5..ecc27d454 100644
--- a/logstash-core/src/test/java/org/logstash/ValuefierTest.java
+++ b/logstash-core/src/test/java/org/logstash/ValuefierTest.java
@@ -38,12 +38,13 @@ import org.jruby.java.proxies.ConcreteJavaProxy;
 import org.jruby.java.proxies.MapJavaProxy;
 import org.jruby.javasupport.Java;
 import org.jruby.runtime.builtin.IRubyObject;
-import org.junit.Rule;
 import org.junit.Test;
-import org.junit.rules.ExpectedException;
 import org.logstash.ext.JrubyTimestampExtLibrary;
 
 import static junit.framework.TestCase.assertEquals;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.junit.Assert.assertThrows;
 
 public class ValuefierTest extends RubyTestBase {
 
@@ -120,15 +121,12 @@ public class ValuefierTest extends RubyTestBase {
         assertEquals(zdt.toInstant().toEpochMilli(), result.getTimestamp().toEpochMilli());
     }
 
-    @Rule
-    public ExpectedException exception = ExpectedException.none();
-
     @Test
     public void testUnhandledObject() {
         RubyMatchData md = new RubyMatchData(RubyUtil.RUBY);
-        exception.expect(MissingConverterException.class);
-        exception.expectMessage("Missing Converter handling for full class name=org.jruby.RubyMatchData, simple name=RubyMatchData");
-        Valuefier.convert(md);
+
+        MissingConverterException missingConverterException = assertThrows(MissingConverterException.class, () -> Valuefier.convert(md));
+        assertThat(missingConverterException.getMessage(), containsString("Missing Converter handling for full class name=org.jruby.RubyMatchData, simple name=RubyMatchData"));
     }
 
     @Test
diff --git a/logstash-core/src/test/java/org/logstash/ackedqueue/QueueTest.java b/logstash-core/src/test/java/org/logstash/ackedqueue/QueueTest.java
index 25bca9fc7..fd075f9ca 100644
--- a/logstash-core/src/test/java/org/logstash/ackedqueue/QueueTest.java
+++ b/logstash-core/src/test/java/org/logstash/ackedqueue/QueueTest.java
@@ -58,7 +58,7 @@ import static org.hamcrest.Matchers.greaterThan;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.fail;
 import static org.logstash.ackedqueue.QueueTestHelpers.computeCapacityForMmapPageIO;
-import static org.logstash.util.ExceptionMatcher.assertThrows;
+import static org.junit.Assert.assertThrows;
 
 public class QueueTest {
 
diff --git a/logstash-core/src/test/java/org/logstash/common/ConfigVariableExpanderTest.java b/logstash-core/src/test/java/org/logstash/common/ConfigVariableExpanderTest.java
index 0b111308f..6f6e430fe 100644
--- a/logstash-core/src/test/java/org/logstash/common/ConfigVariableExpanderTest.java
+++ b/logstash-core/src/test/java/org/logstash/common/ConfigVariableExpanderTest.java
@@ -20,6 +20,7 @@
 
 package org.logstash.common;
 
+import org.hamcrest.MatcherAssert;
 import org.junit.Assert;
 import org.junit.Test;
 import org.logstash.plugins.ConfigVariableExpander;
@@ -110,7 +111,7 @@ public class ConfigVariableExpanderTest {
                 Collections.singletonMap(key, evVal));
 
         Object expandedValue = cve.expand("${" + key + ":" + defaultValue + "}", true);
-        Assert.assertThat(expandedValue, instanceOf(SecretVariable.class));
+        MatcherAssert.assertThat(expandedValue, instanceOf(SecretVariable.class));
         Assert.assertEquals(ssVal, ((SecretVariable) expandedValue).getSecretValue());
     }
 
diff --git a/logstash-core/src/test/java/org/logstash/config/ir/PipelineConfigTest.java b/logstash-core/src/test/java/org/logstash/config/ir/PipelineConfigTest.java
index 8bd2fb98e..22e84fe46 100644
--- a/logstash-core/src/test/java/org/logstash/config/ir/PipelineConfigTest.java
+++ b/logstash-core/src/test/java/org/logstash/config/ir/PipelineConfigTest.java
@@ -33,7 +33,12 @@ import java.time.LocalDateTime;
 import java.util.*;
 import java.util.stream.Collectors;
 
-import static org.junit.Assert.*;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
 
 public class PipelineConfigTest extends RubyEnvTestCase {
 
diff --git a/logstash-core/src/test/java/org/logstash/config/ir/PipelineIRTest.java b/logstash-core/src/test/java/org/logstash/config/ir/PipelineIRTest.java
index 1c1c8b3b0..34bceaa49 100644
--- a/logstash-core/src/test/java/org/logstash/config/ir/PipelineIRTest.java
+++ b/logstash-core/src/test/java/org/logstash/config/ir/PipelineIRTest.java
@@ -27,11 +27,11 @@ import org.logstash.config.ir.graph.Graph;
 import org.logstash.plugins.ConfigVariableExpander;
 import org.logstash.config.ir.graph.QueueVertex;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.any;
 import static org.hamcrest.Matchers.not;
 import static org.hamcrest.Matchers.hasItem;
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertThat;
 import static org.logstash.config.ir.DSL.*;
 import static org.logstash.config.ir.PluginDefinition.Type.*;
 import static org.logstash.config.ir.IRHelpers.randMeta;
diff --git a/logstash-core/src/test/java/org/logstash/config/ir/graph/BooleanEdgeTest.java b/logstash-core/src/test/java/org/logstash/config/ir/graph/BooleanEdgeTest.java
index e6bd7e4e7..2c5c2cd3d 100644
--- a/logstash-core/src/test/java/org/logstash/config/ir/graph/BooleanEdgeTest.java
+++ b/logstash-core/src/test/java/org/logstash/config/ir/graph/BooleanEdgeTest.java
@@ -27,7 +27,7 @@ import org.junit.runner.RunWith;
 import org.logstash.config.ir.InvalidIRException;
 
 import static org.hamcrest.CoreMatchers.*;
-import static org.junit.Assert.assertThat;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.logstash.config.ir.IRHelpers.*;
 
 @RunWith(Theories.class)
diff --git a/logstash-core/src/test/java/org/logstash/config/ir/graph/EdgeTest.java b/logstash-core/src/test/java/org/logstash/config/ir/graph/EdgeTest.java
index 379a4db97..a6682c848 100644
--- a/logstash-core/src/test/java/org/logstash/config/ir/graph/EdgeTest.java
+++ b/logstash-core/src/test/java/org/logstash/config/ir/graph/EdgeTest.java
@@ -24,7 +24,7 @@ import org.junit.Test;
 import org.logstash.config.ir.IRHelpers;
 import org.logstash.config.ir.InvalidIRException;
 
-import static org.junit.Assert.*;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.CoreMatchers.*;
 
 public class EdgeTest {
diff --git a/logstash-core/src/test/java/org/logstash/config/ir/graph/GraphTest.java b/logstash-core/src/test/java/org/logstash/config/ir/graph/GraphTest.java
index a6c222aa0..f4be4bc49 100644
--- a/logstash-core/src/test/java/org/logstash/config/ir/graph/GraphTest.java
+++ b/logstash-core/src/test/java/org/logstash/config/ir/graph/GraphTest.java
@@ -30,7 +30,10 @@ import java.util.Collections;
 
 import static org.hamcrest.CoreMatchers.instanceOf;
 import static org.hamcrest.CoreMatchers.is;
-import static org.junit.Assert.*;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
 import static org.logstash.config.ir.IRHelpers.createTestExpression;
 import static org.logstash.config.ir.IRHelpers.createTestVertex;
 import static org.logstash.config.ir.IRHelpers.randMeta;
diff --git a/logstash-core/src/test/java/org/logstash/config/ir/graph/IfVertexTest.java b/logstash-core/src/test/java/org/logstash/config/ir/graph/IfVertexTest.java
index 996533a7d..dfb5ae523 100644
--- a/logstash-core/src/test/java/org/logstash/config/ir/graph/IfVertexTest.java
+++ b/logstash-core/src/test/java/org/logstash/config/ir/graph/IfVertexTest.java
@@ -32,7 +32,7 @@ import org.logstash.plugins.ConfigVariableExpander;
 import java.util.Collections;
 
 import static org.hamcrest.CoreMatchers.*;
-import static org.junit.Assert.assertThat;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.logstash.config.ir.IRHelpers.*;
 
 public class IfVertexTest {
diff --git a/logstash-core/src/test/java/org/logstash/config/ir/graph/PluginVertexTest.java b/logstash-core/src/test/java/org/logstash/config/ir/graph/PluginVertexTest.java
index 3c4dab32e..37b7cee6d 100644
--- a/logstash-core/src/test/java/org/logstash/config/ir/graph/PluginVertexTest.java
+++ b/logstash-core/src/test/java/org/logstash/config/ir/graph/PluginVertexTest.java
@@ -29,7 +29,7 @@ import java.util.HashMap;
 import java.util.Map;
 
 import static org.hamcrest.CoreMatchers.*;
-import static org.junit.Assert.assertThat;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.logstash.config.ir.IRHelpers.*;
 
 public class PluginVertexTest {
diff --git a/logstash-core/src/test/java/org/logstash/execution/ObservedExecutionTest.java b/logstash-core/src/test/java/org/logstash/execution/ObservedExecutionTest.java
index 263de701f..bd0d04ba6 100644
--- a/logstash-core/src/test/java/org/logstash/execution/ObservedExecutionTest.java
+++ b/logstash-core/src/test/java/org/logstash/execution/ObservedExecutionTest.java
@@ -22,8 +22,8 @@ import java.util.Arrays;
 import java.util.Collection;
 import java.util.stream.Collectors;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.*;
-import static org.junit.Assert.*;
 
 public class ObservedExecutionTest extends RubyEnvTestCase {
 
diff --git a/logstash-core/src/test/java/org/logstash/ext/JrubyEventExtLibraryTest.java b/logstash-core/src/test/java/org/logstash/ext/JrubyEventExtLibraryTest.java
index 2bf627c9e..ad9c4673f 100644
--- a/logstash-core/src/test/java/org/logstash/ext/JrubyEventExtLibraryTest.java
+++ b/logstash-core/src/test/java/org/logstash/ext/JrubyEventExtLibraryTest.java
@@ -27,6 +27,7 @@ import java.util.HashMap;
 import java.util.Map;
 import org.assertj.core.api.Assertions;
 import org.hamcrest.CoreMatchers;
+import org.hamcrest.MatcherAssert;
 import org.jruby.RubyBoolean;
 import org.jruby.RubyHash;
 import org.jruby.RubyString;
@@ -93,7 +94,7 @@ public final class JrubyEventExtLibraryTest extends RubyTestBase {
         try {
             event.ruby_set_field(context, key, value);
         } catch (RuntimeError rubyRuntimeError) {
-            Assert.assertThat(rubyRuntimeError.getLocalizedMessage(), CoreMatchers.containsString("Invalid FieldReference"));
+            MatcherAssert.assertThat(rubyRuntimeError.getLocalizedMessage(), CoreMatchers.containsString("Invalid FieldReference"));
             return;
         }
         Assert.fail("expected ruby RuntimeError was not thrown.");
@@ -109,7 +110,7 @@ public final class JrubyEventExtLibraryTest extends RubyTestBase {
 
         event.ruby_set_field(context, key, value);
         IRubyObject retrievedValue = event.ruby_get_field(context, key);
-        Assert.assertThat(retrievedValue, CoreMatchers.equalTo(value));
+        MatcherAssert.assertThat(retrievedValue, CoreMatchers.equalTo(value));
 
         RubyHash eventHash = (RubyHash) event.ruby_to_hash_with_metadata(context);
         IRubyObject nestedValue = eventHash.dig(context, rubyString("foo"), rubyString("il[[]]]legal"));
diff --git a/logstash-core/src/test/java/org/logstash/instrument/metrics/ExtendedFlowMetricTest.java b/logstash-core/src/test/java/org/logstash/instrument/metrics/ExtendedFlowMetricTest.java
index ebf9e1ff2..215b18f13 100644
--- a/logstash-core/src/test/java/org/logstash/instrument/metrics/ExtendedFlowMetricTest.java
+++ b/logstash-core/src/test/java/org/logstash/instrument/metrics/ExtendedFlowMetricTest.java
@@ -10,6 +10,7 @@ import java.time.Instant;
 import java.util.Map;
 import java.util.function.Consumer;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.anEmptyMap;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.hasEntry;
@@ -17,7 +18,6 @@ import static org.hamcrest.Matchers.hasKey;
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.lessThan;
 import static org.hamcrest.Matchers.not;
-import static org.junit.Assert.assertThat;
 
 public class ExtendedFlowMetricTest {
     @Test
diff --git a/logstash-core/src/test/java/org/logstash/instrument/metrics/SimpleFlowMetricTest.java b/logstash-core/src/test/java/org/logstash/instrument/metrics/SimpleFlowMetricTest.java
index a0956b79f..f6ea280f7 100644
--- a/logstash-core/src/test/java/org/logstash/instrument/metrics/SimpleFlowMetricTest.java
+++ b/logstash-core/src/test/java/org/logstash/instrument/metrics/SimpleFlowMetricTest.java
@@ -8,12 +8,12 @@ import java.time.Instant;
 import java.util.List;
 import java.util.Map;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.anEmptyMap;
 import static org.hamcrest.Matchers.hasEntry;
 import static org.hamcrest.Matchers.is;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
 import static org.logstash.instrument.metrics.SimpleFlowMetric.LIFETIME_KEY;
 import static org.logstash.instrument.metrics.SimpleFlowMetric.CURRENT_KEY;
diff --git a/logstash-core/src/test/java/org/logstash/instrument/metrics/timer/TimerMetricTest.java b/logstash-core/src/test/java/org/logstash/instrument/metrics/timer/TimerMetricTest.java
index a05fd7418..d61f9e45f 100644
--- a/logstash-core/src/test/java/org/logstash/instrument/metrics/timer/TimerMetricTest.java
+++ b/logstash-core/src/test/java/org/logstash/instrument/metrics/timer/TimerMetricTest.java
@@ -10,10 +10,10 @@ import java.util.Optional;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.is;
 import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertThat;
 import static org.junit.Assert.fail;
 
 /**
diff --git a/logstash-core/src/test/java/org/logstash/secret/store/SecretStoreFactoryTest.java b/logstash-core/src/test/java/org/logstash/secret/store/SecretStoreFactoryTest.java
index 9a6129375..7bf133745 100644
--- a/logstash-core/src/test/java/org/logstash/secret/store/SecretStoreFactoryTest.java
+++ b/logstash-core/src/test/java/org/logstash/secret/store/SecretStoreFactoryTest.java
@@ -22,7 +22,6 @@ package org.logstash.secret.store;
 
 import org.junit.Rule;
 import org.junit.Test;
-import org.junit.rules.ExpectedException;
 import org.junit.rules.TemporaryFolder;
 import org.logstash.secret.SecretIdentifier;
 import org.logstash.secret.store.backend.JavaKeyStore;
@@ -36,6 +35,7 @@ import java.util.Map;
 import java.util.UUID;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.Assert.assertThrows;
 import static org.logstash.secret.store.SecretStoreFactory.ENVIRONMENT_PASS_KEY;
 import static org.logstash.secret.store.SecretStoreFactory.KEYSTORE_ACCESS_KEY;
 import static org.logstash.secret.store.SecretStoreFactory.LOGSTASH_MARKER;
@@ -49,9 +49,6 @@ public class SecretStoreFactoryTest {
     @Rule
     public TemporaryFolder folder = new TemporaryFolder();
 
-    @Rule
-    public ExpectedException thrown = ExpectedException.none();
-
     private static final SecretStoreFactory secretStoreFactory = SecretStoreFactory.fromEnvironment();
 
     @Test
@@ -65,12 +62,12 @@ public class SecretStoreFactoryTest {
 
     @Test
     public void testAlternativeImplementationInvalid() {
-        thrown.expect(SecretStoreException.ImplementationNotFoundException.class);
         SecureConfig secureConfig = new SecureConfig();
         secureConfig.add("keystore.classname", "junk".toCharArray());
-        SecretStore secretStore = secretStoreFactory.load(secureConfig);
-        assertThat(secretStore).isInstanceOf(MemoryStore.class);
-        validateMarker(secretStore);
+
+        assertThrows(SecretStoreException.ImplementationNotFoundException.class, () -> {
+            secretStoreFactory.load(secureConfig);
+        });
     }
 
     @Test
@@ -140,9 +137,10 @@ public class SecretStoreFactoryTest {
      */
     @Test
     public void testErrorLoading() {
-        thrown.expect(SecretStoreException.LoadException.class);
-        //default implementation requires a path
-        secretStoreFactory.load(new SecureConfig());
+        assertThrows(SecretStoreException.LoadException.class, () -> {
+            //default implementation requires a path
+            secretStoreFactory.load(new SecureConfig());
+        });
     }
 
     private void validateMarker(SecretStore secretStore) {
diff --git a/logstash-core/src/test/java/org/logstash/secret/store/backend/JavaKeyStoreTest.java b/logstash-core/src/test/java/org/logstash/secret/store/backend/JavaKeyStoreTest.java
index 02b49ba4a..bfd9615dd 100644
--- a/logstash-core/src/test/java/org/logstash/secret/store/backend/JavaKeyStoreTest.java
+++ b/logstash-core/src/test/java/org/logstash/secret/store/backend/JavaKeyStoreTest.java
@@ -25,7 +25,6 @@ import org.junit.Before;
 import org.junit.Ignore;
 import org.junit.Rule;
 import org.junit.Test;
-import org.junit.rules.ExpectedException;
 import org.junit.rules.TemporaryFolder;
 import org.logstash.secret.SecretIdentifier;
 import org.logstash.secret.store.SecretStore;
@@ -57,6 +56,7 @@ import java.util.stream.IntStream;
 import static java.nio.file.attribute.PosixFilePermission.*;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Fail.fail;
+import static org.junit.Assert.assertThrows;
 import static org.logstash.secret.store.SecretStoreFactory.LOGSTASH_MARKER;
 
 /**
@@ -68,8 +68,6 @@ public class JavaKeyStoreTest {
     private final static String EXTERNAL_TEST_WRITE = "test_external_write";
     @Rule
     public TemporaryFolder folder = new TemporaryFolder();
-    @Rule
-    public ExpectedException thrown = ExpectedException.none();
     private JavaKeyStore keyStore;
     private char[] keyStorePath;
     private SecureConfig withDefaultPassConfig;
@@ -210,7 +208,6 @@ public class JavaKeyStoreTest {
      */
     @Test
     public void notLogstashKeystore() throws Exception {
-        thrown.expect(SecretStoreException.class);
         SecureConfig altConfig = new SecureConfig();
         Path altPath = folder.newFolder().toPath().resolve("alt.not.a.logstash.keystore");
         try (OutputStream out = Files.newOutputStream(altPath)) {
@@ -219,7 +216,10 @@ public class JavaKeyStoreTest {
             out.write(randomBytes);
         }
         altConfig.add("keystore.file", altPath.toString().toCharArray());
-        new JavaKeyStore().load(altConfig);
+
+        assertThrows(SecretStoreException.class, () -> {
+            new JavaKeyStore().load(altConfig);
+        });
     }
 
     /**
@@ -229,9 +229,11 @@ public class JavaKeyStoreTest {
      */
     @Test
     public void notLogstashKeystoreNoMarker() throws Exception {
-        thrown.expect(SecretStoreException.LoadException.class);
         withDefinedPassConfig.add("keystore.file", Paths.get(this.getClass().getClassLoader().getResource("not.a.logstash.keystore").toURI()).toString().toCharArray().clone());
-        new JavaKeyStore().load(withDefinedPassConfig);
+
+        assertThrows(SecretStoreException.LoadException.class, () -> {
+            new JavaKeyStore().load(withDefinedPassConfig);
+        });
     }
 
     /**
@@ -313,7 +315,6 @@ public class JavaKeyStoreTest {
      */
     @Test
     public void tamperedKeystore() throws Exception {
-        thrown.expect(SecretStoreException.class);
         byte[] keyStoreAsBytes = Files.readAllBytes(Paths.get(new String(keyStorePath)));
         //bump the middle byte by 1
         int tamperLocation = keyStoreAsBytes.length / 2;
@@ -322,7 +323,10 @@ public class JavaKeyStoreTest {
         Files.write(tamperedPath, keyStoreAsBytes);
         SecureConfig sc = new SecureConfig();
         sc.add("keystore.file", tamperedPath.toString().toCharArray());
-        new JavaKeyStore().load(sc);
+
+        assertThrows(SecretStoreException.class, () -> {
+            new JavaKeyStore().load(sc);
+        });
     }
 
     /**
@@ -332,10 +336,12 @@ public class JavaKeyStoreTest {
      */
     @Test
     public void testAlreadyCreated() throws IOException {
-        thrown.expect(SecretStoreException.AlreadyExistsException.class);
         SecureConfig secureConfig = new SecureConfig();
         secureConfig.add("keystore.file", keyStorePath.clone());
-        new JavaKeyStore().create(secureConfig);
+
+        assertThrows(SecretStoreException.AlreadyExistsException.class, () -> {
+            new JavaKeyStore().create(secureConfig);
+        });
     }
 
     /**
@@ -362,7 +368,6 @@ public class JavaKeyStoreTest {
 
     @Test
     public void testDelete() throws IOException {
-        thrown.expect(SecretStoreException.LoadException.class);
         Path altPath = folder.newFolder().toPath().resolve("alt.logstash.keystore");
         SecureConfig altConfig = new SecureConfig();
         altConfig.add("keystore.file", altPath.toString().toCharArray());
@@ -372,8 +377,10 @@ public class JavaKeyStoreTest {
         assertThat(new String(marker, StandardCharsets.UTF_8)).isEqualTo(LOGSTASH_MARKER.getKey());
         secretStore.delete(altConfig.clone());
         assertThat(secretStore.exists(altConfig.clone())).isFalse();
-       new JavaKeyStore().load(altConfig.clone());
 
+        assertThrows(SecretStoreException.LoadException.class, () -> {
+            new JavaKeyStore().load(altConfig.clone());
+        });
     }
 
     /**
@@ -383,12 +390,14 @@ public class JavaKeyStoreTest {
      */
     @Test
     public void testEmptyNotAllowedOnCreate() throws IOException {
-        thrown.expect(SecretStoreException.CreateException.class);
         Path altPath = folder.newFolder().toPath().resolve("alt.logstash.keystore");
         SecureConfig altConfig = new SecureConfig();
         altConfig.add("keystore.file", altPath.toString().toCharArray());
         altConfig.add(SecretStoreFactory.KEYSTORE_ACCESS_KEY, "".toCharArray());
-        new JavaKeyStore().create(altConfig);
+
+        assertThrows(SecretStoreException.CreateException.class, () -> {
+            new JavaKeyStore().create(altConfig);
+        });
     }
 
     /**
@@ -398,7 +407,6 @@ public class JavaKeyStoreTest {
      */
     @Test
     public void testEmptyNotAllowedOnExisting() throws Exception {
-        thrown.expect(SecretStoreException.AccessException.class);
         Path altPath = folder.newFolder().toPath().resolve("alt.logstash.keystore");
         SecureConfig altConfig = new SecureConfig();
         altConfig.add("keystore.file", altPath.toString().toCharArray());
@@ -406,7 +414,10 @@ public class JavaKeyStoreTest {
         altConfig2.add("keystore.file", altPath.toString().toCharArray());
         altConfig2.add(SecretStoreFactory.KEYSTORE_ACCESS_KEY, "".toCharArray());
         new JavaKeyStore().create(altConfig);
-        new JavaKeyStore().load(altConfig2);
+
+        assertThrows(SecretStoreException.AccessException.class, () -> {
+            new JavaKeyStore().load(altConfig2);
+        });
     }
 
     /**
@@ -583,17 +594,20 @@ public class JavaKeyStoreTest {
 
     @Test
     public void testLoadNotCreated() throws IOException {
-        thrown.expect(SecretStoreException.LoadException.class);
         Path altPath = folder.newFolder().toPath().resolve("alt.logstash.keystore");
         SecureConfig secureConfig = new SecureConfig();
         secureConfig.add("keystore.file", altPath.toString().toCharArray());
-        new JavaKeyStore().load(secureConfig.clone());
+
+        assertThrows(SecretStoreException.LoadException.class, () -> {
+            new JavaKeyStore().load(secureConfig.clone());
+        });
     }
 
     @Test
     public void testNoPathDefined() {
-        thrown.expect(SecretStoreException.LoadException.class);
-        new JavaKeyStore().load(new SecureConfig());
+        assertThrows(SecretStoreException.LoadException.class, () -> {
+            new JavaKeyStore().load(new SecureConfig());
+        });
     }
 
     /**
@@ -687,9 +701,11 @@ public class JavaKeyStoreTest {
      */
     @Test
     public void wrongPassword() throws Exception {
-        thrown.expect(SecretStoreException.AccessException.class);
         withDefinedPassConfig.add(SecretStoreFactory.KEYSTORE_ACCESS_KEY, "wrongpassword".toCharArray());
-        new JavaKeyStore().load(withDefinedPassConfig);
+
+        assertThrows(SecretStoreException.AccessException.class, () -> {
+            new JavaKeyStore().load(withDefinedPassConfig);
+        });
     }
 
     @Test(timeout = 40_000)
diff --git a/logstash-core/src/test/java/org/logstash/util/CloudSettingAuthTest.java b/logstash-core/src/test/java/org/logstash/util/CloudSettingAuthTest.java
index 7ccf22bcd..e116e4ee0 100644
--- a/logstash-core/src/test/java/org/logstash/util/CloudSettingAuthTest.java
+++ b/logstash-core/src/test/java/org/logstash/util/CloudSettingAuthTest.java
@@ -19,49 +19,46 @@
 
 package org.logstash.util;
 
-import org.junit.Rule;
 import org.junit.Test;
-import org.junit.rules.ExpectedException;
 
 import org.logstash.RubyTestBase;
 
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
 import static org.junit.Assert.*;
 
 public class CloudSettingAuthTest extends RubyTestBase {
 
-    @Rule
-    public ExpectedException exceptionRule = ExpectedException.none();
-
     @Test
     public void testThrowExceptionWhenGivenStringWithoutSeparatorOrPassword() {
-        exceptionRule.expect(org.jruby.exceptions.ArgumentError.class);
-        exceptionRule.expectMessage("Cloud Auth username and password format should be");
-
-        new CloudSettingAuth("foobarbaz");
+        Exception thrownException = assertThrows(org.jruby.exceptions.ArgumentError.class, () -> {
+            new CloudSettingAuth("foobarbaz");
+        });
+        assertThat(thrownException.getMessage(), containsString("Cloud Auth username and password format should be"));
     }
 
     @Test
     public void testThrowExceptionWhenGivenStringWithoutPassword() {
-        exceptionRule.expect(org.jruby.exceptions.ArgumentError.class);
-        exceptionRule.expectMessage("Cloud Auth username and password format should be");
-
-        new CloudSettingAuth("foo:");
+        Exception thrownException = assertThrows(org.jruby.exceptions.ArgumentError.class, () -> {
+            new CloudSettingAuth("foo:");
+        });
+        assertThat(thrownException.getMessage(), containsString("Cloud Auth username and password format should be"));
     }
 
     @Test
     public void testThrowExceptionWhenGivenStringWithoutUsername() {
-        exceptionRule.expect(org.jruby.exceptions.ArgumentError.class);
-        exceptionRule.expectMessage("Cloud Auth username and password format should be");
-
-        new CloudSettingAuth(":bar");
+        Exception thrownException = assertThrows(org.jruby.exceptions.ArgumentError.class, () -> {
+            new CloudSettingAuth(":bar");
+        });
+        assertThat(thrownException.getMessage(), containsString("Cloud Auth username and password format should be"));
     }
 
     @Test
     public void testThrowExceptionWhenGivenStringWhichIsEmpty() {
-        exceptionRule.expect(org.jruby.exceptions.ArgumentError.class);
-        exceptionRule.expectMessage("Cloud Auth username and password format should be");
-
-        new CloudSettingAuth("");
+        Exception thrownException = assertThrows(org.jruby.exceptions.ArgumentError.class, () -> {
+            new CloudSettingAuth("");
+        });
+        assertThat(thrownException.getMessage(), containsString("Cloud Auth username and password format should be"));
     }
 
     @Test
diff --git a/logstash-core/src/test/java/org/logstash/util/CloudSettingIdTest.java b/logstash-core/src/test/java/org/logstash/util/CloudSettingIdTest.java
index 808b439fb..1e04c30cd 100644
--- a/logstash-core/src/test/java/org/logstash/util/CloudSettingIdTest.java
+++ b/logstash-core/src/test/java/org/logstash/util/CloudSettingIdTest.java
@@ -20,22 +20,22 @@
 package org.logstash.util;
 
 import org.junit.Before;
-import org.junit.Rule;
 import org.junit.Test;
-import org.junit.rules.ExpectedException;
 
 import org.logstash.RubyTestBase;
 
-import static org.junit.Assert.*;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertThrows;
 
 public class CloudSettingIdTest extends RubyTestBase {
 
     private String input = "foobar:dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy";
     private CloudSettingId sut;
 
-    @Rule
-    public ExpectedException exceptionRule = ExpectedException.none();
-
     @Before
     public void setUp() {
         sut = new CloudSettingId(input);
@@ -63,40 +63,45 @@ public class CloudSettingIdTest extends RubyTestBase {
     public void testThrowExceptionWhenMalformedValueIsGiven() {
         String[] raw = new String[] {"first", "second"};
         String encoded = CloudSettingId.cloudIdEncode(raw);
-        exceptionRule.expect(org.jruby.exceptions.ArgumentError.class);
-        exceptionRule.expectMessage("Cloud Id, after decoding, is invalid. Format: '<segment1>$<segment2>$<segment3>'. Received: \"" + String.join("$", raw) + "\".");
 
-        new CloudSettingId(encoded);
+        Exception thrownException = assertThrows(org.jruby.exceptions.ArgumentError.class, () -> {
+            new CloudSettingId(encoded);
+        });
+        assertThat(thrownException.getMessage(), containsString("Cloud Id, after decoding, is invalid. Format: '<segment1>$<segment2>$<segment3>'. Received: \"" + String.join("$", raw) + "\"."));
     }
 
     @Test
     public void testThrowExceptionWhenAtLeatOneSegmentIsEmpty() {
         String[] raw = new String[] {"first", "", "third"};
         String encoded = CloudSettingId.cloudIdEncode(raw);
-        exceptionRule.expect(org.jruby.exceptions.ArgumentError.class);
-        exceptionRule.expectMessage("Cloud Id, after decoding, is invalid. Format: '<segment1>$<segment2>$<segment3>'. Received: \"" + String.join("$", raw) + "\".");
 
-        new CloudSettingId(encoded);
+        Exception thrownException = assertThrows(org.jruby.exceptions.ArgumentError.class, () -> {
+            new CloudSettingId(encoded);
+        });
+        assertThat(thrownException.getMessage(), containsString("Cloud Id, after decoding, is invalid. Format: '<segment1>$<segment2>$<segment3>'. Received: \"" + String.join("$", raw) + "\"."));
     }
 
     @Test
     public void testThrowExceptionWhenElasticSegmentSegmentIsUndefined() {
         String[] raw = new String[] {"us-east-1.aws.found.io", "undefined", "my-kibana"};
         String encoded = CloudSettingId.cloudIdEncode(raw);
-        exceptionRule.expect(org.jruby.exceptions.ArgumentError.class);
-        exceptionRule.expectMessage("Cloud Id, after decoding, elasticsearch segment is 'undefined', literally.");
 
-        new CloudSettingId(encoded);
+        Exception thrownException = assertThrows(org.jruby.exceptions.ArgumentError.class, () -> {
+            new CloudSettingId(encoded);
+        });
+        assertThat(thrownException.getMessage(), containsString("Cloud Id, after decoding, elasticsearch segment is 'undefined', literally."));
     }
 
     @Test
     public void testThrowExceptionWhenKibanaSegmentSegmentIsUndefined() {
         String[] raw = new String[] {"us-east-1.aws.found.io", "my-elastic-cluster", "undefined"};
         String encoded = CloudSettingId.cloudIdEncode(raw);
-        exceptionRule.expect(org.jruby.exceptions.ArgumentError.class);
-        exceptionRule.expectMessage("Cloud Id, after decoding, the kibana segment is 'undefined', literally. You may need to enable Kibana in the Cloud UI.");
 
-        new CloudSettingId(encoded);
+        Exception thrownException = assertThrows(org.jruby.exceptions.ArgumentError.class, () -> {
+            new CloudSettingId(encoded);
+        });
+        assertThat(thrownException.getMessage(), containsString("Cloud Id, after decoding, the kibana segment is 'undefined', literally. You may need to enable Kibana in the Cloud UI."));
+
     }
 
     // without a label
diff --git a/logstash-core/src/test/java/org/logstash/util/ExceptionMatcher.java b/logstash-core/src/test/java/org/logstash/util/ExceptionMatcher.java
deleted file mode 100644
index 322d2fc20..000000000
--- a/logstash-core/src/test/java/org/logstash/util/ExceptionMatcher.java
+++ /dev/null
@@ -1,20 +0,0 @@
-package org.logstash.util;
-
-import org.hamcrest.Matchers;
-import org.junit.Assert;
-
-@FunctionalInterface
-public interface ExceptionMatcher {
-    void execute() throws Throwable;
-
-    static <T extends Throwable> T assertThrows(Class<T> expectedType, ExceptionMatcher executable) {
-        try {
-            executable.execute();
-        } catch (Throwable actual) {
-            Assert.assertThat(actual, Matchers.instanceOf(expectedType));
-            return expectedType.cast(actual);
-        }
-
-        throw new AssertionError(String.format("Expected %s to be thrown, but nothing was thrown.", expectedType.getName()));
-    }
-}
\ No newline at end of file
diff --git a/logstash-core/src/test/java/org/logstash/util/SetOnceReferenceTest.java b/logstash-core/src/test/java/org/logstash/util/SetOnceReferenceTest.java
index 49b25ec33..5dc469790 100644
--- a/logstash-core/src/test/java/org/logstash/util/SetOnceReferenceTest.java
+++ b/logstash-core/src/test/java/org/logstash/util/SetOnceReferenceTest.java
@@ -12,8 +12,8 @@ import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.nullValue;
 import static org.hamcrest.Matchers.sameInstance;
-import static org.junit.Assert.assertThat;
-import static org.logstash.util.ExceptionMatcher.assertThrows;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertThrows;
 
 public class SetOnceReferenceTest {
     @Test
diff --git a/qa/integration/build.gradle b/qa/integration/build.gradle
index 29649bca0..3cf9a5455 100644
--- a/qa/integration/build.gradle
+++ b/qa/integration/build.gradle
@@ -32,7 +32,7 @@ buildscript {
 dependencies {
   testImplementation project(':logstash-core')
   testImplementation 'org.assertj:assertj-core:3.8.0'
-  testImplementation 'junit:junit:4.12'
+  testImplementation 'junit:junit:4.13.2'
 }
 
 test {
diff --git a/tools/benchmark-cli/build.gradle b/tools/benchmark-cli/build.gradle
index 91313c2c7..596fffa00 100644
--- a/tools/benchmark-cli/build.gradle
+++ b/tools/benchmark-cli/build.gradle
@@ -60,7 +60,7 @@ dependencies {
   implementation group: 'org.elasticsearch.client', name: 'elasticsearch-rest-client', version: elasticsearch
   implementation "org.openjdk.jmh:jmh-core:$jmh"
   testImplementation group: 'com.github.tomakehurst', name: 'wiremock-standalone', version: '2.27.0'
-  testImplementation "junit:junit:4.12"
+  testImplementation "junit:junit:4.13.2"
 }
 
 javadoc {
diff --git a/tools/dependencies-report/build.gradle b/tools/dependencies-report/build.gradle
index 67995b5c1..76549941e 100644
--- a/tools/dependencies-report/build.gradle
+++ b/tools/dependencies-report/build.gradle
@@ -47,7 +47,7 @@ dependencies {
   implementation "com.fasterxml.jackson.core:jackson-core:${jacksonVersion}"
   implementation "com.fasterxml.jackson.core:jackson-databind:${jacksonVersion}"
   implementation "com.fasterxml.jackson.core:jackson-annotations:${jacksonVersion}"
-  testImplementation 'junit:junit:4.12'
+  testImplementation 'junit:junit:4.13.2'
 }
 
 javadoc {
diff --git a/tools/dependencies-report/src/test/java/org/logstash/dependencies/ReportGeneratorTest.java b/tools/dependencies-report/src/test/java/org/logstash/dependencies/ReportGeneratorTest.java
index 4e71d68ec..324d615ce 100644
--- a/tools/dependencies-report/src/test/java/org/logstash/dependencies/ReportGeneratorTest.java
+++ b/tools/dependencies-report/src/test/java/org/logstash/dependencies/ReportGeneratorTest.java
@@ -34,9 +34,9 @@ import java.util.regex.Pattern;
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
 import static org.logstash.dependencies.Main.ACCEPTABLE_LICENSES_PATH;
 
diff --git a/tools/dependencies-report/src/test/resources/expectedNoticeOutput.txt b/tools/dependencies-report/src/test/resources/expectedNoticeOutput.txt
index 112223333..570e65faa 100644
--- a/tools/dependencies-report/src/test/resources/expectedNoticeOutput.txt
+++ b/tools/dependencies-report/src/test/resources/expectedNoticeOutput.txt
@@ -76,7 +76,7 @@ Notice for: json-parser-
 TEST
 
 ==========
-Notice for: junit:junit-4.12
+Notice for: junit:junit-4.13.2
 ----------
 
 TEST
diff --git a/tools/dependencies-report/src/test/resources/expectedOutput.txt b/tools/dependencies-report/src/test/resources/expectedOutput.txt
index f01eaa821..cf3dfe6b0 100644
--- a/tools/dependencies-report/src/test/resources/expectedOutput.txt
+++ b/tools/dependencies-report/src/test/resources/expectedOutput.txt
@@ -12,6 +12,6 @@ jruby-openssl,0.9.21,,https://rubygems.org/gems/jruby-openssl/versions/0.9.20-ja
 jruby-readline,1.1.1,,https://rubygems.org/gems/jruby-readline/versions/1.1.1-java,Apache-2.0,,
 json-generator,,,https://github.com/flori/json,Ruby,,
 json-parser,,,https://rubygems.org/gems/json-parser/versions/0.0.1,Apache-2.0,,
-junit:junit,4.12,,https://github.com/junit-team/junit4,Apache-2.0,,
+junit:junit,4.13.2,,https://github.com/junit-team/junit4,Apache-2.0,,
 org.codehaus.janino:commons-compiler,3.0.8,,https://github.com/janino-compiler/janino,BSD-3-Clause-Attribution,,
 tzinfo,,,https://github.com/tzinfo/tzinfo,MIT,Philip Ross,
diff --git a/tools/dependencies-report/src/test/resources/javaLicenses1.csv b/tools/dependencies-report/src/test/resources/javaLicenses1.csv
index 305cadaff..9bb374967 100644
--- a/tools/dependencies-report/src/test/resources/javaLicenses1.csv
+++ b/tools/dependencies-report/src/test/resources/javaLicenses1.csv
@@ -2,5 +2,5 @@
 "com.fasterxml.jackson.core:jackson-core:2.9.4","https://github.com/FasterXML/jackson-core","The Apache Software License, Version 2.0","http://www.apache.org/licenses/LICENSE-2.0.txt",
 "com.google.errorprone:javac-shaded:9-dev-r4023-3","https://github.com/google/error-prone-javac","GNU General Public License, version 2, with the Classpath Exception","http://openjdk.java.net/legal/gplv2+ce.html",
 "gradle.plugin.com.github.jk1:gradle-license-report:0.7.1",,,,
-"junit:junit:4.12","http://junit.org","Eclipse Public License 1.0","http://www.eclipse.org/legal/epl-v10.html",
+"junit:junit:4.13.2","http://junit.org","Eclipse Public License 1.0","http://www.eclipse.org/legal/epl-v10.html",
 "org.codehaus.janino:commons-compiler:3.0.8",,"New BSD License","https://raw.githubusercontent.com/janino-compiler/janino/master/LICENSE",
diff --git a/tools/ingest-converter/build.gradle b/tools/ingest-converter/build.gradle
index 928413700..5df635dc2 100644
--- a/tools/ingest-converter/build.gradle
+++ b/tools/ingest-converter/build.gradle
@@ -44,7 +44,7 @@ buildscript {
 dependencies {
   implementation 'net.sf.jopt-simple:jopt-simple:4.6'
   implementation "com.fasterxml.jackson.core:jackson-databind:${jacksonDatabindVersion}"
-  testImplementation "junit:junit:4.12"
+  testImplementation "junit:junit:4.13.2"
   testImplementation 'commons-io:commons-io:2.13.0'
 }
 
diff --git a/tools/jvm-options-parser/build.gradle b/tools/jvm-options-parser/build.gradle
index 811198748..d744e9751 100644
--- a/tools/jvm-options-parser/build.gradle
+++ b/tools/jvm-options-parser/build.gradle
@@ -35,7 +35,7 @@ project.sourceCompatibility = JavaVersion.VERSION_11
 project.targetCompatibility = JavaVersion.VERSION_11
 
 dependencies {
-  testImplementation "junit:junit:4.13.1"
+  testImplementation "junit:junit:4.13.2"
 }
 
 javadoc {
diff --git a/x-pack/build.gradle b/x-pack/build.gradle
index 9aeb4515d..42ba297cd 100644
--- a/x-pack/build.gradle
+++ b/x-pack/build.gradle
@@ -23,7 +23,7 @@ configurations {
 dependencies {
   testImplementation project(':logstash-core')
   testImplementation 'org.assertj:assertj-core:3.8.0'
-  testImplementation 'junit:junit:4.12'
+  testImplementation 'junit:junit:4.13.2'
 
   geolite2('org.elasticsearch:geolite2-databases:20191119') {
     transitive = false