Addressing log4j vulnerability for 1.x and 2.x elasticsearch

Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31 has details for anything <5.0

But please do be aware that these have all been EOL for quite a long time and are no longer supported.