Fix log4j ：upgrade ES version OR replace log4j.jar to 2.17.2

[qiuxb (qiuxinbo)]

At present, we have more than 500 Elasticsearch clusters, with thousands of nodes. The Elasticsearch versions are 6.3.2, 7.2 and 7.4. In order to solve the log4j vulnerability, if you choose to upgrade the Elasticsearch version on a large scale, it will affect the online business. The cost is relatively high. I have recently referred to other repair methods, such as replacing the log4j jar version with 2.17.2. Which method is currently considered? give me some advice

[Christian_Dahlqvist]

Have a look at this thread.

[qiuxb (qiuxinbo)]

Thank you, if I can't use the solution of replacing the jar package,
can I refer to this solution ：

Elasticsearch 5.0.0-5.6.10 and 6.0.0-6.3.2: Log4j CVE-2021-44228, CVE-2021-45046 remediation

Note — If you are not running Elasticsearch 5.0.0-5.6.10 or 6.0.0-6.3.2, these instructions do not apply. Please follow the guidance in the main announcement. Instructions for removing JndiLookup from the log4j-core JAR file​ These instructions only apply to users running Elasticsearch versions between 5.0.0 and 5.6.10 (inclusive) or between 6.0.0 and 6.3.2 (inclusive). These must not be used in other versions of Elasticsearch as there are safer, supported remediations (or no remediation is ne…

[Christian_Dahlqvist]

It seems like that would apply to your 6.3.2 clusters but not the 7.x ones.

[qiuxb (qiuxinbo)]

Yes, only handles Elasticsearch version 6.3.2, excluding 7.x

[system]

Elasticsearch version 6.3 is EOL and no longer supported. Please upgrade ASAP.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns )