Logstash update log4j version

[yaauie (Ry Biesemeyer)]

The packaged code is still attempting to load the old jars, and is not finding them.

While upgrading the log4j jars and replacing all references in-place may work from a technical standpoint, the recommended mitigations per ESA-2021-31 remain:

@Levine

Users should upgrade to Logstash 7.16.2 or 6.8.22, which were released on December 19, 2021. These releases replace vulnerable versions of Log4j with Log4j 2.17.0.

The widespread flag -Dlog4j2.formatMsgNoLookups=true is NOT sufficient to mitigate the vulnerability in Logstash in all cases, as Logstash uses Log4j in a way where the flag has no effect. If the user cannot upgrade to Logstash 7.16.2 or 6.8.22, it is necessary to remove the JndiLookup class from the log4j2 core jar, with the following command (which is applicable for 5.x, 6.x, and 7.x):

[EDIT: updated with guidance from 2021-12-19 reflecting releases of 7.16.2 and 6.8.22]