Hello Team, I am using logstash 7.5.1 and having log4j jar as 2.11.1. Now as per doc https://discuss.elastic.co/ it is mentioned to remove JNDI class if we don't want to upgrade logstash. Is it possible if I can upgrade log4j jar to 2.15.0 in my current logstash version to mitigate this vulnerabili…

No, you can't just replace the jar with a newer version. Please read the security announcement about the Log4J exploit, there you will find how to mitigate the issue according to your Logstash/Elasticsearch version. If what you want to do is not mentioned there, then it is not recommended or teste…

Replace Log4j from 2.11.0 to 2.15.0

Elastic Stack Logstash

system (system) Closed February 3, 2022, 9:02am 11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Urgent - Incomplete fix for Apache Log4j vulnerability v2.15.0 Logstash	3	3575	January 19, 2022
Log4j on Elasticsearch 7.9.2 Elasticsearch	9	3587	February 14, 2022
Replace Log4j from 2.x to 2.17.0 or later Elasticsearch	5	3103	February 21, 2022
How to update log4j jar in logstash installed in ubuntu VM Logstash	3	2563	January 11, 2022
Fix log4j ：upgrade ES version OR replace log4j.jar to 2.17.2 Elasticsearch	6	2058	May 19, 2022

Replace Log4j from 2.11.0 to 2.15.0

Related topics