# Secure log4j for elasticsearch

**URL:** <https://discuss.elastic.co/t/secure-log4j-for-elasticsearch/291684>\
**Category:** Elasticsearch\
**Created:** [December 13, 2021, 3:33pm UTC](https://discuss.elastic.co/t/secure-log4j-for-elasticsearch/291684 "2021-12-13T15:33:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![beci](https://avatars.discourse-cdn.com/v4/letter/b/ac8455/32.png) [@beci](https://discuss.elastic.co/u/beci)\
**Post date:** [December 13, 2021, 3:33pm UTC](https://discuss.elastic.co/t/secure-log4j-for-elasticsearch/291684/1 "2021-12-13T15:33:39Z")

</div>

Hello,

We have a server with logstash and Elasticsearch installed on it, I updated these two items to 7.16.1.  
When I search for files that say "\* log4j \*", there are always items mentioning version 2.11.1 of log4j :

/usr/share/Elasticsearch/modules/x-pack-core/log4j-1.2-api-2.11.1.jar  
/usr/share/Elasticsearch/modules/x-pack-identity-provider/log4j-slf4j-impl-2.11.1.jar  
/usr/share/Elasticsearch/modules/x-pack-security/log4j-slf4j-impl-2.11.1.jar  
/usr/share/Elasticsearch/modules/vector-tile/log4j-slf4j-impl-2.11.1.jar  
/usr/share/Elasticsearch/modules/repository-url/log4j-1.2-api-2.11.1.jar  
/usr/share/Elasticsearch/lib/log4j-api-2.11.1.jar

Can you tell me if this is normal and if not how to fix it ?

Thanks for your help

---

<div class="post-metadata">

**Author:** ![beci](https://avatars.discourse-cdn.com/v4/letter/b/ac8455/32.png) [@beci](https://discuss.elastic.co/u/beci)\
**Post date:** [December 14, 2021, 10:47am UTC](https://discuss.elastic.co/t/secure-log4j-for-elasticsearch/291684/2 "2021-12-14T10:47:12Z")

</div>

I found my answer in this topic [Apache Log4j2 Remote Code Execution (RCE) Vulnerability - CVE-2021-44228 - ESA-2021-31](https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 11, 2022, 10:47am UTC](https://discuss.elastic.co/t/secure-log4j-for-elasticsearch/291684/3 "2022-01-11T10:47:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.