I think you need to look into replacing log4j in elasticsearch with logback since shield does not control the logger; we piggyback on the elasticsearch infrastructure. There is an old thread about it but I really have no idea if it will still work. Replacing log4j with logback