Because of the log4j vulnerability I'm in the need to patch a elasticsearch 5.6.16 instance that I cannot immediately update.
The docker image uses:
Can elasticsearch 5.6.16 work with log4j-core-2.16?
And is it the correct way to replace both with the core jar that can be found here https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.16.0/ ?
According to the official security announcement, if you're running on 5.6.16 you don't need to upgrade Log4J but simply set the following JVM option
-Dlog4j2.formatMsgNoLookups=true
As an additional mitigation, you can also remove the JndiLookup class from the log4j JAR using:
zip -q -d <ES_HOME>/lib/log4j-core-2.* org/apache/logging/log4j/core/lookup/JndiLookup.class
We are using Elastic Search 7.1.1 and we successfully upgraded to 2.16 log4j Version . Make sure you swap both Core and Api jars and restart the server . It will work . If you try and removing JNDIlookup class its fails .
We did it across all the lanes and its working and stable
We used the below for our ElasticSearch version 6.3.1. We have to remove the JndiLookup.class vulnerable class from log4j-core-*.jar file.
If you using Elasticsearch 5.0.0-5.6.10 and 6.0.0-6.3.2 then you will have to follow the below steps as per official link.