Log4j vulnerability elk platform processing method (logstah5.5.1)

End of network closure , Start to deal with log4j Loophole :

Method one replaces jar file

Method 2 Delete jar The class in the package

1. Application vulnerability Replace log4j-core xxx .jar

2.es Vulnerabilities need to be replaced core and api Otherwise, the report will be wrong :NoSuchFieldError: EMPTY_BYTE_ARRAY

3.logstah5.5.1 Loophole Take the second way

zip -q -d log4j-core-2.6.2.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

Refer to official documentation :Logstash 5.0.0-6.8.20 and 7.0.0-7.16.0: Log4j CVE-2021-44228, CVE-2021-45046 remediation - Security Announcements - Discuss the Elastic Stack