在elasticsearch 7.10.0版本验证通过
使用如下脚本自动处理
#创建jar包暂存目录
mkdir /opt/log4j
cd /opt/log4j
#下载最新jar包
wget https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-core/2.17.2/log4j-core-2.17.2.jar
wget https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-api/2.17.2/log4j-api-2.17.2.jar
wget https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-jcl/2.17.2/log4j-jcl-2.17.2.jar
wget https://repo.maven.apache.org/maven2/org/apache/logging/log4j/log4j-slf4j-impl/2.17.2/log4j-slf4j-impl-2.17.2.jar
#创建jar包备份目录
mkdir /opt/log4j_es_bak/
mkdir /opt/log4j_logstash_bak/
#安装新版本jar包
cp log4j-core-2.17.2.jar /usr/share/elasticsearch/lib/
cp log4j-api-2.17.2.jar /usr/share/elasticsearch/lib/
cp log4j-*2.17.2.jar /usr/share/logstash/logstash-core/lib/jars/
#移除老版本jar包
mv /usr/share/elasticsearch/lib/log4j-*2.11.1.jar /opt/log4j_es_bak/
mv /usr/share/logstash/logstash-core/lib/jars/log4j-*2.13.3.jar /opt/log4j_logstash_bak/
#重启服务
systemctl restart elasticsearch
systemctl restart logstash
参考资料：