From 8dcb64d87c7b3fb70fa92df4c2d40c125ef51002 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Fri, 10 Dec 2021 11:56:33 -0500
Subject: [PATCH 1/4] Update init.sls

---
 salt/elasticsearch/init.sls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/elasticsearch/init.sls b/salt/elasticsearch/init.sls
index 84ce545b8..b5d61a6a5 100644
--- a/salt/elasticsearch/init.sls
+++ b/salt/elasticsearch/init.sls
@@ -258,7 +258,7 @@ so-elasticsearch:
       {% if TRUECLUSTER is sameas false or (TRUECLUSTER is sameas true and not salt['pillar.get']('nodestab', {})) %}
       - discovery.type=single-node
       {% endif %}
-      - ES_JAVA_OPTS=-Xms{{ esheap }} -Xmx{{ esheap }} -Des.transport.cname_in_publish_address=true
+      - ES_JAVA_OPTS=-Xms{{ esheap }} -Xmx{{ esheap }} -Des.transport.cname_in_publish_address=true -Dlog4j2.formatMsgNoLookups=true
       ulimits:
       - memlock=-1:-1
       - nofile=65536:65536

From 66c8cc6e86e0e2a09becd071d61d5bf216c8b77f Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Fri, 10 Dec 2021 11:59:12 -0500
Subject: [PATCH 2/4] Update init.sls

---
 salt/thehive/init.sls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/thehive/init.sls b/salt/thehive/init.sls
index d7050e226..7cbe34c90 100644
--- a/salt/thehive/init.sls
+++ b/salt/thehive/init.sls
@@ -95,7 +95,7 @@ so-thehive-es:
       - /opt/so/conf/thehive/etc/es/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties:ro
       - /opt/so/log/thehive:/var/log/elasticsearch:rw
     - environment:
-      - ES_JAVA_OPTS=-Xms512m -Xmx512m
+      - ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true
     - port_bindings:
       - 0.0.0.0:9400:9400
       - 0.0.0.0:9500:9500

From e48de1848055aa9d1600ae200d7fa68b16c02a9f Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Fri, 10 Dec 2021 12:00:12 -0500
Subject: [PATCH 3/4] Update init.sls

---
 salt/logstash/init.sls | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/logstash/init.sls b/salt/logstash/init.sls
index 069b2f7bd..37a298237 100644
--- a/salt/logstash/init.sls
+++ b/salt/logstash/init.sls
@@ -156,7 +156,7 @@ so-logstash:
     - extra_hosts:
       - {{ EXTRAHOSTHOSTNAME }}:{{ EXTRAHOSTIP }}
     - environment:
-      - LS_JAVA_OPTS=-Xms{{ lsheap }} -Xmx{{ lsheap }}
+      - LS_JAVA_OPTS=-Xms{{ lsheap }} -Xmx{{ lsheap }} -Dlog4j2.formatMsgNoLookups=true
     - port_bindings:
   {% for BINDING in DOCKER_OPTIONS.port_bindings %}
       - {{ BINDING }}

From 45346b6318b3ac90b7d844347ca89d67b2c4c8c1 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Fri, 10 Dec 2021 12:01:39 -0500
Subject: [PATCH 4/4] Update log4j2.properties

---
 salt/logstash/etc/log4j2.properties | 1 +
 1 file changed, 1 insertion(+)

diff --git a/salt/logstash/etc/log4j2.properties b/salt/logstash/etc/log4j2.properties
index 73a646b8d..66bb65cbc 100644
--- a/salt/logstash/etc/log4j2.properties
+++ b/salt/logstash/etc/log4j2.properties
@@ -34,3 +34,4 @@ rootLogger.level = info
 rootLogger.appenderRef.rolling.ref = rolling
 #rootLogger.level = ${sys:ls.log.level}
 #rootLogger.appenderRef.console.ref = ${sys:ls.log.format}_console
+log4j2.formatMsgNoLookups = true