Fix conflicts

salt/elasticsearch/init.sls

@@ -131,6 +131,13 @@ esrolesdir:
     - group: 939
     - makedirs: True
 
+eslibdir:
+  file.directory:
+    - name: /opt/so/conf/elasticsearch/lib
+    - user: 930
+    - group: 939
+    - makedirs: True
+
 esingestdynamicconf:
   file.recurse:
     - name: /opt/so/conf/elasticsearch/ingest
@@ -179,6 +186,14 @@ es_template_{{TEMPLATE.split('.')[0] | replace("/","_") }}:
     - group: 939
 {% endfor %}
 
+eslibsync:
+  file.managed:
+    - name: /opt/so/conf/elasticsearch/lib/log4j-core-2.11.1-patched.jar
+    - source: salt://elasticsearch/lib/log4j-core-2.11.1-patched.jar
+    - user: 930
+    - group: 939
+    - mode: 644
+
 esroles:
   file.recurse:
     - source: salt://elasticsearch/roles/
@@ -258,7 +273,7 @@ so-elasticsearch:
       {% if TRUECLUSTER is sameas false or (TRUECLUSTER is sameas true and not salt['pillar.get']('nodestab', {})) %}
       - discovery.type=single-node
       {% endif %}
-      - ES_JAVA_OPTS=-Xms{{ esheap }} -Xmx{{ esheap }} -Des.transport.cname_in_publish_address=true
+      - ES_JAVA_OPTS=-Xms{{ esheap }} -Xmx{{ esheap }} -Des.transport.cname_in_publish_address=true -Dlog4j2.formatMsgNoLookups=true
       ulimits:
       - memlock=-1:-1
       - nofile=65536:65536
@@ -267,6 +282,7 @@ so-elasticsearch:
       - 0.0.0.0:9200:9200
       - 0.0.0.0:9300:9300
     - binds:
+      - /opt/so/conf/elasticsearch/lib/log4j-core-2.11.1-patched.jar:/usr/share/elasticsearch/lib/log4j-core-2.11.1.jar:ro
       - /opt/so/conf/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
       - /opt/so/conf/elasticsearch/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties:ro
       - /nsm/elasticsearch:/usr/share/elasticsearch/data:rw

salt/logstash/etc/jvm.options

@@ -0,0 +1 @@
+-Dlog4j2.formatMsgNoLookups=true

salt/logstash/init.sls

@@ -61,6 +61,13 @@ logstash:
     - gid: 931
     - home: /opt/so/conf/logstash
 
+lslibdir:
+  file.directory:
+    - name: /opt/so/conf/logstash/lib
+    - user: 931
+    - group: 939
+    - makedirs: True
+
 lsetcdir:
   file.directory:
     - name: /opt/so/conf/logstash/etc
@@ -123,6 +130,14 @@ lsetcsync:
     - clean: True
     - exclude_pat: pipelines*
 
+lslibsync:
+  file.managed:
+    - name: /opt/so/conf/logstash/lib/log4j-core-2.14.0-patched.jar
+    - source: salt://logstash/lib/log4j-core-2.14.0-patched.jar
+    - user: 931
+    - group: 939
+    - mode: 644
+
 # Create the import directory
 importdir:
   file.directory:
@@ -162,6 +177,7 @@ so-logstash:
       - {{ BINDING }}
   {% endfor %}
     - binds:
+      - /opt/so/conf/logstash/lib/log4j-core-2.14.0-patched.jar:/usr/share/logstash/logstash-core/lib/jars/log4j-core-2.14.0.jar:ro
       - /opt/so/conf/elasticsearch/templates/:/templates/:ro
       - /opt/so/conf/logstash/etc/:/usr/share/logstash/config/:ro
       - /opt/so/conf/logstash/pipelines:/usr/share/logstash/pipelines:ro

salt/thehive/init.sls

@@ -95,7 +95,7 @@ so-thehive-es:
       - /opt/so/conf/thehive/etc/es/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties:ro
       - /opt/so/log/thehive:/var/log/elasticsearch:rw
     - environment:
-      - ES_JAVA_OPTS=-Xms512m -Xmx512m
+      - ES_JAVA_OPTS=-Xms512m -Xmx512m -Dlog4j2.formatMsgNoLookups=true
     - port_bindings:
       - 0.0.0.0:9400:9400
       - 0.0.0.0:9500:9500