Elasticsearch Helm chart: Set -Dlog4j2.formatMsgNoLookups = true in jvm.options

[gopukrishnantec]

I was trying to update Elasticsearch cluster in AKS using helm chart. I wanted to set it up with option -Dlog4j2.formatMsgNoLookups = true in jvm.options file in the pods but using values.yaml file, I can only add it in /usr/share/elasticsearch/config/log4j2.properties. I see only option to add it as below:

esConfig:
#  elasticsearch.yml: |
#    key:
#      nestedkey: value
  log4j2.properties: |
    -Dlog4j2.formatMsgNoLookups = true

Please let me know if the above setting should be enough for log4j vulnerability primary fix and how to add the parameter in the jvm.options file directly? Are we getting a new updated chart soon?

[ebuildy]

-Dlog4j2.formatMsgNoLookups is a java option.

Use esJavaOpts instead:

esJavaOpts: -Dlog4j2.formatMsgNoLookups

[arriven]

is it possible to somehow create a jvm.options.d/ file using this chart as it's better than overriding default jvm.options file? we use a custom vertical scaler for elastic that overrides esJavaOpts dynamically so we need another solution. I was thinking if maybe extraInitContainers could do the trick?

[jmlrt]

Hi, I think the best solution for now is to use esJavaOpts as mentioned by @ebuildy.

Meanwhile, we are working toward publishing a new 7.16.1 release soon.

[afirth]

"The ES_JAVA_OPTS variable overrides all other JVM options. We do not recommend using ES_JAVA_OPTS in production."
from the es docs

Anyway, I'm using it for now, so thanks!

[jmlrt]

FYI, 7.16.1 and 6.8.21 releases just got released.

These are now the versions to use for the log4j fix.

[ebuildy]

@afirth you are absolutely right! I will post the Helm chart we are using in production tomorrow and propose a PR to set /usr/share/elasticsearch/config/jvm.options.d/ files.

[ebuildy]

hello @afirth , here the PR https://github.com/elastic/helm-charts/pull/1496/files