log4j-elk-remediation-role.yml

---
- name: Check /etc/elasticsearch/jvm.options exists
  stat:
    path: /etc/elasticsearch/jvm.options
  become: true
  register: elastic_jvm_options

- name: Check /etc/logstash/jvm.options exists
  stat:
    path: /etc/logstash/jvm.options
  become: true
  register: logstash_jvm_options

- name: Test for log4j2.formatMsgNoLookups=true in elasticsearch
  shell: /bin/grep -c "log4j2.formatMsgNoLookups=true" /etc/elasticsearch/jvm.options || true
  register: test_elastic
  become: true
  check_mode: no
  changed_when: test_elastic.stdout == "0"
  when: elastic_jvm_options.stat.exists

- name: Test for log4j2.formatMsgNoLookups=true in logstash
  shell: /bin/grep -c "log4j2.formatMsgNoLookups=true" /etc/logstash/jvm.options || true
  register: test_logstash
  become: true
  check_mode: no
  changed_when: test_logstash.stdout == "0"
  when: logstash_jvm_options.stat.exists 

- name: Configure elastic to not do log lookups
  lineinfile:
    dest: /etc/elasticsearch/jvm.options
    line: -Dlog4j2.formatMsgNoLookups=true
  when: test_elastic.stdout == "0"

- name: Configure logstash to not do log lookups
  lineinfile:
    dest: /etc/logstash/jvm.options
    line: -Dlog4j2.formatMsgNoLookups=true
  when: test_logstash.stdout == "0"