diff --git a/pom.xml b/pom.xml
index 19916a6b7..27af10918 100644
--- a/pom.xml
+++ b/pom.xml
@@ -189,6 +189,14 @@
                                 <exclude>META-INF/*.SF</exclude>
                                 <exclude>META-INF/*.DSA</exclude>
                                 <exclude>META-INF/*.RSA</exclude>
+                                <!--
+                                    This mitigates against the log4j JNDI lookup vulnerability: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
+
+                                    Since we are using an old version of elastic search that is incompatible with a patched, newer version of log4j we
+                                    have to remove the class JndiLookup from the fat jar. This is the recommended course of action when you cannot upgrade
+                                    as per https://logging.apache.org/log4j/2.x/security.html
+                                -->
+                                <exclude>org/apache/logging/log4j/core/lookup/JndiLookup.class</exclude>
                             </excludes>
                         </filter>
                     </filters>