A version of Azure DevOps Server with a reasonably recent, secure, and supported version of Elastic Search is coming soon.
Azure DevOps Server 2022
Microsoft finally will be releasing Azure DevOps Server 2022, which ships with Elastic Search 7.17.5:
This version no longer ships with patched jar files, but finally ships with the version of log4j that should be secure.
You won't be able to use this version of Elastic Search with an older version of Azure DevOps Server, the way to go is to perform the upgrade to 2022.
In case you need help to prepare or perform an upgrade of your aging Team Foundation Server or Azure DevOps Server installation, don't hesitate to reach out.