Disable Scalable Vector Engine (XX:UseSVE=0) to fix issues on macOS and other ARM platforms

https://github.com/elastic/elasticsearch/issues/118583

docker/elk/elasticsearch/Dockerfile

@@ -15,8 +15,8 @@ RUN	apt-get update -y && \
 #
 # Determine arch, get and install packages
     ARCH=$(arch) && \
-      if [ "$ARCH" = "x86_64" ]; then ES_ARCH="amd64"; fi && \
-      if [ "$ARCH" = "aarch64" ]; then ES_ARCH="arm64"; fi && \
+      if [ "$ARCH" = "x86_64" ]; then ES_ARCH="amd64"; export _JAVA_OPTIONS=""; fi && \
+      if [ "$ARCH" = "aarch64" ]; then ES_ARCH="arm64"; export _JAVA_OPTIONS="-XX:UseSVE=0"; fi && \
     echo "$ARCH" && \
     cd /root/dist/ && \
     mkdir -p /usr/share/elasticsearch/config \
@@ -47,4 +47,7 @@ HEALTHCHECK --retries=10 CMD curl -s -XGET 'http://127.0.0.1:9200/_cat/health'
 #
 # Start ELK
 USER elasticsearch:elasticsearch
-CMD ["/usr/share/elasticsearch/bin/elasticsearch"]
+#CMD ["/usr/share/elasticsearch/bin/elasticsearch"]
+CMD ARCH=$(arch) && \
+    if [ "$ARCH" = "aarch64" ]; then export _JAVA_OPTIONS="-XX:UseSVE=0"; fi && \
+    exec /usr/share/elasticsearch/bin/elasticsearch

docker/elk/elasticsearch/docker-compose.yml

@@ -22,6 +22,6 @@ services:
     mem_limit: 2g
     ports:
      - "127.0.0.1:64298:9200"
-    image: "dtagdevsec/elasticsearch:24.04"
+    image: "ghcr.io/telekom-security/elasticsearch:24.04.1"
     volumes:
      - $HOME/tpotce/data:/data

docker/elk/logstash/Dockerfile

@@ -17,8 +17,8 @@ RUN apt-get update -y && \
 #
 # Determine arch, get and install packages
     ARCH=$(arch) && \
-      if [ "$ARCH" = "x86_64" ]; then LS_ARCH="amd64"; fi && \
-      if [ "$ARCH" = "aarch64" ]; then LS_ARCH="arm64"; fi && \
+    if [ "$ARCH" = "x86_64" ]; then LS_ARCH="amd64"; export _JAVA_OPTIONS=""; fi && \
+    if [ "$ARCH" = "aarch64" ]; then LS_ARCH="arm64"; export _JAVA_OPTIONS="-XX:UseSVE=0"; fi && \
     echo "$ARCH" && \
     mkdir -p /etc/listbot && \
     cd /etc/listbot && \

docker/elk/logstash/dist/entrypoint.sh

@@ -101,4 +101,8 @@ if [ "$TPOT_TYPE" != "SENSOR" ];
 fi
 echo
 
+ARCH=$(arch)
+if [ "$ARCH" = "aarch64" ]; then
+  export _JAVA_OPTIONS="-XX:UseSVE=0";
+fi
 exec /usr/share/logstash/bin/logstash --config.reload.automatic

docker/elk/logstash/docker-compose.yml

@@ -12,7 +12,7 @@ services:
 #        condition: service_healthy
     ports:
      - "127.0.0.1:64305:64305"
-    image: "dtagdevsec/logstash:24.04"
+    image: "ghcr.io/telekom-security/logstash:24.04.1"
     volumes:
      - $HOME/tpotce/data:/data
 #     - /$HOME/tpotce/docker/elk/logstash/dist/logstash.conf:/etc/logstash/conf.d/logstash.conf