ELK fails to start on MAC M1

[syberkitten]

Hi
Not able to start the service on Mac OSX M1, getting this error:

Couldn't start Elasticsearch. Exiting.
elk_1 | Elasticsearch log follows below.
elk_1 | [2022-04-26T13:11:01,933][WARN ][o.e.b.JNANatives ] [elk] unable to install syscall filter:
elk_1 | java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed

Looking it up we probably need to disable this:

bootstrap.system_call_filter

Can someone please guide to where / how this can be changed?

[syberkitten]

tried building an image from this project, adding this line to the elasticsearch.yml
but then i got a failure of a different kind:

elk_1       | qemu-x86_64: Could not open '/lib64/ld-linux-x86-64.so.2': No such file or directory
elk_1       |    ...fail!

 Couldn't start Elasticsearch. Exiting.
elk_1       | Elasticsearch log follows below.
elk_1       | cat: /var/log/elasticsearch/elasticsearch.log: No such file or directory

[BonesyWonesy]

Also getting this as an issue with a Mac M1. Currently on macOS 12.4. But this specific issue seems to be a duplicate of: #357

[lylek]

Also getting this as an issue with a Mac M1. Currently on macOS 12.4. But this specific issue seems to be a duplicate of: #357

I'm getting the same issue. That issue you referenced looks different to me.

[jgreffe]

@syberkitten : did you resolve this issue? Having the same error :/

[maxonfjvipon]

@jgreffe Hey! Did you find the solution? I got the same issue (obviously)

[BonesyWonesy]

I ended up doing similar to what was done on this post to get it all working on my M1:

https://blog.devgenius.io/elastic-search-8-2-3-kibana-enterprise-search-developer-env-setup-notes-docker-only-6c39e7520f80

[Talar1997]

I had same issue with syscall filter.

I was able to run elk stack on M1 using docker with images from this repo. Here's my solution based on docs from https://elk-docker.readthedocs.io/#building-image-arm64 with my extra steps:

1. Pull phusion/baseimage:master-arm64 (because docker build thrown errors) docker pull phusion/baseimage:master-arm64
2. Build with command from docs (with added tag) docker build --build-arg IMAGE=master-arm64 --build-arg ARCH=aarch64 . -t m1/elk
3. Run: docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -p 7777:7777/udp -v $PWD/.docker/elk/udp.conf:/etc/logstash/conf.d/99-input-udp.conf -e MAX_MAP_COUNT=262144 -it --name distnode-elk m1/elk

Here's also ma config (udp.conf)

input {
    udp {
        id => "nodejs_udp_logs"
        port => 7777
        codec => json
    }
}
output {
    elasticsearch {
        hosts => ["localhost:9200"]
        document_type => "nodelog"
        manage_template => false
        index => "nodejs-%{+YYYY.MM.dd}"
    }
}

[xtakeit]

I had same issue with syscall filter.

I was able to run elk stack on M1 using docker with images from this repo. Here's my solution based on docs from https://elk-docker.readthedocs.io/#building-image-arm64 with my extra steps:

1. Pull phusion/baseimage:master-arm64 (because docker build thrown errors) docker pull phusion/baseimage:master-arm64
2. Build with command from docs (with added tag) docker build --build-arg IMAGE=master-arm64 --build-arg ARCH=aarch64 . -t m1/elk
3. Run: docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -p 7777:7777/udp -v $PWD/.docker/elk/udp.conf:/etc/logstash/conf.d/99-input-udp.conf -e MAX_MAP_COUNT=262144 -it --name distnode-elk m1/elk

Here's also ma config (udp.conf)

input {
    udp {
        id => "nodejs_udp_logs"
        port => 7777
        codec => json
    }
}
output {
    elasticsearch {
        hosts => ["localhost:9200"]
        document_type => "nodelog"
        manage_template => false
        index => "nodejs-%{+YYYY.MM.dd}"
    }
}

but I meet something diffrence.
the image master-arm64 is no found. so I change to phusion/baseimage:focal-1.2.0.

Operation Steps :

Pull arm64 paltform image: docker pull --platform=linux/arm64 phusion/baseimage:focal-1.2.0
Build with local image focal-1.2.0: docker build --build-arg IMAGE=focal-1.2.0 --build-arg ARCH=aarch64 . -t sebp/elk-arm64

Run: sudo docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -it --name arm64-elk sebp/elk-arm64

[fatalist]

Unable to run elk on my M4 with Docker Compose: v2.31.0-desktop.2
No way to build using this guide https://elk-docker.readthedocs.io/#building-image-arm64:

docker build --no-cache --build-arg IMAGE=focal-1.2.0 --build-arg ARCH=aarch64 -t m1/elk --file ./elk.Dockerfile .
[+] Building 0.6s (5/5) FINISHED                                                                               docker:desktop-linux
 => [internal] load build definition from elk.Dockerfile                                                                       0.0s
 => => transferring dockerfile: 229B                                                                                           0.0s
 => [internal] load metadata for docker.io/sebp/elk:latest                                                                     0.6s
 => [internal] load .dockerignore                                                                                              0.0s
 => => transferring context: 437B                                                                                              0.0s
 => CACHED [1/1] FROM docker.io/sebp/elk:latest@sha256:a2a05b8e5bb68aed9f17b86206f83a8047db5b251c628201b36c657054f72c17        0.0s
 => exporting to image                                                                                                         0.0s
 => => exporting layers                                                                                                        0.0s
 => => writing image sha256:a75af527c316dd74db82d2749c302d9dedaaf8eddc0bc9e5dbb1c4bdd670b6e5                                   0.0s
 => => naming to docker.io/m1/elk                                                                                              0.0s

View build details: docker-desktop://dashboard/build/desktop-linux/desktop-linux/qw5umcu45so11gvctrn4mkpzc

 1 warning found (use docker --debug to expand):
 - InvalidBaseImagePlatform: Base image sebp/elk was pulled with platform "linux/amd64", expected "linux/arm64" for current build (line 1)

Rosetta emulation doesn't work either.

Can anyone provide a step by step guide on how to run elk under M* (arm64) Mac?

Thanks in advance.

[kalenforn]

docker build --build-arg ARCH=aarch64 -t sebp/elk:arm64 .