T Pot, RAM and Elastic Stack

With the latest Elastic Stack having 16GB of RAM for T-Pot is probably the best choice for all of the Elastic Tools to run and start up without any errors. However, not everyone has the option for 16GB of RAM. You can adjust $HOME/tpotce/docker-compose.yml to limit the Elastic RAM usage.

It is assumed you make all the changes as the user you installed T-Pot with...

1. Stop T-Pot (sytemctl stop tpot)
2. vi $HOME/tpotce/docker-compose.yml
3. Search for Elasticsearch service and adjust the following lines to your needs (uncommenting should be enough in most cases):

#     - ES_JAVA_OPTS=-Xms2048m -Xmx2048m
#    mem_limit: 4g

4. Save and reboot.

Limiting RAM might have a negative impact on your Elastic Stack performance, especially if you want to run queries for a large timeframe.