tweaking

ELK 7.6.0 is not ready for production, however it works if APM is enabled (disabled in config, so image wont build as precaution)
Remove SISSDEN from ewsposter, suricata
Bump suricata to 5.0.1
Alpine now support suricata incl. enabled JA3 support, move back to Alpine install

docker/elk/elasticsearch/Dockerfile

@@ -1,7 +1,7 @@
 FROM alpine
 #
 # VARS
-ENV ES_VER=7.5.2 \
+ENV ES_VER=7.6.0 \
     JAVA_HOME=/usr/lib/jvm/java-11-openjdk
 # Include dist
 ADD dist/ /root/dist/

docker/elk/elasticsearch/dist/elasticsearch.yml

@@ -9,6 +9,7 @@ path:
 http.host: 0.0.0.0
 http.cors.enabled: true
 http.cors.allow-origin: "*"
+indices.query.bool.max_clause_count: 2000
 cluster.initial_master_nodes:
 - "tpotcluster-node-01"
 discovery.zen.ping.unicast.hosts: