HI Alex thank for the response and help.
sorry I copied this quickly and didn't include what this output was.
ll /mnt/data/elastic
drwxrwxrwx. 2 ansible ansible 6 Apr 26 23:58 elastic
/mnt
/mnt/data
/mnt/data/elastic
are all ansible and 777 permissions.
ansible is id 1000 and thats why its used.
elk is part of dockerroot just for troubleshooting.
docker group was created manually