Logstash 7.9.1 have issues in ARM

No. The in-memory sincedb is always maintained. You can set

sincedb_path => "/dev/null"

but it will still write the in-memory db to /dev/null, and it may still choose to use the atomic write for that. In that case it would chown /dev/null

If I were you I would try pointing sincedb_path at every file system you have available, and see if one of them chooses the non-atomic write. Local disk, RAM disk, NFS mount, /dev/null...

I see you are on aarch64. A user had the same problem a couple of years ago. No solution was found. I am wondering if .blockdev? is broken in the ruby implementation.