# Filebeat 7.5 - Suricata module and Elastic cloud ingest pipeline issue

**URL:** <https://discuss.elastic.co/t/filebeat-7-5-suricata-module-and-elastic-cloud-ingest-pipeline-issue/215017>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 14, 2020, 4:32pm UTC](https://discuss.elastic.co/t/filebeat-7-5-suricata-module-and-elastic-cloud-ingest-pipeline-issue/215017 "2020-01-14T16:32:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![flxdan](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@flxdan](https://discuss.elastic.co/u/flxdan)\
**Post date:** [January 14, 2020, 4:32pm UTC](https://discuss.elastic.co/t/filebeat-7-5-suricata-module-and-elastic-cloud-ingest-pipeline-issue/215017/1 "2020-01-14T16:32:33Z")

</div>

Running Ubuntu 18.04 running Suricata 5.0.1 - I've tried to use the filebeat (7.5.0 and 7.5.1) Suricata module on Elastic cloud but running setup on filebeat keeps giving me the following error:

2020-01-14T15:25:00.230Z INFO elasticsearch/client.go:753 Attempting to connect to Elasticsearch version 7.5.0  
2020-01-14T15:25:00.285Z ERROR fileset/setup.go:75 Error loading pipeline: 1 error: Error loading pipeline for fileset suricata/eve: couldn't load pipeline: couldn't load json. Error: 500 Internal Server Error: {"error":{"root\_cause":[{"type":"circuit\_breaking\_exception","reason":"[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max\_compilations\_rate] setting","bytes\_wanted":0,"bytes\_limit":0,"durability":"TRANSIENT"}],"type":"general\_script\_exception","reason":"Failed to compile inline script [long getOrZero(def map, def key) {\n if (map!=null && map[key]!=null) {\n return map[key];\n }\n return 0;\n} def network=ctx['network'], source=ctx['source'], dest=ctx['destination']; def sp=getOrZero(source,'packets'), sb=getOrZero(source,'bytes'), dp=getOrZero(dest,'packets'), db=getOrZero(dest,'bytes'); if (sb+db+sp+dp \> 0) {\n if (network == null) {\n network=new HashMap();\n ctx['network']=network;\n }\n if (sb+db \> 0) {\n network['bytes'] = sb+db;\n }\n if(sp+dp\>0) {\n network['packets'] = sp+dp;\n }\n}\n] using lang [painless]","processor\_type":"script","caused\_by":{"type":"circuit\_breaking\_exception","reason":"[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max\_compilations\_rate] setting","bytes\_wanted":0,"bytes\_limit":0,"durability":"TRANSIENT"},"suppressed":[{"type":"general\_script\_exception","reason":"Failed to compile inline script [Instant ins(def d) {\n try {\n return Instant.parse(d);\n } catch(Exception e) {\n return null;\n }\n} def ev = ctx['event']; if (ev != null) {\n def start = ins(ev['start']);\n def end = ins(ev['end']);\n if (start != null && end != null && !start.isAfter(end)) {\n ev['duration'] = Duration.between(start,end).toNanos();\n }\n}\n] using lang [painless]","processor\_type":"script","caused\_by":{"type":"circuit\_breaking\_exception","reason":"[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max\_compilations\_rate] setting","bytes\_wanted":0,"bytes\_limit":0,"durability":"TRANSIENT"}},{"type":"general\_script\_exception","reason":"Failed to compile inline script [def t = ctx.suricata?.eve?.event\_type; if (t == "stats") {\n ctx['event']['kind'] = "metric";\n} else if (t == "alert") {\n ctx['event']['kind'] = "alert";\n ctx['event']['category'] = "network\_traffic";\n} else {\n ctx['event']['kind'] = "event";\n ctx['event']['category'] = "network\_traffic";\n}\n] using lang [painless]","processor\_type":"script","caused\_by":{"type":"circuit\_breaking\_exception","reason":"[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max\_compilations\_rate] setting","bytes\_wanted":0,"bytes\_limit":0,"durability":"TRANSIENT"}}]},"status":500}. Response body: {"error":{"root\_cause":[{"type":"circuit\_breaking\_exception","reason":"[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max\_compilations\_rate] setting","bytes\_wanted":0,"bytes\_limit":0,"durability":"TRANSIENT"}],"type":"general\_script\_exception","reason":"Failed to compile inline script [long getOrZero(def map, def key) {\n if (map!=null && map[key]!=null) {\n return map[key];\n }\n return 0;\n} def network=ctx['network'], source=ctx['source'], dest=ctx['destination']; def sp=getOrZero(source,'packets'), sb=getOrZero(source,'bytes'), dp=getOrZero(dest,'packets'), db=getOrZero(dest,'bytes'); if (sb+db+sp+dp \> 0) {\n if (network == null) {\n network=new HashMap();\n ctx['network']=network;\n }\n if (sb+db \> 0) {\n network['bytes'] = sb+db;\n }\n if(sp+dp\>0) {\n network['packets'] = sp+dp;\n }\n}\n] using lang [painless]","processor\_type":"script","caused\_by":{"type":"circuit\_breaking\_exception","reason":"[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max\_compilations\_rate] setting","bytes\_wanted":0,"bytes\_limit":0,"durability":"TRANSIENT"},"suppressed":[{"type":"general\_script\_exception","reason":"Failed to compile inline script [Instant ins(def d) {\n try {\n return Instant.parse(d);\n } catch(Exception e) {\n return null;\n }\n} def ev = ctx['event']; if (ev != null) {\n def start = ins(ev['start']);\n def end = ins(ev['end']);\n if (start != null && end != null && !start.isAfter(end)) {\n ev['duration'] = Duration.between(start,end).toNanos();\n }\n}\n] using lang [painless]","processor\_type":"script","caused\_by":{"type":"circuit\_breaking\_exception","reason":"[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max\_compilations\_rate] setting","bytes\_wanted":0,"bytes\_limit":0,"durability":"TRANSIENT"}},{"type":"general\_script\_exception","reason":"Failed to compile inline script [def t = ctx.suricata?.eve?.event\_type; if (t == "stats") {\n ctx['event']['kind'] = "metric";\n} else if (t == "alert") {\n ctx['event']['kind'] = "alert";\n ctx['event']['category'] = "network\_traffic";\n} else {\n ctx['event']['kind'] = "event";\n ctx['event']['category'] = "network\_traffic";\n}\n] using lang [painless]","processor\_type":"script","caused\_by":{"type":"circuit\_breaking\_exception","reason":"[script] Too many dynamic script compilations within, max: [75/5m]; please use indexed, or scripts with parameters instead; this limit can be changed by the [script.max\_compilations\_rate] setting","bytes\_wanted":0,"bytes\_limit":0,"durability":"TRANSIENT"}}]},"status":500}  
2020-01-14T15:25:00.285Z INFO cfgfile/reload.go:264 Loading of config files completed

Any ideas?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 11, 2020, 4:32pm UTC](https://discuss.elastic.co/t/filebeat-7-5-suricata-module-and-elastic-cloud-ingest-pipeline-issue/215017/2 "2020-02-11T16:32:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.