[Urgent] Elasticsearch fails to start

Elastic Stack Beats
1

I've the latest Elasticsearch (updated 30 minutes ago); and it's still throwing the following error:-

regular expression has redundant nested repeat operator * /\[(?<TIMESTAMP_ISO8601:elasticsearch.deprecation.timestamp>(?:(?>\d\d){1,2})-(?:(?:0?[1-9]|1[0-2]))-(?:(?:(?:0[1-9])|(?:[12][0-9])|

I see that I'm not the only one; because others are facing the issue: [ES 7.6] regular expression has redundant nested repeat operator

This issue has rendered my elasticsearch + app-search setup totally useless. Can someone please help fix this? This is really urgent.

2

As far as I can see this will be fixed in 7.7.

I'm moving the question to #beats:filebeat as it seems to be related

1 Like
3

Thanks. But it's not released. Any suggestions on how can I proceed with it?

4

@The-Big-K if you look at the changed files in the PR you'll see that the change is to the ingest pipeline, which is stored in Elasticsearch.

So, you can query ES for the pipeline (I'm not sure of its specific name)

GET _ingest/pipeline/filebeat*mysql*pipeline

When you find the name of the slowlog one (which is what was fixed), delete it:

DELETE _ingest/pipeline/<the pipeline id>

Then create it with the fixed version

PUT _ingest/pipeline/<the pipeline id>
{ 
  <pipeline contents> 
}
2 Likes
5

The problem is that I'm not able to interact with ES; because it just doesn't start! All I'm getting is -

curl -XGET 'http://localhost:9200'
curl: (7) Failed to connect to localhost port 9200: Connection refused
6

Perhaps there is more than one problem present? Do you see that error when you startup Elasticsearch? I wouldn't expect that since it should only be thrown when ES is up and running and that pipeline is being used.

What errors are you seeing that are preventing ES from starting?

7

As I believe this is another question, @The-Big-K would you mind opening another thread in #elasticsearch as this one is solved IMO.

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.