# \[Urgent\] Elasticsearch fails to start

**URL:** https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044
**Category:** Beats
**Tags:** filebeat
**Created:** [April 1, 2020, 12:19pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044 "2020-04-01T12:19:39Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![The-Big-K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the-big-k/32/56199_2.png) [@The-Big-K](https://discuss.elastic.co/u/The-Big-K)
#### Post date: [April 1, 2020, 12:19pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044/1 "2020-04-01T12:19:39Z")

</div>

I've the latest Elasticsearch (updated 30 minutes ago); and it's still throwing the following error:-

```auto
regular expression has redundant nested repeat operator * /\[(?<TIMESTAMP_ISO8601:elasticsearch.deprecation.timestamp>(?:(?>\d\d){1,2})-(?:(?:0?[1-9]|1[0-2]))-(?:(?:(?:0[1-9])|(?:[12][0-9])|

```

I see that I'm not the only one; because others are facing the issue: [[ES 7.6] regular expression has redundant nested repeat operator](https://discuss.elastic.co/t/es-7-6-regular-expression-has-redundant-nested-repeat-operator/220835/4)

This issue has rendered my elasticsearch + app-search setup totally useless. Can someone please help fix this? This is really urgent.

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 1, 2020, 1:08pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044/2 "2020-04-01T13:08:12Z")

</div>

As far as I can see this will be fixed in 7.7.

> <https://github.com/elastic/beats/pull/17156>

I'm moving the question to #beats:filebeat as it seems to be related

---

<div class="post-metadata">

### Author: ![The-Big-K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the-big-k/32/56199_2.png) [@The-Big-K](https://discuss.elastic.co/u/The-Big-K)
#### Post date: [April 1, 2020, 1:21pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044/3 "2020-04-01T13:21:30Z")

</div>

Thanks. But it's not released. Any suggestions on how can I proceed with it?

---

<div class="post-metadata">

### Author: ![Mike.Barretta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike.barretta/32/16688_2.png) [@Mike.Barretta](https://discuss.elastic.co/u/Mike.Barretta)
#### Post date: [April 1, 2020, 1:38pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044/4 "2020-04-01T13:38:07Z")

</div>

@The-Big-K if you look at the [changed files in the PR](https://github.com/elastic/beats/pull/17156/files) you'll see that the change is to the ingest pipeline, which is stored in Elasticsearch.

So, you can query ES for the pipeline (I'm not sure of its specific name)

```auto
GET _ingest/pipeline/filebeat*mysql*pipeline

```

When you find the name of the slowlog one (which is what was fixed), delete it:

```auto
DELETE _ingest/pipeline/<the pipeline id>

```

Then create it with the [fixed version](https://github.com/whataboutpereira/beats/blob/master/filebeat/module/mysql/slowlog/ingest/pipeline.json)

```auto
PUT _ingest/pipeline/<the pipeline id>
{ 
  <pipeline contents> 
}

```

---

<div class="post-metadata">

### Author: ![The-Big-K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the-big-k/32/56199_2.png) [@The-Big-K](https://discuss.elastic.co/u/The-Big-K)
#### Post date: [April 1, 2020, 1:49pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044/5 "2020-04-01T13:49:55Z")

</div>

The problem is that I'm not able to interact with ES; because it just doesn't start! All I'm getting is -

```auto
curl -XGET 'http://localhost:9200'
curl: (7) Failed to connect to localhost port 9200: Connection refused

```

---

<div class="post-metadata">

### Author: ![Mike.Barretta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike.barretta/32/16688_2.png) [@Mike.Barretta](https://discuss.elastic.co/u/Mike.Barretta)
#### Post date: [April 1, 2020, 1:53pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044/6 "2020-04-01T13:53:56Z")

</div>

Perhaps there is more than one problem present? Do you see that error when you startup Elasticsearch? I wouldn't expect that since it should only be thrown when ES is up and running and that pipeline is being used.

What errors are you seeing that are preventing ES from starting?

---

<div class="post-metadata">

### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [April 1, 2020, 2:58pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044/7 "2020-04-01T14:58:58Z")

</div>

As I believe this is another question, @The-Big-K would you mind opening another thread in #elasticsearch as this one is solved IMO.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 29, 2020, 2:58pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044/8 "2020-04-29T14:58:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.