[Urgent] Elasticsearch fails to start

@The-Big-K if you look at the changed files in the PR you'll see that the change is to the ingest pipeline, which is stored in Elasticsearch.

So, you can query ES for the pipeline (I'm not sure of its specific name)

GET _ingest/pipeline/filebeat*mysql*pipeline

When you find the name of the slowlog one (which is what was fixed), delete it:

DELETE _ingest/pipeline/<the pipeline id>

Then create it with the fixed version

PUT _ingest/pipeline/<the pipeline id>
{ 
  <pipeline contents> 
}
2 Likes