# \[Urgent\] Elasticsearch fails to start

**URL:** https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044
**Category:** Beats
**Tags:** filebeat
**Created:** [April 1, 2020, 12:19pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044 "2020-04-01T12:19:39Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![Mike.Barretta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike.barretta/32/16688_2.png) [@Mike.Barretta](https://discuss.elastic.co/u/Mike.Barretta)
#### Post date: [April 1, 2020, 1:38pm UTC](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044/4 "2020-04-01T13:38:07Z")

</div>

@The-Big-K if you look at the [changed files in the PR](https://github.com/elastic/beats/pull/17156/files) you'll see that the change is to the ingest pipeline, which is stored in Elasticsearch.

So, you can query ES for the pipeline (I'm not sure of its specific name)

```auto
GET _ingest/pipeline/filebeat*mysql*pipeline

```

When you find the name of the slowlog one (which is what was fixed), delete it:

```auto
DELETE _ingest/pipeline/<the pipeline id>

```

Then create it with the [fixed version](https://github.com/whataboutpereira/beats/blob/master/filebeat/module/mysql/slowlog/ingest/pipeline.json)

```auto
PUT _ingest/pipeline/<the pipeline id>
{ 
  <pipeline contents> 
}

```

---

_[View the full topic](https://discuss.elastic.co/t/urgent-elasticsearch-fails-to-start/226044)._