Script Allowed Contexts
All script contexts are allowed to run on the cluster. Unrestricted contexts let costly scripts run in places you might not intend, hurting performance and widening the attack surface.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Cluster |
| Domains | performance, security-safety |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
The allowed scripts are :12
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Restrict script contexts
Condition: Always shown for this insight.
Set script.allowed_contexts: none in elasticsearch.yml, then restart the node.
Impact: Running scripts with all contexts allowed can lead to costly scripts being allowed to run, which in turn might cause performance issues in the cluster. Query scripts can place a heavy load on your cluster, particularly if the scripts are not written carefully with thought for the resources they might require. For this reason it is a best practice to limit both the type of scripts that can run on a cluster, and also the contexts in which scripts can run. To restrict the contexts allowed you need to know exactly which contexts your application requires to work. If you do not know which contexts you require, it is best to leave this setting as the default, which allows all contexts.