Scripts Painless Regex Enabled
Painless scripts are allowed to use regular expressions, which Elasticsearch turns off by default because some patterns are extremely CPU- and memory-heavy. A poorly written regex in an ingest pipeline, update-by-query, or runtime field can slow the whole node and amplify search or indexing latency.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Cluster |
| Domains | performance, security-safety |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
No description available.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Disable Painless regex scripting
Condition: Always shown for this insight.
Set script.painless.regex.enabled to false in elasticsearch.yml on every node, then restart each node. The default is limited, which restricts regex complexity.
Impact: Some scripts containing regular expressions can be extremely slow and require a great deal of resources to run, which can cause performance issues. Regex (short for regular expression) refers to a technique for searching using a sequence of characters defining a search pattern. Regex must be used with care in painless scripts, since some expressions can be extremely slow and require a great deal of resources to run. For this reason regex is turned off by default in painless scripts. Keep in mind that the use of regex — if properly implemented — is perfectly legitimate. Since 7.10, it is also possible to keep regular expression enabled but limit their complexity to prevent consuming too many resources.