{"record":{"id":"4fe7fc10d3e98abc","repo":"elastic/elasticsearch","slug":"painless-regex-enabled-can-only-be-set-on-node-s","errorCode":null,"errorMessage":"[painless.regex.enabled] can only be set on node startup.","messagePattern":"\\[painless\\.regex\\.enabled\\] can only be set on node startup\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/lang-painless/src/main/java/org/elasticsearch/painless/PainlessScriptEngine.java","lineNumber":444,"sourceCode":"\n            String value = copy.remove(CompilerSettings.MAX_LOOP_COUNTER);\n            if (value != null) {\n                compilerSettings.setMaxLoopCounter(Integer.parseInt(value));\n            }\n\n            value = copy.remove(CompilerSettings.PICKY);\n            if (value != null) {\n                compilerSettings.setPicky(Booleans.parseBoolean(value));\n            }\n\n            value = copy.remove(CompilerSettings.INITIAL_CALL_SITE_DEPTH);\n            if (value != null) {\n                compilerSettings.setInitialCallSiteDepth(Integer.parseInt(value));\n            }\n\n            value = copy.remove(CompilerSettings.REGEX_ENABLED.getKey());\n            if (value != null) {\n                throw new IllegalArgumentException(\"[painless.regex.enabled] can only be set on node startup.\");\n            }\n\n            value = copy.remove(CompilerSettings.REGEX_LIMIT_FACTOR.getKey());\n            if (value != null) {\n                throw new IllegalArgumentException(\"[painless.regex.limit-factor] can only be set on node startup.\");\n            }\n\n            if (copy.isEmpty() == false) {\n                throw new IllegalArgumentException(\"Unrecognized compile-time parameter(s): \" + copy);\n            }\n        }\n        return compilerSettings;\n    }\n\n    private static ScriptException convertToScriptException(String scriptSource, Throwable t) {\n        // create a script stack: this is just the script portion\n        List<String> scriptStack = new ArrayList<>();\n        ScriptException.Position pos = null;","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/lang-painless/src/main/java/org/elasticsearch/painless/PainlessScriptEngine.java#L426-L462","documentation":"PainlessScriptEngine.buildCompilerSettings throws this IllegalArgumentException when a per-script (per-request) compile parameter includes 'painless.regex.enabled'. Regex enabling is a security-sensitive node-level setting because regexes can be used for denial-of-service; Painless only reads it from the node's script context settings at startup. Passing it in the params map of an individual script/compilation request is rejected.","triggerScenarios":"Submitting a script with params that include {'painless.regex.enabled': true} via the _scripts API, an ingest pipeline, a runtime field, or any per-script compilation context. The buildCompilerSettings method strips known per-request keys and explicitly rejects the regex-enabled key.","commonSituations":"Trying to enable regex per-script after it was disabled cluster-wide. Copying node-level settings into script params by mistake. Tutorials or examples that conflate node settings with script params.","solutions":["Set painless.regex.enabled in elasticsearch.yml or via the cluster settings API (script.painless.regex.enabled: limited/true), not in script params.","Restart the node (or update the cluster setting) for the change to take effect.","Remove painless.regex.enabled from the script's params map."],"exampleFix":"// before (script params)\n{\"source\": \"doc['x'].value =~ /abc/\", \"params\": {\"painless.regex.enabled\": true}}\n// after (elasticsearch.yml)\nscript.painless.regex.enabled: limited","handlingStrategy":"validation","validationCode":"// Do not include painless.regex.enabled in script params. Set it at node level:\n// // PUT _cluster/settings {\"persistent\": {\"script.painless.regex.enabled\": \"limited\"}}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set painless.regex.enabled in elasticsearch.yml or cluster settings, never in script params.","Audit script params for node-level setting keys before submitting.","Document which settings are node-only versus per-script."],"tags":["painless","elasticsearch","configuration","regex","settings","compile-time"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}