elastic/elasticsearch · error · PolicyValidationException

'path' [{}] must be absolute

Error message

'path' [{}] must be absolute

What it means

Thrown when the `path` field resolves to a non-absolute path. The `path` branch is reserved for fully-qualified filesystem paths; a relative value cannot be safely resolved by the entitlement system and is rejected — relative paths must use `relative_path` plus `relative_to` instead.

Source

Thrown at libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java:289

            if (settingBaseDirAsString != null && pathSetting == null) {
                throw new PolicyValidationException("'basedir_if_relative' may only be used with 'path_setting'");
            }

            final FileData fileData;
            if (relativePathAsString != null) {
                if (relativeTo == null) {
                    throw new PolicyValidationException("files entitlement with a 'relative_path' must specify 'relative_to'");
                }
                BaseDir baseDir = parseBaseDir(relativeTo);
                Path relativePath = Path.of(relativePathAsString);
                if (FileUtils.isAbsolutePath(relativePathAsString)) {
                    throw new PolicyValidationException("'relative_path' [" + relativePathAsString + "] must be relative");
                }
                fileData = FileData.ofRelativePath(relativePath, baseDir, mode);
            } else if (pathAsString != null) {
                Path path = Path.of(pathAsString);
                if (FileUtils.isAbsolutePath(pathAsString) == false) {
                    throw new PolicyValidationException("'path' [" + pathAsString + "] must be absolute");
                }
                fileData = FileData.ofPath(path, mode);
            } else if (pathSetting != null) {
                if (settingBaseDirAsString == null) {
                    throw new PolicyValidationException("files entitlement with a 'path_setting' must specify 'basedir_if_relative'");
                }
                BaseDir baseDir = parseBaseDir(settingBaseDirAsString);
                fileData = FileData.ofPathSetting(pathSetting, baseDir, mode);
            } else {
                throw new AssertionError("File entry validation error");
            }
            filesData.add(fileData.withPlatform(platform).withExclusive(exclusive));
        }
        return new FilesEntitlement(filesData);
    }
}

View on GitHub (pinned to db6a809a66)

Solutions

1. If the path is meant to be relative, switch to `relative_path` plus `relative_to`.
2. If the path is meant to be absolute, prefix it with the root (leading `/` on Unix, `<DRIVE>:\` on Windows).

Example fix

// before
{ "path": "var/log/es", "mode": "read" }

// after (option A: absolute)
{ "path": "/var/log/es", "mode": "read" }
// after (option B: relative)
{ "relative_path": "var/log/es", "relative_to": "home", "mode": "read" }

public static void validatePathIsAbsolute(String path) {
    if (!Path.of(path).isAbsolute()) {
        throw new IllegalArgumentException("path must be absolute: " + path);
    }
}

public static boolean isAbsolute(String p) {
    return Path.of(p).isAbsolute();
}

When it happens

Trigger: An entry sets `path` to a value that FileUtils.isAbsolutePath reports as non-absolute on the host OS (no leading slash on Unix, no drive letter on Windows).

Common situations: Author uses `path` for a relative value by mistake; cross-platform issue where a Unix path is interpreted on Windows; missing leading slash; mis-paste of a partial path.

Related errors

• 'relative_path' [{}] must be relative
• invalid platform: {}, valid values: [linux, macos, windows]
• invalid relative directory: {}, valid values: [config, data,
• a files entitlement entry must contain one of [path, relativ
• 'relative_to' may only be used with 'relative_path'

AI-assisted analysis of elastic/elasticsearch@db6a809a66 (2026-08-12). Data as JSON: /api/errors/fc50a2a72b736fa7. Report an issue: GitHub.