provectus/kafka-ui · error · ValidationException

Groovy filters is not allowed. Set filtering.groovy.enabled…

Error message

Groovy filters is not allowed. Set filtering.groovy.enabled property to 'true' to enabled it.

What it means

DynamicConfigOperations.checkIfFilteringGroovyEnabled() guards creation of message filters written in Groovy. Because Groovy filter scripts execute arbitrary code, kafka-ui only allows them when the `filtering.groovy.enabled=true` property is set; otherwise it throws this ValidationException when a Groovy filter is submitted.

Solutions

Set `filtering.groovy.enabled: true` in the kafka-ui application config (or env var FILTERING_GROOVY_ENABLED=true) and restart
If Groovy isn't wanted, rewrite the filter using the CEL engine instead of Groovy
In Kubernetes, add the property to helm values under config and redeploy

Example fix

// before (application.yml)
filtering:
  enabled: true
// after
filtering:
  enabled: true
  groovy:
    enabled: true

Defensive patterns

Strategy: validation

Validate before calling

if (!filteringGroovyEnabled) {
  throw new IllegalStateException("Enable filtering.groovy.enabled=true before using Groovy filters");
}

Try / catch

try {
  filterService.register(groovyFilter);
} catch (ValidationException e) {
  if (e.getMessage().contains("Groovy")) {
    // fall back to CEL filter or surface setup instructions
  }
}

Prevention

Set filtering.groovy.enabled explicitly in deployment manifests if Groovy is required
Prefer CEL filters to avoid enabling Groovy
Document the flag next to the filter feature in your runbook

When it happens

Trigger: Creating or editing a messages filter in the UI choosing the Groovy engine while the app was started without `filtering.groovy.enabled: true` (or env var FILTERING_GROOVY_ENABLED=true).

Common situations: Kubernetes deployment where the property wasn't added to the chart values; security-conscious default left untouched; upgrading kafka-ui and reusing an old config that never enabled Groovy.

Related errors

AI-assisted analysis of provectus/kafka-ui@83b5a60cc0 (2026-09-08). Data as JSON: /api/errors/5db63e73e5be5a1a. Report an issue: GitHub.

Appendix: source

Thrown at kafka-ui-api/src/main/java/com/provectus/kafka/ui/util/DynamicConfigOperations.java:157

            new FileUploadException("Error creating directory for uploads %s".formatted(targetDir), e));
      }
    }

    Path targetFilePath = targetDir.resolve(file.filename() + "-" + Instant.now().getEpochSecond());
    log.info("Uploading config-related file {}", targetFilePath);
    if (Files.exists(targetFilePath)) {
      log.info("File {} already exists, it will be overwritten", targetFilePath);
    }

    return file.transferTo(targetFilePath)
        .thenReturn(targetFilePath)
        .doOnError(th -> log.error("Error uploading file {}", targetFilePath, th))
        .onErrorMap(th -> new FileUploadException(targetFilePath, th));
  }

  public void checkIfFilteringGroovyEnabled() {
    if (!filteringGroovyEnabled()) {
      throw new ValidationException(
              "Groovy filters is not allowed. "
                      + "Set filtering.groovy.enabled property to 'true' to enabled it.");
    }
  }

  private void checkIfDynamicConfigEnabled() {
    if (!dynamicConfigEnabled()) {
      throw new ValidationException(
          "Dynamic config change is not allowed. "
              + "Set dynamic.config.enabled property to 'true' to enabled it.");
    }
  }

  @SneakyThrows
  private void writeYamlToFile(String yaml, Path path) {
    if (Files.isDirectory(path)) {
      throw new ValidationException("Dynamic file path is a directory, but should be a file path");
    }

View on GitHub (pinned to 83b5a60cc0)