Yes, for non-dynamic settings you will need to make the change to elasticsearch.yml and then perform a rolling restart.
This is a requirement in particular for this security-sensitive setting so that any potential attacker cannot just turn scripts on and then try to exploit Elasticsearch with scripting.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.