# Enabling scripting for installed scripts only **URL:** \ **Category:** Elasticsearch\ **Created:** [June 27, 2014, 6:44pm UTC](https://discuss.elastic.co/t/enabling-scripting-for-installed-scripts-only/18378 "2014-06-27T18:44:41Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![greg\_j](https://avatars.discourse-cdn.com/v4/letter/g/d6d6ee/32.png) [@greg\_j](https://discuss.elastic.co/u/greg_j)\ **Post date:** [June 27, 2014, 6:44pm UTC](https://discuss.elastic.co/t/enabling-scripting-for-installed-scripts-only/18378/1 "2014-06-27T18:44:41Z")
Hi, We'd like to enable custom scoring using a script that we'll install under config/scripts, so that we can invoke it as part of a function\_score query, like "query": { "function\_score": { "query" : { ... }, "functions": [ { "script\_score": { "script": "my-script" // installed in config/scripts/my-script.mvel } }] } } In order to do this, it looks like we have to set script.disable\_dynamic: false in elasticsearch.yml. But that also allows arbitrary script code to be submitted as the body of the script field, which we want to disallow. Is it possible to configure scripting to work only with named scripts that are installed? It seems like the one config option I found is to coarse for this. Thanks! -gregj -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [June 30, 2014, 8:11am UTC](https://discuss.elastic.co/t/enabling-scripting-for-installed-scripts-only/18378/2 "2014-06-30T08:11:54Z")
Hey, I just tested with 1.2.1, and even if dynamic scripting is disabled, you can still execute locally stored scripts. See the example in > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. --Alex On Fri, Jun 27, 2014 at 8:44 PM, greg j [gregj@allenai.org](mailto:gregj@allenai.org) wrote: > Hi, > > We'd like to enable custom scoring using a script that we'll install under > config/scripts, so that we can invoke it as part of a function\_score query, > like > > "query": { > "function\_score": { > "query" : { ... }, > "functions": [ { > "script\_score": { > "script": "my-script" // installed in > config/scripts/my-script.mvel > } > }] > } > } > > In order to do this, it looks like we have to set > > script.disable\_dynamic: false > > in elasticsearch.yml. > > But that also allows arbitrary script code to be submitted as the body of > the script field, which we want to disallow. > > Is it possible to configure scripting to work only with named scripts that > are installed? It seems like the one config option I found is to coarse > for this. > > Thanks! > > -gregj > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGCwEM8Ku5RtL%2B\_42v1%2B50Ps8bGY-mUb9h5\_EWXkism0\_sxeCA%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGCwEM8Ku5RtL%2B_42v1%2B50Ps8bGY-mUb9h5_EWXkism0_sxeCA%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![greg\_j](https://avatars.discourse-cdn.com/v4/letter/g/d6d6ee/32.png) [@greg\_j](https://discuss.elastic.co/u/greg_j)\ **Post date:** [June 30, 2014, 9:39pm UTC](https://discuss.elastic.co/t/enabling-scripting-for-installed-scripts-only/18378/3 "2014-06-30T21:39:42Z")
You're right. Was sure I tried that, but obviously had done something wrong along the way. Thanks! On Monday, June 30, 2014 1:11:59 AM UTC-7, Alexander Reelsen wrote: > Hey, > > I just tested with 1.2.1, and even if dynamic scripting is disabled, you > can still execute locally stored scripts. See the example in > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/modules-scripting.html#modules-scripting) > > --Alex > > On Fri, Jun 27, 2014 at 8:44 PM, greg j \<[gr...@allenai.org](mailto:gr...@allenai.org) \\> > wrote: > > > Hi, > > > > We'd like to enable custom scoring using a script that we'll install > > under config/scripts, so that we can invoke it as part of a function\_score > > query, like > > > > "query": { > > "function\_score": { > > "query" : { ... }, > > "functions": [ { > > "script\_score": { > > "script": "my-script" // installed in > > config/scripts/my-script.mvel > > } > > }] > > } > > } > > > > In order to do this, it looks like we have to set > > > > script.disable\_dynamic: false > > > > in elasticsearch.yml. > > > > But that also allows arbitrary script code to be submitted as the body of > > the script field, which we want to disallow. > > > > Is it possible to configure scripting to work only with named scripts > > that are installed? It seems like the one config option I found is to > > coarse for this. > > > > Thanks! > > > > -gregj > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/e866778e-c8db-4e9e-8ce9-3e1ada7529f6%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/29a64032-3651-47e0-8ee3-9b5010051e65%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/29a64032-3651-47e0-8ee3-9b5010051e65%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:18am UTC](https://discuss.elastic.co/t/enabling-scripting-for-installed-scripts-only/18378/4 "2017-07-06T01:18:50Z")
Closed on July 6, 2017, 1:18am UTC