In addition to reading this guide, we recommend you run the Elasticsearch Health Check-Up. It will detect issues and improve your Elasticsearch performance by analyzing your shard sizes, threadpools, memory, snapshots, disk watermarks and more.The Elasticsearch Check-Up is free and requires no installation.
Before you begin reading this guide, we recommend you try running the OpenSearch Error Check-Up which analyzes 2 JSON files to detect many configuration errors.
To evaluate your use of text regex in OpenSearch, try AutoOps for OpenSearch. AutoOps will also help you optimize other important settings in OpenSearch and improve performance automatically.
Overview
Regex (short for regular expression) refers to a technique for searching using a sequence of characters defining a search pattern. For example, gray|grey would find both words gray and grey. Regex must be used with care in painless scripts, since some expressions can be extremely slow and require a great deal of resources to run. For this reason regex is disabled by default in painless scripts.
If you decide to enable regex, remember the following best practices: expressions should use anchors (^ or $) to denominate the beginning or end of the text string wherever possible and should never have a leading wildcard (*) (or just 1 character and wildcard) since this implies searching through all of the terms in the set. In general you should also try to be as specific as possible with which and how many characters can match.
How to resolve it
By default regex is disabled in OpenSearch, so if it has been enabled on your cluster, there may be a reason for that. Bear in mind that the use of regex – if properly implemented – is perfectly legitimate. Check the scripts that are in use in your application to determine if regex is being used. You can search for the painless regex operator “=~”.
To prevent regex scripts being used altogether you can restore the default setting on all of your nodes in opensearch.yml (it cannot be updated dynamically):
script.painless.regex.enabled: false
