SonarSource/sonarqube · error · MessageException

property need to be set when using elastic search authentic

Error message

 property need to be set when using elastic search authentication

What it means

When Elasticsearch authentication/SSL is enabled, EsSettings requires a keystore/truststore/http-keystore path property. getFileNameFromPathProperty throws this MessageException when the required property key is absent from the configuration, naming the missing key in the message.

Source

Thrown at server/sonar-main/src/main/java/org/sonar/application/es/EsSettings.java:147

      builder.put("xpack.security.transport.ssl.truststore.path", clusterESTruststoreFileName);

      if (props.value(CLUSTER_ES_HTTP_KEYSTORE.getKey()) != null) {
        String clusterESHttpKeystoreFileName = getFileNameFromPathProperty(CLUSTER_ES_HTTP_KEYSTORE);

        builder.put("xpack.security.http.ssl.enabled", Boolean.TRUE.toString());
        builder.put("xpack.security.http.ssl.keystore.path", clusterESHttpKeystoreFileName);
      }
    } else {
      builder.put("xpack.security.autoconfiguration.enabled", Boolean.FALSE.toString());
      builder.put("xpack.security.enabled", Boolean.FALSE.toString());
    }
  }

  private String getFileNameFromPathProperty(ProcessProperties.Property processProperty) {
    String processPropertyPath = props.value(processProperty.getKey());

    if (processPropertyPath == null) {
      throw new MessageException(processProperty.getKey() + " property need to be set " +
        "when using elastic search authentication");
    }
    Path path = Paths.get(processPropertyPath);
    if (!path.toFile().exists()) {
      throw new MessageException("Unable to configure: " + processProperty.getKey() + ". "
        + "File specified in [" + processPropertyPath + "] does not exist");
    }
    if (!path.toFile().canRead()) {
      throw new MessageException("Unable to configure: " + processProperty.getKey() + ". "
        + "Could not get read access to [" + processPropertyPath + "]");
    }
    return path.getFileName().toString();
  }

  private void configureNetwork(Map<String, String> builder) {
    if (!clusterEnabled) {
      InetAddress searchHost = resolveAddress(SEARCH_HOST);
      int searchPort = Integer.parseInt(props.nonNullValue(SEARCH_PORT.getKey()));

View on GitHub (pinned to 184c821202)

Solutions

Set the missing property reported in the message, e.g. sonar.cluster.es.ssl.keystore.path=/path/to/keystore.p12
If you do not intend to use ES authentication, disable it (remove/adjust the flag that enables it) so the store properties are not required
Verify all three stores (keystore, truststore, http keystore) paths are configured when full TLS is enabled

Example fix

# before
sonar.cluster.enabled=true
sonar.cluster.es.auth=true
# (no keystore path)
# after
sonar.cluster.enabled=true
sonar.cluster.es.auth=true
sonar.cluster.es.ssl.keystore.path=/etc/sonarqube/es/keystore.p12
sonar.cluster.es.ssl.truststore.path=/etc/sonarqube/es/truststore.p12

Defensive patterns

Strategy: validation

Validate before calling

// Pre-flight check in deployment tooling
String ks = props.get("sonar.cluster.es.ssl.keystore.path");
String ts = props.get("sonar.cluster.es.ssl.truststore.path");
if (esAuthEnabled && (ks == null || ts == null)) throw new IllegalArgumentException("keystore/truststore path required when ES auth is enabled");

Try / catch

try { esSettings.build(); } catch (MessageException e) { log.error("ES config error: {}", e.getMessage()); System.exit(2); }

Prevention

Use a config template that includes all three store path properties when ES auth is on
Automate cluster provisioning so store properties are generated together with the auth flag
Diff configs across nodes after upgrades
Validate sonar.properties with a lint script before service start

When it happens

Trigger: sonar.es.auth is enabled (or TLS configured) but the corresponding property, e.g. sonar.cluster.es.ssl.keystore.path, sonar.cluster.es.ssl.truststore.path, or sonar.cluster.es.ssl.http.keystore.path, is not set.

Common situations: Setting up a SonarQube cluster with ES authentication and forgetting one of the three store path properties; copying config between nodes and dropping a property.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/c1bbc5c00aaf483c. Report an issue: GitHub.