{"record":{"id":"168357453f3bcf0d","repo":"elastic/elasticsearch","slug":"error-processing-reserved-state-settings-file","errorCode":null,"errorMessage":"Error processing reserved state settings file","messagePattern":"Error processing reserved state settings file","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/FileSettingsClusterSecretsLoader.java","lineNumber":93,"sourceCode":"     *             \"file_secrets\": {\n     *                 \"secure.setting.key.three\": \"Y2Nj\"\n     *             }\n     *         }\n     *     }\n     * }\n     * </pre>\n     */\n    private static SecureClusterStateSettings readClusterSecrets(Path settingsFile) {\n        if (Files.exists(settingsFile) == false) {\n            return SecureClusterStateSettings.EMPTY;\n        }\n        try (\n            var bis = new BufferedInputStream(Files.newInputStream(settingsFile));\n            var parser = JSON.xContent().createParser(XContentParserConfiguration.EMPTY, bis)\n        ) {\n            return requireNonNullElse(createFileSettingsParser().apply(parser, null), SecureClusterStateSettings.EMPTY);\n        } catch (IOException e) {\n            throw new IllegalStateException(\"Error processing reserved state settings file\", e);\n        }\n    }\n\n    // one-off parser used to load initial cluster secrets\n    private static ConstructingObjectParser<SecureClusterStateSettings, Void> createFileSettingsParser() {\n        var stateParser = new ConstructingObjectParser<SecureClusterStateSettings, Void>(\n            \"state\",\n            true,\n            a -> (SecureClusterStateSettings) a[0]\n        );\n        stateParser.declareObject(\n            optionalConstructorArg(),\n            (p, c) -> SecureClusterStateSettings.fromXContent(p),\n            new ParseField(ClusterSecrets.NAME)\n        );\n\n        var parser = new ConstructingObjectParser<SecureClusterStateSettings, Void>(\n            \"file_settings\",","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/distribution/tools/server-cli/src/main/java/org/elasticsearch/server/cli/FileSettingsClusterSecretsLoader.java#L75-L111","documentation":"Thrown by FileSettingsClusterSecretsLoader.readClusterSecrets() when parsing the file-based settings file (the auto-conf/reserved state settings) throws an IOException. The file exists but could not be opened or JSON-parsed, wrapped in an IllegalStateException.","triggerScenarios":"Files.newInputStream or the XContent parser throws IOException on the settings file — e.g. the file is a directory, has wrong permissions, or contains malformed JSON.","commonSituations":"settings.json (or the resolved file-settings path) is syntactically broken; truncated due to a concurrent write; permissions deny read to the ES user; the path points to a directory.","solutions":["Check the caused-by IOException for the specific I/O reason.","Validate the file is valid JSON: cat <path> | python -m json.tool (or jq).","Fix permissions so the ES user can read it: chmod/chown appropriately.","Ensure the path is a regular file, not a directory."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"Path f = settingsFile;\nif (Files.exists(f) && (Files.isDirectory(f) || !Files.isReadable(f))) {\n    throw new IllegalStateException(\"Settings file unreadable or is a directory: \" + f);\n}","typeGuard":null,"tryCatchPattern":"try (var bis = new BufferedInputStream(Files.newInputStream(settingsFile));\n     var parser = JSON.xContent().createParser(XContentParserConfiguration.EMPTY, bis)) {\n    return parser.map();\n} catch (IOException e) {\n    throw new IllegalStateException(\"Cannot parse settings file \" + settingsFile, e);\n}","preventionTips":["Validate settings JSON with jq before boot.","Ensure the ES user has read permission on the settings file.","Write settings atomically (temp + rename) to avoid truncated reads."],"tags":["secure-settings","io","json","config","filesystem"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}