{"record":{"id":"1f159dc9637dcc2d","repo":"elastic/elasticsearch","slug":"1","errorCode":"1","errorMessage":"ERROR: Elasticsearch keystore not found","messagePattern":"ERROR: Elasticsearch keystore not found","errorType":"console","errorClass":"UserException","httpStatus":null,"severity":"warning","filePath":"distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/HasPasswordKeyStoreCommand.java","lineNumber":42,"sourceCode":"\n    static final int NO_PASSWORD_EXIT_CODE = 1;\n\n    HasPasswordKeyStoreCommand() {\n        super(\n            \"Succeeds if the keystore exists and is password-protected, \" + \"fails with exit code \" + NO_PASSWORD_EXIT_CODE + \" otherwise.\"\n        );\n    }\n\n    @Override\n    public void execute(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws Exception {\n        final Path configFile = env.configDir();\n        final KeyStoreWrapper keyStore = KeyStoreWrapper.load(configFile);\n\n        // We handle error printing here so we can respect the \"--silent\" flag\n        // We have to throw an exception to get a nonzero exit code\n        if (keyStore == null) {\n            terminal.errorPrintln(Terminal.Verbosity.NORMAL, \"ERROR: Elasticsearch keystore not found\");\n            throw new UserException(NO_PASSWORD_EXIT_CODE, null);\n        }\n        if (keyStore.hasPassword() == false) {\n            terminal.errorPrintln(Terminal.Verbosity.NORMAL, \"ERROR: Keystore is not password-protected\");\n            throw new UserException(NO_PASSWORD_EXIT_CODE, null);\n        }\n\n        terminal.println(Terminal.Verbosity.NORMAL, \"Keystore is password-protected\");\n    }\n}\n","sourceCodeStart":24,"sourceCodeEnd":52,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/HasPasswordKeyStoreCommand.java#L24-L52","documentation":"Thrown by `elasticsearch-keystore has-password` when `KeyStoreWrapper.load(configDir)` returns null — i.e. no keystore file exists in the config directory. The error text is printed to stderr via `terminal.errorPrintln` (respecting the `--silent` flag) and the thrown UserException carries a null message with NO_PASSWORD_EXIT_CODE (1). It is an intentional semantic exit: the subcommand exists purely to report password status.","triggerScenarios":"Running `has-password` on a node that has no keystore; pointing at the wrong config dir; checking a fresh install before `create`.","commonSituations":"Health-check scripts probing whether to set up a keystore; CI verifying cluster bootstrap state.","solutions":["Run `bin/elasticsearch-keystore create` to initialize a keystore if one is expected.","If a keystore should already exist, verify `ES_PATH_CONF` and locate `elasticsearch.keystore`.","Treat exit code 1 from `has-password` as 'no keystore' and branch accordingly in automation."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"Path ks = KeyStoreWrapper.keystorePath(env.configDir());\nboolean exists = Files.exists(ks);","typeGuard":null,"tryCatchPattern":"int rc = runHasPassword();\nif (rc == 1) {\n    // no keystore (or no password) — create/initialize as needed\n}","preventionTips":["Treat exit 1 from has-password as a normal 'unprotected or absent' signal, not a crash.","Run has-password as part of bootstrap checks to decide whether to create a keystore."],"tags":["elasticsearch","keystore-cli","state-missing","exit-code"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}