{"record":{"id":"59afa2cbf9ab9dfe","repo":"jaegertracing/jaeger","slug":"only-one-of-basic-auth-es-username-es-passwor-59afa2","errorCode":null,"errorMessage":"only one of basic auth (--es.username/--es.password), --es.token-file, or --es.api-key-file may be configured","messagePattern":"only one of basic auth \\(--es\\.username/--es\\.password\\), --es\\.token-file, or --es\\.api-key-file may be configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/es-rollover/app/flags.go","lineNumber":101,"sourceCode":"\t\treturn err\n\t}\n\tc.TLSConfig = tlsCfg\n\treturn validateAuthFlags(c.Username, c.Password, c.TokenFilePath, c.APIKeyFilePath)\n}\n\n// validateAuthFlags rejects configuring more than one authentication method.\n// The shared auth stack adds an Authorization header per configured method, so\n// more than one would emit multiple Authorization headers, which ES/OS reject.\nfunc validateAuthFlags(username, password, tokenFilePath, apiKeyFilePath string) error {\n\tbasicAuth := username != \"\" && password != \"\"\n\tauthMethods := 0\n\tfor _, set := range []bool{basicAuth, tokenFilePath != \"\", apiKeyFilePath != \"\"} {\n\t\tif set {\n\t\t\tauthMethods++\n\t\t}\n\t}\n\tif authMethods > 1 {\n\t\treturn errors.New(\"only one of basic auth (--es.username/--es.password), --es.token-file, or --es.api-key-file may be configured\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":83,"sourceCodeEnd":105,"githubUrl":"https://github.com/jaegertracing/jaeger/blob/806f4447841ecdb60519f408b004a599d515f437/cmd/es-rollover/app/flags.go#L83-L105","documentation":"errArity reports that a predicate call received a number of arguments its operator cannot accept. The filter is rejected with tracestore.ErrFilterInvalid because the expression is structurally malformed for that operator, independent of value types. It is used by every argument-shape check (buildFilterQuery, buildCombinedArgs, refArg, refAndConstantArgs, refAndListArgs).","triggerScenarios":"Submitting a filter where an operator is called with the wrong argument count — e.g. a binary comparison with 1 or 3 args, a tag lookup with 2 args, or an empty arg list — anywhere in buildFilterQuery's predicate dispatch.","commonSituations":"Hand-written JSON filters with missing or extra operands; a query builder emitting placeholder args that were never filled; version drift where an operator's signature changed between client and server.","solutions":["Count the arguments expected by the operator and supply exactly that many (e.g. binary comparisons take exactly 2, tag/name lookups take exactly 1).","Validate the filter expression client-side before submission using the library's shape checks (e.g. EnsureFilterStandsAlone).","Read the error's %d value to see how many args were actually sent and diff against the operator's arity."],"exampleFix":"// before\n{\"op\": \"eq\", \"args\": [\"status\"]}          // 1 arg\n// after\n{\"op\": \"eq\", \"args\": [\"status\", \"ok\"]}   // 2 args","handlingStrategy":"validation","validationCode":"var arity = map[expression.Operator]int{ /* op -> required arg count */ }\nfunc arityOK(c *expression.Call) bool {\n    n, ok := arity[c.Op]\n    return ok && len(c.Args) == n\n}","typeGuard":null,"tryCatchPattern":"err := buildFilterQuery(...)\nif errors.Is(err, tracestore.ErrFilterInvalid) && strings.Contains(err.Error(), \"cannot take\") {\n    // fix operand count for the named operator\n}","preventionTips":["Check each operator's expected argument count before emitting a call.","Run EnsureFilterStandsAlone / shape validation before submitting.","Fill placeholder args in generated filters before sending."],"tags":["query-filter","arity","expression"],"backgroundTag":"invalid-filter-arity","analyzedSha":"806f4447841ecdb60519f408b004a599d515f437","analyzedAt":"2026-09-01T02:39:22.140Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}