{"record":{"id":"6c7f3a41304dc54a","repo":"testcontainers/testcontainers-java","slug":"service-account-token-response-did-not-contain-token-value","errorCode":null,"errorMessage":"Service account token response did not contain token.value: ","messagePattern":"Service account token response did not contain token\\.value: ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java","lineNumber":589,"sourceCode":"\n                if (result.getExitCode() != 0) {\n                    throw new RuntimeException(\n                        \"Failed to create Kibana service account token. Exit code: \" +\n                        result.getExitCode() +\n                        \", stdout: \" +\n                        stdout +\n                        \", stderr: \" +\n                        stderr\n                    );\n                }\n\n                JsonNode json = OBJECT_MAPPER.readTree(stdout);\n                JsonNode value = json.path(\"token\").path(\"value\");\n                if (value.isTextual() && !value.asText().trim().isEmpty()) {\n                    return value.asText().trim();\n                }\n\n                throw new RuntimeException(\"Service account token response did not contain token.value: \" + stdout);\n            }\n        );\n    }\n\n    private static String stableConfigKey(DockerImageName imageName) {\n        // UUID v3 (name-based) gives a deterministic 32-character string from the image name,\n        // keeping xpack.encryptedSavedObjects.encryptionKey identical across JVM runs —\n        // a prerequisite for container reuse. Call withEncryptionKey() for real secret management.\n        return UUID\n            .nameUUIDFromBytes(imageName.asCanonicalNameString().getBytes(StandardCharsets.UTF_8))\n            .toString()\n            .replace(\"-\", \"\");\n    }\n\n    /**\n     * Returns the HTTP host address for accessing Kibana.\n     *\n     * @return the host address in the format \"host:port\"","sourceCodeStart":571,"sourceCodeEnd":607,"githubUrl":"https://github.com/testcontainers/testcontainers-java/blob/8e549514e3f01c57d70546fbb8599d138f3903e5/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java#L571-L607","documentation":"After the service-tokens CLI runs successfully, its stdout is parsed as JSON and the library expects a token.value textual field. If the JSON lacks that path or the value is empty, this RuntimeException is thrown including the raw stdout so you can see what was actually returned.","triggerScenarios":"The elasticsearch-service-tokens command exits 0 but prints output not matching {\"token\":{\"value\":\"...\"}} — e.g. a custom ES image whose tool prints a different format, extra non-JSON logging lines corrupting stdout, or an ES version producing a different JSON schema.","commonSituations":"Custom or patched Elasticsearch images; wrapper scripts that echo extra text before the JSON; ES upgrades changing the CLI's output format.","solutions":["Inspect the raw stdout appended to the message to see why token.value is missing.","Use an official Elasticsearch image without wrapper scripts that pollute stdout.","Check the ES version: if the tool's output schema differs, upgrade or generate the token manually and pass it via withEnv(\"ELASTICSEARCH_SERVICEACCOUNTTOKEN\", ...)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    String token = kibana.token();\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"did not contain token.value\")) {\n        // raw stdout is appended: log it, fall back to a manually provisioned token\n        log.warn(\"Unexpected token CLI output: {}\", e.getMessage());\n        token = System.getenv(\"ELASTICSEARCH_SERVICEACCOUNTTOKEN\");\n    } else throw e;\n}","preventionTips":["Avoid wrapper scripts/custom images that echo extra lines before the JSON output.","Pin to official Elasticsearch images whose CLI output schema is stable.","Keep a fallback token injection path via withEnv(\"ELASTICSEARCH_SERVICEACCOUNTTOKEN\", ...)."],"tags":["testcontainers","kibana","json","unexpected-response","service-account"],"backgroundTag":"unexpected-response-shape","analyzedSha":"8e549514e3f01c57d70546fbb8599d138f3903e5","analyzedAt":"2026-09-12T14:56:41.227Z","contentChangedAt":"2026-09-12T14:56:41.227Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}