{"record":{"id":"8cf834bffc8011e2","repo":"jaegertracing/jaeger","slug":"only-one-of-basic-auth-es-username-es-passwor","errorCode":null,"errorMessage":"only one of basic auth (--es.username/--es.password), --es.token-file, or --es.api-key-file may be configured","messagePattern":"only one of basic auth \\(--es\\.username/--es\\.password\\), --es\\.token-file, or --es\\.api-key-file may be configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/es-index-cleaner/app/flags.go","lineNumber":96,"sourceCode":"\t\treturn err\n\t}\n\tc.TLSConfig = tlsCfg\n\treturn validateAuthFlags(c.Username, c.Password, c.TokenFilePath, c.APIKeyFilePath)\n}\n\n// validateAuthFlags rejects configuring more than one authentication method.\n// The shared auth stack adds an Authorization header per configured method, so\n// more than one would emit multiple Authorization headers, which ES/OS reject.\nfunc validateAuthFlags(username, password, tokenFilePath, apiKeyFilePath string) error {\n\tbasicAuth := username != \"\" && password != \"\"\n\tauthMethods := 0\n\tfor _, set := range []bool{basicAuth, tokenFilePath != \"\", apiKeyFilePath != \"\"} {\n\t\tif set {\n\t\t\tauthMethods++\n\t\t}\n\t}\n\tif authMethods > 1 {\n\t\treturn errors.New(\"only one of basic auth (--es.username/--es.password), --es.token-file, or --es.api-key-file may be configured\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":78,"sourceCodeEnd":100,"githubUrl":"https://github.com/jaegertracing/jaeger/blob/806f4447841ecdb60519f408b004a599d515f437/cmd/es-index-cleaner/app/flags.go#L78-L100","documentation":"buildDurationComparison resolves the comparison operator for the duration field against the durationComparisons map before reading the value. If the operator has no duration entry (e.g. a string-like or containment operator applied to duration), the filter is rejected with tracestore.ErrFilterUnsupported rather than misinterpreted as a type error. This keeps the refusal about capability, not about the value.","triggerScenarios":"Building a filter query that applies an operator not in durationComparisons (e.g. duration contains \"2s\", duration =~ ..., or another non-ordering operator) to the duration field via buildComparison.","commonSituations":"A generic query builder applying the same operator set to every field; a UI letting users pick any operator for duration; porting filters from a backend that supports richer duration operators.","solutions":["Use only supported ordering operators on duration (e.g. >, >=, <, <=, ==, != as defined in durationComparisons).","Check supported operators beforehand via the backend's capabilities/capabilities check (tracestore.EnsureSupported).","Catch errors.Is(err, tracestore.ErrFilterUnsupported) and fall back to a supported operator or show the user allowed operators."],"exampleFix":"// before\n{\"duration\": {\"contains\": \"2s\"}}\n// after\n{\"duration\": {\"gt\": \"2s\"}}","handlingStrategy":"validation","validationCode":"func durationOpAllowed(op expression.Operator) bool {\n    _, ok := durationComparisons[op]\n    return ok\n}","typeGuard":null,"tryCatchPattern":"q, err := buildDurationComparison(op, value)\nif errors.Is(err, tracestore.ErrFilterUnsupported) {\n    // retry with a supported ordering operator\n}","preventionTips":["Restrict duration fields to ordering operators in your query UI.","Query backend capabilities (EnsureSupported) before building filters.","Keep an allowlist of operators per field type."],"tags":["query-filter","operator","duration"],"backgroundTag":"unsupported-operator","analyzedSha":"806f4447841ecdb60519f408b004a599d515f437","analyzedAt":"2026-09-01T02:39:22.140Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}