{"record":{"id":"c1bbc5c00aaf483c","repo":"SonarSource/sonarqube","slug":"property-need-to-be-set-when-using-elastic-search","errorCode":null,"errorMessage":" property need to be set when using elastic search authentication","messagePattern":" property need to be set when using elastic search authentication","errorType":"validation","errorClass":"MessageException","httpStatus":null,"severity":"error","filePath":"server/sonar-main/src/main/java/org/sonar/application/es/EsSettings.java","lineNumber":147,"sourceCode":"      builder.put(\"xpack.security.transport.ssl.truststore.path\", clusterESTruststoreFileName);\n\n      if (props.value(CLUSTER_ES_HTTP_KEYSTORE.getKey()) != null) {\n        String clusterESHttpKeystoreFileName = getFileNameFromPathProperty(CLUSTER_ES_HTTP_KEYSTORE);\n\n        builder.put(\"xpack.security.http.ssl.enabled\", Boolean.TRUE.toString());\n        builder.put(\"xpack.security.http.ssl.keystore.path\", clusterESHttpKeystoreFileName);\n      }\n    } else {\n      builder.put(\"xpack.security.autoconfiguration.enabled\", Boolean.FALSE.toString());\n      builder.put(\"xpack.security.enabled\", Boolean.FALSE.toString());\n    }\n  }\n\n  private String getFileNameFromPathProperty(ProcessProperties.Property processProperty) {\n    String processPropertyPath = props.value(processProperty.getKey());\n\n    if (processPropertyPath == null) {\n      throw new MessageException(processProperty.getKey() + \" property need to be set \" +\n        \"when using elastic search authentication\");\n    }\n    Path path = Paths.get(processPropertyPath);\n    if (!path.toFile().exists()) {\n      throw new MessageException(\"Unable to configure: \" + processProperty.getKey() + \". \"\n        + \"File specified in [\" + processPropertyPath + \"] does not exist\");\n    }\n    if (!path.toFile().canRead()) {\n      throw new MessageException(\"Unable to configure: \" + processProperty.getKey() + \". \"\n        + \"Could not get read access to [\" + processPropertyPath + \"]\");\n    }\n    return path.getFileName().toString();\n  }\n\n  private void configureNetwork(Map<String, String> builder) {\n    if (!clusterEnabled) {\n      InetAddress searchHost = resolveAddress(SEARCH_HOST);\n      int searchPort = Integer.parseInt(props.nonNullValue(SEARCH_PORT.getKey()));","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-main/src/main/java/org/sonar/application/es/EsSettings.java#L129-L165","documentation":"When Elasticsearch authentication/SSL is enabled, EsSettings requires a keystore/truststore/http-keystore path property. getFileNameFromPathProperty throws this MessageException when the required property key is absent from the configuration, naming the missing key in the message.","triggerScenarios":"sonar.es.auth is enabled (or TLS configured) but the corresponding property, e.g. sonar.cluster.es.ssl.keystore.path, sonar.cluster.es.ssl.truststore.path, or sonar.cluster.es.ssl.http.keystore.path, is not set.","commonSituations":"Setting up a SonarQube cluster with ES authentication and forgetting one of the three store path properties; copying config between nodes and dropping a property.","solutions":["Set the missing property reported in the message, e.g. sonar.cluster.es.ssl.keystore.path=/path/to/keystore.p12","If you do not intend to use ES authentication, disable it (remove/adjust the flag that enables it) so the store properties are not required","Verify all three stores (keystore, truststore, http keystore) paths are configured when full TLS is enabled"],"exampleFix":"# before\nsonar.cluster.enabled=true\nsonar.cluster.es.auth=true\n# (no keystore path)\n# after\nsonar.cluster.enabled=true\nsonar.cluster.es.auth=true\nsonar.cluster.es.ssl.keystore.path=/etc/sonarqube/es/keystore.p12\nsonar.cluster.es.ssl.truststore.path=/etc/sonarqube/es/truststore.p12","handlingStrategy":"validation","validationCode":"// Pre-flight check in deployment tooling\nString ks = props.get(\"sonar.cluster.es.ssl.keystore.path\");\nString ts = props.get(\"sonar.cluster.es.ssl.truststore.path\");\nif (esAuthEnabled && (ks == null || ts == null)) throw new IllegalArgumentException(\"keystore/truststore path required when ES auth is enabled\");","typeGuard":null,"tryCatchPattern":"try { esSettings.build(); } catch (MessageException e) { log.error(\"ES config error: {}\", e.getMessage()); System.exit(2); }","preventionTips":["Use a config template that includes all three store path properties when ES auth is on","Automate cluster provisioning so store properties are generated together with the auth flag","Diff configs across nodes after upgrades","Validate sonar.properties with a lint script before service start"],"tags":["elasticsearch","configuration","missing-property","authentication"],"backgroundTag":"missing-required-config-field","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}