{"record":{"id":"ca25c79677b42c66","repo":"elastic/elasticsearch","slug":"65-ca25c7","errorCode":"65","errorMessage":"Elasticsearch keystore not found at [{}]. Use 'create' command to create one.","messagePattern":"Elasticsearch keystore not found at \\[(.+?)\\]\\. Use 'create' command to create one\\.","errorType":"exception","errorClass":"UserException","httpStatus":null,"severity":"error","filePath":"distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/BaseKeyStoreCommand.java","lineNumber":46,"sourceCode":"\n    private KeyStoreWrapper keyStore;\n    private SecureString keyStorePassword;\n    private final boolean keyStoreMustExist;\n    OptionSpec<Void> forceOption;\n\n    public BaseKeyStoreCommand(String description, boolean keyStoreMustExist) {\n        super(description);\n        this.keyStoreMustExist = keyStoreMustExist;\n    }\n\n    @Override\n    public final void execute(Terminal terminal, OptionSet options, Environment env, ProcessInfo processInfo) throws Exception {\n        try {\n            final Path configFile = env.configDir();\n            keyStore = KeyStoreWrapper.load(configFile);\n            if (keyStore == null) {\n                if (keyStoreMustExist) {\n                    throw new UserException(\n                        ExitCodes.DATA_ERROR,\n                        \"Elasticsearch keystore not found at [\"\n                            + KeyStoreWrapper.keystorePath(env.configDir())\n                            + \"]. Use 'create' command to create one.\"\n                    );\n                } else if (options.has(forceOption) == false) {\n                    if (terminal.promptYesNo(\"The elasticsearch keystore does not exist. Do you want to create it?\", false) == false) {\n                        terminal.println(\"Exiting without creating keystore.\");\n                        return;\n                    }\n                }\n                keyStorePassword = new SecureString(new char[0]);\n                keyStore = KeyStoreWrapper.create();\n                keyStore.save(configFile, keyStorePassword.getChars());\n            } else {\n                keyStorePassword = keyStore.hasPassword() ? readPassword(terminal, false) : new SecureString(new char[0]);\n                keyStore.decrypt(keyStorePassword.getChars());\n            }","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/distribution/tools/keystore-cli/src/main/java/org/elasticsearch/cli/keystore/BaseKeyStoreCommand.java#L28-L64","documentation":"Thrown by the BaseKeyStoreCommand shared by all mutating keystore subcommands when `KeyStoreWrapper.load(configDir)` returns null (no keystore file on disk) AND the subcommand was constructed with `keyStoreMustExist=true`. This applies to list/add/remove/show/change-password but not create. Exits DATA_ERROR (65). It tells the operator to run `create` first.","triggerScenarios":"Running `elasticsearch-keystore list` / `add-string` / `remove` / `show` / `change-password` on a fresh node that never had a keystore created; pointing `ES_PATH_CONF` at a config dir without `elasticsearch.keystore`; the keystore file was deleted.","commonSituations":"New cluster bootstrap where someone jumped to adding settings before running `create`; misconfigured `ES_PATH_CONF` pointing at a stale or wrong directory; container image that does not ship a keystore.","solutions":["Run `bin/elasticsearch-keystore create` first to initialize the keystore, then re-run the desired subcommand.","Verify `ES_PATH_CONF` points at the intended config directory and that the keystore file is expected there.","If migrating, copy the existing `elasticsearch.keystore` into the config dir before issuing mutations."],"exampleFix":"// before\nbin/elasticsearch-keystore add-string my.secret\n// after\nbin/elasticsearch-keystore create && bin/elasticsearch-keystore add-string my.secret","handlingStrategy":"validation","validationCode":"import java.nio.file.Files;\nPath ks = KeyStoreWrapper.keystorePath(env.configDir());\nif (!Files.exists(ks)) {\n    // run 'create' first, or skip the mutating subcommand\n}","typeGuard":null,"tryCatchPattern":"try {\n    runMutatingCommand();\n} catch (UserException e) {\n    if (e.exitCode == ExitCodes.DATA_ERROR && e.getMessage().contains(\"keystore not found\")) {\n        createKeystoreFirst();\n        runMutatingCommand();\n    } else throw e;\n}","preventionTips":["On fresh nodes, run `create` before any other keystore subcommand.","Verify ES_PATH_CONF points where you expect before mutating the keystore."],"tags":["elasticsearch","keystore-cli","state-missing","initialization"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}