jaegertracing/jaeger · error

only one of basic auth (--es.username/--es.password), --es.t

Error message

only one of basic auth (--es.username/--es.password), --es.token-file, or --es.api-key-file may be configured

What it means

errArity reports that a predicate call received a number of arguments its operator cannot accept. The filter is rejected with tracestore.ErrFilterInvalid because the expression is structurally malformed for that operator, independent of value types. It is used by every argument-shape check (buildFilterQuery, buildCombinedArgs, refArg, refAndConstantArgs, refAndListArgs).

Source

Thrown at cmd/es-rollover/app/flags.go:101

		return err
	}
	c.TLSConfig = tlsCfg
	return validateAuthFlags(c.Username, c.Password, c.TokenFilePath, c.APIKeyFilePath)
}

// validateAuthFlags rejects configuring more than one authentication method.
// The shared auth stack adds an Authorization header per configured method, so
// more than one would emit multiple Authorization headers, which ES/OS reject.
func validateAuthFlags(username, password, tokenFilePath, apiKeyFilePath string) error {
	basicAuth := username != "" && password != ""
	authMethods := 0
	for _, set := range []bool{basicAuth, tokenFilePath != "", apiKeyFilePath != ""} {
		if set {
			authMethods++
		}
	}
	if authMethods > 1 {
		return errors.New("only one of basic auth (--es.username/--es.password), --es.token-file, or --es.api-key-file may be configured")
	}
	return nil
}

View on GitHub (pinned to 806f444784)

Solutions

1. Count the arguments expected by the operator and supply exactly that many (e.g. binary comparisons take exactly 2, tag/name lookups take exactly 1).
2. Validate the filter expression client-side before submission using the library's shape checks (e.g. EnsureFilterStandsAlone).
3. Read the error's %d value to see how many args were actually sent and diff against the operator's arity.

Example fix

// before
{"op": "eq", "args": ["status"]}          // 1 arg
// after
{"op": "eq", "args": ["status", "ok"]}   // 2 args

var arity = map[expression.Operator]int{ /* op -> required arg count */ }
func arityOK(c *expression.Call) bool {
    n, ok := arity[c.Op]
    return ok && len(c.Args) == n
}

err := buildFilterQuery(...)
if errors.Is(err, tracestore.ErrFilterInvalid) && strings.Contains(err.Error(), "cannot take") {
    // fix operand count for the named operator
}

When it happens

Trigger: Submitting a filter where an operator is called with the wrong argument count — e.g. a binary comparison with 1 or 3 args, a tag lookup with 2 args, or an empty arg list — anywhere in buildFilterQuery's predicate dispatch.

Common situations: Hand-written JSON filters with missing or extra operands; a query builder emitting placeholder args that were never filled; version drift where an operator's signature changed between client and server.

Related errors

• wrong number of arguments
• %w: %w
• file must begin with '['
• only one of basic auth (--es.username/--es.password), --es.t
• empty configuration

AI-assisted analysis of jaegertracing/jaeger@806f444784 (2026-09-01). Data as JSON: /api/errors/59afa2cbf9ab9dfe. Report an issue: GitHub.