jaegertracing/jaeger · error

only one of basic auth (--es.username/--es.password), --es.t

Error message

only one of basic auth (--es.username/--es.password), --es.token-file, or --es.api-key-file may be configured

What it means

buildDurationComparison resolves the comparison operator for the duration field against the durationComparisons map before reading the value. If the operator has no duration entry (e.g. a string-like or containment operator applied to duration), the filter is rejected with tracestore.ErrFilterUnsupported rather than misinterpreted as a type error. This keeps the refusal about capability, not about the value.

Source

Thrown at cmd/es-index-cleaner/app/flags.go:96

		return err
	}
	c.TLSConfig = tlsCfg
	return validateAuthFlags(c.Username, c.Password, c.TokenFilePath, c.APIKeyFilePath)
}

// validateAuthFlags rejects configuring more than one authentication method.
// The shared auth stack adds an Authorization header per configured method, so
// more than one would emit multiple Authorization headers, which ES/OS reject.
func validateAuthFlags(username, password, tokenFilePath, apiKeyFilePath string) error {
	basicAuth := username != "" && password != ""
	authMethods := 0
	for _, set := range []bool{basicAuth, tokenFilePath != "", apiKeyFilePath != ""} {
		if set {
			authMethods++
		}
	}
	if authMethods > 1 {
		return errors.New("only one of basic auth (--es.username/--es.password), --es.token-file, or --es.api-key-file may be configured")
	}
	return nil
}

View on GitHub (pinned to 806f444784)

Solutions

1. Use only supported ordering operators on duration (e.g. >, >=, <, <=, ==, != as defined in durationComparisons).
2. Check supported operators beforehand via the backend's capabilities/capabilities check (tracestore.EnsureSupported).
3. Catch errors.Is(err, tracestore.ErrFilterUnsupported) and fall back to a supported operator or show the user allowed operators.

Example fix

// before
{"duration": {"contains": "2s"}}
// after
{"duration": {"gt": "2s"}}

func durationOpAllowed(op expression.Operator) bool {
    _, ok := durationComparisons[op]
    return ok
}

q, err := buildDurationComparison(op, value)
if errors.Is(err, tracestore.ErrFilterUnsupported) {
    // retry with a supported ordering operator
}

When it happens

Trigger: Building a filter query that applies an operator not in durationComparisons (e.g. duration contains "2s", duration =~ ..., or another non-ordering operator) to the duration field via buildComparison.

Common situations: A generic query builder applying the same operator set to every field; a UI letting users pick any operator for duration; porting filters from a backend that supports richer duration operators.

Related errors

• file must begin with '['
• wrong number of arguments
• only one of basic auth (--es.username/--es.password), --es.t
• empty configuration
• at least one storage backend is required

AI-assisted analysis of jaegertracing/jaeger@806f444784 (2026-09-01). Data as JSON: /api/errors/8cf834bffc8011e2. Report an issue: GitHub.