langgenius/dify · error · ValueError

ELASTICSEARCH_PASSWORD is required for self-hosted Elasticse

Error message

ELASTICSEARCH_PASSWORD is required for self-hosted Elasticsearch

What it means

Raised by validate_elasticsearch_config (self-hosted branch) when ELASTICSEARCH_PASSWORD is empty. Default is 'elastic', so this fires only when the password is explicitly blanked.

Source

Thrown at api/configs/middleware/vdb/elasticsearch_config.py:72

    ELASTICSEARCH_MAX_RETRIES: int = Field(
        description="Maximum number of retry attempts (default is 10000)", default=10000
    )

    @model_validator(mode="after")
    def validate_elasticsearch_config(self):
        """Validate Elasticsearch configuration based on deployment type."""
        if self.ELASTICSEARCH_USE_CLOUD:
            if not self.ELASTICSEARCH_CLOUD_URL:
                raise ValueError("ELASTICSEARCH_CLOUD_URL is required when using Elastic Cloud")
            if not self.ELASTICSEARCH_API_KEY:
                raise ValueError("ELASTICSEARCH_API_KEY is required when using Elastic Cloud")
        else:
            if not self.ELASTICSEARCH_HOST:
                raise ValueError("ELASTICSEARCH_HOST is required for self-hosted Elasticsearch")
            if not self.ELASTICSEARCH_USERNAME:
                raise ValueError("ELASTICSEARCH_USERNAME is required for self-hosted Elasticsearch")
            if not self.ELASTICSEARCH_PASSWORD:
                raise ValueError("ELASTICSEARCH_PASSWORD is required for self-hosted Elasticsearch")

        return self

View on GitHub (pinned to ef8544b173)

Solutions

Set ELASTICSEARCH_PASSWORD to the cluster credential.
Inject the password via a secrets manager / docker secret rather than clearing it.
Restore the default if running a dev cluster with the stock password.

Example fix

// before
ELASTICSEARCH_PASSWORD=
// after
ELASTICSEARCH_PASSWORD=<strong-password>

Defensive patterns

Strategy: validation

Validate before calling

def es_password_present(use_cloud: bool, password: str | None) -> bool:
    return use_cloud or bool(password)

Prevention

Inject ELASTICSEARCH_PASSWORD via a secret, never blank it.
Rotate the default 'elastic' password in any non-dev cluster.
Pre-flight check that secrets populate before app boot.

When it happens

Trigger: Setting ELASTICSEARCH_PASSWORD='' while using self-hosted ES.

Common situations: Operator clears the default password but never sets a real one, or secrets injection fails to populate the var.

Related errors

AI-assisted analysis of langgenius/dify@ef8544b173 (2026-08-12). Data as JSON: /api/errors/fc125715caa0c801. Report an issue: GitHub.