testcontainers/testcontainers-java · error · RuntimeException

Service account token response did not contain token.value:

Error message

Service account token response did not contain token.value: 

What it means

After the service-tokens CLI runs successfully, its stdout is parsed as JSON and the library expects a token.value textual field. If the JSON lacks that path or the value is empty, this RuntimeException is thrown including the raw stdout so you can see what was actually returned.

Solutions

1. Inspect the raw stdout appended to the message to see why token.value is missing.
2. Use an official Elasticsearch image without wrapper scripts that pollute stdout.
3. Check the ES version: if the tool's output schema differs, upgrade or generate the token manually and pass it via withEnv("ELASTICSEARCH_SERVICEACCOUNTTOKEN", ...).

try {
    String token = kibana.token();
} catch (RuntimeException e) {
    if (e.getMessage() != null && e.getMessage().contains("did not contain token.value")) {
        // raw stdout is appended: log it, fall back to a manually provisioned token
        log.warn("Unexpected token CLI output: {}", e.getMessage());
        token = System.getenv("ELASTICSEARCH_SERVICEACCOUNTTOKEN");
    } else throw e;
}

When it happens

Trigger: The elasticsearch-service-tokens command exits 0 but prints output not matching {"token":{"value":"..."}} — e.g. a custom ES image whose tool prints a different format, extra non-JSON logging lines corrupting stdout, or an ES version producing a different JSON schema.

Common situations: Custom or patched Elasticsearch images; wrapper scripts that echo extra text before the JSON; ES upgrades changing the CLI's output format.

Related errors

• Cannot create service account token in external mode
• Failed to create Kibana service account token. Exit code
• Cannot set Elasticsearch URL when using Elasticsearch…
• Couchbase /pools/default/nodeServices did not return valid…
• Couchbase /pools did not return valid JSON

AI-assisted analysis of testcontainers/testcontainers-java@8e549514e3 (2026-09-12). Data as JSON: /api/errors/6c7f3a41304dc54a. Report an issue: GitHub.

Appendix: source

Thrown at modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/KibanaContainer.java:589

                if (result.getExitCode() != 0) {
                    throw new RuntimeException(
                        "Failed to create Kibana service account token. Exit code: " +
                        result.getExitCode() +
                        ", stdout: " +
                        stdout +
                        ", stderr: " +
                        stderr
                    );
                }

                JsonNode json = OBJECT_MAPPER.readTree(stdout);
                JsonNode value = json.path("token").path("value");
                if (value.isTextual() && !value.asText().trim().isEmpty()) {
                    return value.asText().trim();
                }

                throw new RuntimeException("Service account token response did not contain token.value: " + stdout);
            }
        );
    }

    private static String stableConfigKey(DockerImageName imageName) {
        // UUID v3 (name-based) gives a deterministic 32-character string from the image name,
        // keeping xpack.encryptedSavedObjects.encryptionKey identical across JVM runs —
        // a prerequisite for container reuse. Call withEncryptionKey() for real secret management.
        return UUID
            .nameUUIDFromBytes(imageName.asCanonicalNameString().getBytes(StandardCharsets.UTF_8))
            .toString()
            .replace("-", "");
    }

    /**
     * Returns the HTTP host address for accessing Kibana.
     *
     * @return the host address in the format "host:port"

View on GitHub (pinned to 8e549514e3)