# Error in ES keystore when elasticsearch.yml references custom variables in /etc/default/elasticsearch **URL:** \ **Category:** Elasticsearch\ **Created:** [April 30, 2020, 4:40pm UTC](https://discuss.elastic.co/t/error-in-es-keystore-when-elasticsearch-yml-references-custom-variables-in-etc-default-elasticsearch/230592 "2020-04-30T16:40:36Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![gchiartosini](https://avatars.discourse-cdn.com/v4/letter/g/bc79bd/32.png) [@gchiartosini](https://discuss.elastic.co/u/gchiartosini)\ **Post date:** [April 30, 2020, 4:40pm UTC](https://discuss.elastic.co/t/error-in-es-keystore-when-elasticsearch-yml-references-custom-variables-in-etc-default-elasticsearch/230592/1 "2020-04-30T16:40:36Z")
Hello, can anyone help with this weird problem, please? I have defined custom variables in /etc/default/elasticsearch file, and referenced them in the elasticsearch.yml; ES works with them properly, but I get an error about those variables whenever I try to run any command (list, add) on the elasticsearch keystore. What am I doing wrong? I installed the ELK 7.6 (Debian) stack, configured the xpack security and the keystore without errors. Only after inserting custom variables into the /etc/default/elasticsearch file, and having successfully used them in the elasticsearch.yml file, I am no longer able to use the keystore. I get the following error: ```auto $ cd /usr/share/elasticsearch $ sudo bin / elasticsearch-keystore list Exception in thread "main" java.lang.IllegalArgumentException: Could not resolve placeholder 'ESC_SMTP_FROM' at org.elasticsearch.common.settings.PropertyPlaceholder.parseStringValue(PropertyPlaceholder.java:116) at org.elasticsearch.common.settings.PropertyPlaceholder.replacePlaceholders(PropertyPlaceholder.java:69) at org.elasticsearch.common.settings.Settings$Builder.replacePropertyPlaceholders(Settings.java:1162) at org.elasticsearch.common.settings.Settings$Builder.replacePropertyPlaceholders(Settings.java:1118) at org.elasticsearch.node.InternalSettingsPreparer.initializeSettings(InternalSettingsPreparer.java:108) at org.elasticsearch.node.InternalSettingsPreparer.prepareEnvironment(InternalSettingsPreparer.java:90) at org.elasticsearch.cli.EnvironmentAwareCommand.createEnv(EnvironmentAwareCommand.java:100) at org.elasticsearch.cli.EnvironmentAwareCommand.createEnv(EnvironmentAwareCommand.java:91) at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:91) at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) at org.elasticsearch.cli.Command.main(Command.java:90) at org.elasticsearch.common.settings.KeyStoreCli.main(KeyStoreCli.java:41) ``` Lines added in the /etc/default/elasticsearch file: ```auto ################################# ## TLP NCR CUSTOM VARIABLES ################################# # For /etc/elasticsearch/elasticsearch.yml # section: xpack.notification.email.account ES_SMTP_FROM="noreply@example.com" ES_SMTP_SSL_TRUST="10.123.123.45" ES_SMTP_AUTH=false ES_SMTP_HOST="10.123.123.45" ES_SMTP_PORT=25 ES_SMTP_USER="noreply@example.com" ``` Lines added in the elasticsearch.yml file: ```auto # ---------------------------------- SMTP for Watchers -------------------------# xpack.notification.email.account.elk_account.profile: standard xpack.notification.email.account.elk_account.email_defaults.from: "${ESC_SMTP_FROM}" xpack.notification.email.account.elk_account.smtp.ssl.trust: "${ESC_SMTP_SSL_TRUST}" xpack.notification.email.account.elk_account.smtp.auth: "${ESC_SMTP_AUTH}" xpack.notification.email.account.elk_account.smtp.host: "${ESC_SMTP_HOST}" xpack.notification.email.account.elk_account.smtp.port: "${ESC_SMTP_PORT}" xpack.notification.email.account.elk_account.smtp.user: "${ESC_SMTP_USER}" xpack.notification.email.default_account: elk_account ``` **Note** : Elasticsearch works correctly. **Note2** : SMTP configuration works correctly. **Note3** : If I remove the variables from the .yml file the keystore no longer returns errors. Thanks for your help, Giada ---
**Author:** ![gchiartosini](https://avatars.discourse-cdn.com/v4/letter/g/bc79bd/32.png) [@gchiartosini](https://discuss.elastic.co/u/gchiartosini)\ **Post date:** [May 4, 2020, 8:36am UTC](https://discuss.elastic.co/t/error-in-es-keystore-when-elasticsearch-yml-references-custom-variables-in-etc-default-elasticsearch/230592/2 "2020-05-04T08:36:36Z")
Sorry, I have included old configuration lines for the /etc/default/elasticsearch file. These are the correct lines: ```auto ################################# ## TLP NCR CUSTOM VARIABLES ################################# # For /etc/elasticsearch/elasticsearch.yml # section: xpack.notification.email.account ESC_SMTP_FROM="noreply@telepass.com" ESC_SMTP_SSL_TRUST="10.153.248.39" ESC_SMTP_AUTH=false ESC_SMTP_HOST="10.153.248.39" ESC_SMTP_PORT=25 ESC_SMTP_USER="noreply@telepass.com" ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [May 5, 2020, 1:00pm UTC](https://discuss.elastic.co/t/error-in-es-keystore-when-elasticsearch-yml-references-custom-variables-in-etc-default-elasticsearch/230592/3 "2020-05-05T13:00:46Z")
`/etc/default/elasticsearch` is not an alternative configuration file, it [only allows you to set _some_ parameters](https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html#deb-configuring). You can not add arbitrary substitutions in there. What you are actually trying to use is [environment variable substituion](https://www.elastic.co/guide/en/elasticsearch/reference/current/settings.html#_environment_variable_substitution), but as the name alludes to, you would have to export `ESC_SMTP_FROM` etc as environment variables. The reason why it works for elasticsearch, is that elasticsearch runs as a service and the service definition loads and sources `/etc/default/elasticsearch` thus making anything you define in there available as an environment variable. ---
**Author:** ![gchiartosini](https://avatars.discourse-cdn.com/v4/letter/g/bc79bd/32.png) [@gchiartosini](https://discuss.elastic.co/u/gchiartosini)\ **Post date:** [May 7, 2020, 5:28pm UTC](https://discuss.elastic.co/t/error-in-es-keystore-when-elasticsearch-yml-references-custom-variables-in-etc-default-elasticsearch/230592/4 "2020-05-07T17:28:55Z")
Thank you very much for your clarification about the function of the /etc/default/elasticsearch file and the loading process. The weird thing is that the elasticsearch-keystore utility uses /bin/elasticsearch-env which in turn _does_ source /etc/default/elasticsearch - apparently. Our aim would be to store our custom environment variables in one place where both elasticsearch _as a service_, and the elasticsearch-keystore utility _from command line via sudo_, could read them. Is that at all possible, that you know? We have even tried to move our custom variables to system-wide file - /etc/environment but it was worse, because elasticsearch was not able to resolve them. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 4, 2020, 5:28pm UTC](https://discuss.elastic.co/t/error-in-es-keystore-when-elasticsearch-yml-references-custom-variables-in-etc-default-elasticsearch/230592/5 "2020-06-04T17:28:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.