diff --git a/salt/common/tools/sbin/so-elastic-auth b/salt/common/tools/sbin/so-elastic-auth
index 663dbb9f6..6631badf2 100755
--- a/salt/common/tools/sbin/so-elastic-auth
+++ b/salt/common/tools/sbin/so-elastic-auth
@@ -45,7 +45,7 @@ if [[ "$authEnable" == "true" ]]; then
     if grep -q "argon" "$ES_USERS_FILE"; then
       echo ""
       echo "IMPORTANT: The following users will need to change their password, after logging into SOC, in order to access Kibana:"
-      grep argon "$ES_USERS" | cut -d ":" -f 1
+      grep argon "$ES_USERS_FILE" | cut -d ":" -f 1
     fi
   else
     echo "Auth is already enabled."