Change Elasticsearch password

Elastic Stack Elasticsearch
1

Hi

Understanding that Logstash uses .conf files to authenticate against Elasticsearch, I am here today to ask for your help in changing the current password I have configured in the .conf files from Logstash.

elasticsearch {
  id => "My_font"
  hosts => ["https://192.168.1.1:9200","https://192.168.1.2:9200","https://192.168.1.3:9200"]
  data_stream => true
  data_stream_type => "logs"
  data_stream_dataset => "my_font"
  data_stream_namespace => "prd"
  user => "elastic"
  password => "cocacola"
  ssl_enabled  => true
  ssl_certificate_authorities => "/xxxxxxxxxxx/ca.crt"
}

If I want to set the new password as pepsi2025, how can I do this without affecting the ELK solution?

2

Not sure if I understood, the authentication is done on Elasticsearch side, if you want to change the password for the elastic user, you need to do that on Elasticsearch or using the Kibana UI.

It will affect everywhere this user is used.

1 Like
3

The key I currently use is very old, and I need to assign a new one.

Do I need to log in directly to each of the servers in the Elasticsearch cluster to modify the .yml or something like that? Or is there another method? That is my question.

4

No, the password is set on the cluster, it exists in the security index, to change it you need to use the Change Password API or change it using the Kibana UI, in the User Management part.

After you change it will will also need to change any configuration that uses the old password, for example, if your in your kibana.yml you configures Kibana to use the elastic user and the old password, you will need to change it on the file and restart Kibana as well.

1 Like
5

@leandrojmp

Thanks for your reply. To make sure I understand you correctly, I just need to log in from the Kibana graphical interface, then go to Dev Tools and run

POST /_security/user/elastic/_password
{
"password": “pepsi”
}

Then I log in to Logstash via SSH and modify each of the .conf files with the new password.

Is that all? Or do I need to do anything else?

Should I restart Logstash after the change?

6

Yes, you need to change it in every configuration file you have and restar the services.

Also, as mentioned, if Kibana is configured to use the elastic user you also need to change this in Kibana configuration and restart the service.

If this is a production environment I suggest that you do those actions on a maintenance windows as they can impact the availability of your cluster.

1 Like
7

Thank you very much, as always, for your valuable help. I was able to make the change.