# Elasticsearch.keystore **URL:** \ **Category:** Elasticsearch\ **Created:** [October 25, 2018, 5:55pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051 "2018-10-25T17:55:30Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Jockj](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@Jockj](https://discuss.elastic.co/u/Jockj)\ **Post date:** [October 25, 2018, 5:55pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051/1 "2018-10-25T17:55:30Z")
does anyone have one list of supported keys/values in elasticsearch.keystore? I'm trying to leverage elasticsearch.keystore, but I cannot find a document to know which keys/values of the settings is supported. ---
**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\ **Post date:** [October 25, 2018, 6:20pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051/2 "2018-10-25T18:20:45Z")
There is no central listing keys that may be used within the elasticsearch keystore. Rather, each setting that must be specified in the keystore explicitly notes this. So, look at documentation for whatever you are trying to configure, and see if it mentions it as a "secure setting". ---
**Author:** ![Jockj](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@Jockj](https://discuss.elastic.co/u/Jockj)\ **Post date:** [October 25, 2018, 10:13pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051/3 "2018-10-25T22:13:52Z")
Thanks Ryan. I try to "secure" the password used to connect to the central monitoring, so I try something like below, it doesn't work, does it mean it is not supported yet. in elasticsearch.yml xpack.monitoring.exporters: idhttp: type: http host: ["[https://10.224.244.170:9200](https://10.224.244.170:9200)"] auth.username: clp\_monitoring auth.password: ${xpack.monitoring.exporters.idhttp.auth.password} ssl.certificate\_authorities: "/etc/elasticsearch/x-pack/es\_xpack\_ca.crt" I put xpack.monitoring.exporters.idhttp.auth.password in the keystore, it has error Exception in thread "main" java.lang.IllegalArgumentException: Circular placeholder reference 'xpack.monitoring.exporters.idhttp.auth.password' in property definitions I try to use auth.password: ${auth.password}, it has error Exception in thread "main" java.lang.IllegalArgumentException: Could not resolve placeholder 'auth.password' I try to remove the line auth.password from the elasticsearch.yml, there is no error but it will not load the password from the keystore. ---
**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Post date:** [October 30, 2018, 9:55pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051/4 "2018-10-30T21:55:00Z")
+1! it's not clear how to reference the properties from `keystore`, especially on Windows: ```auto bin\elasticsearch-keystore create bin\elasticsearch-keystore add pw ``` 1. `elasticsearch.yml`: ```auto bind_password: "${pw}" ``` Exception: `Exception in thread "main" java.lang.IllegalArgumentException: Could not resolve placeholder 'pw'` 1. `elasticsearch.yml`: ```auto bind_password: "$pw" ``` Exception: `uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: unknown secure setting [pw] please check that any required plugins are installed, or check the breaking changes documentation for removed settings` Please update the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-settings.html) by adding examples (unix & win). Thanks a lot! Update: oops, sorry: > Only some settings are designed to be read from the keystore. See documentation for each setting to see if it is supported as part of the keystore. ok, works as designed... ---
**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Post date:** [October 30, 2018, 10:27pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051/5 "2018-10-30T22:27:35Z")
works: ```auto bind_dn: "CN=user,OU=People,DC=company,DC=com" # secure_bind_password: "use the keystore: bin\elasticsearch-keystore add xpack.security.authc.realms.company_ad.secure_bind_password" ``` ---
**Author:** ![rjernst](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rjernst/32/6363_2.png) [@rjernst](https://discuss.elastic.co/u/rjernst)\ **Post date:** [October 31, 2018, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051/6 "2018-10-31T16:21:08Z")
@jetnet Properties are not meant to be referenced. The keystore key is the secure setting. @Jockj The monitoring http exporter does not yet have keystore variants of its username/password. Each setting that supports keystore must be manually migrated, and this is an ongoing effort. ---
**Author:** ![Jockj](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@Jockj](https://discuss.elastic.co/u/Jockj)\ **Post date:** [October 31, 2018, 4:52pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051/7 "2018-10-31T16:52:11Z")
@rjernst, Thanks a lot for your update. ---
**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Post date:** [October 31, 2018, 8:50pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051/8 "2018-10-31T20:50:31Z")
@rjernst, thanks for the details. I didn't use the ES keystore before, in LS keystore you can reference props, that's why I tried to do the same with ES one. One stack - different approaches? 😉 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2018, 8:55pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore/154051/9 "2018-11-28T20:55:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.