Encrypt Password In Filebeat Yml

Elastic Stack Elasticsearch
1

Hi Team,

Could you please help me how we can encrypt the plain text password which we are mentioning in filebeat.yml file.

Thanks,
Debasis

2

You can use a keystore as mentioned in the documentation.

3

@leandrojmp Is this option works if we are using basic licensing ELK stack.

Thanks,
Debasis

4

@Debasis_Mallick Yes keystore is available in Basic license

5

@stephenb I had executed the key store command as below but it did not create any key store in paths.data folder which is mentioned in filebeat.yml.

[root@cb-4 ~]# filebeat keystore create
Created filebeat keystore

Below is the snippet from filebeat.yml file.

type: log
  enabled: true
  paths:
   - /cbdata/elastic/cb4lv1/cb4transv4/*.csv # path to your CSV file
  exclude_lines: ['^\"\"']          # header line
  pipeline: parse_elastic_data_v2
  harvestor_buffer_size: 40960000
  close_eof: true
  close_inactive: 10s

Below is the location of paths.data folder.

[root@cb-4 cb4transv4]# pwd
/cbdata/elastic/cb4lv1/cb4transv4
[root@cb-4 cb4transv4]# ls -ltr
total 4
-rw-r--r-- 1 root root 957 Jun 26 17:20 2023-07-09_17118023455.csv
[root@cb-4 cb4transv4]#

Please suggest if I am missing anything.

Thanks,
Debasis

6

That is not the path.data unless you made changes
path.data is not where your source logs are it is where filebeat keeps state data and other items

See Here:

If you installed with package

/var/lib/filebeat