# Encrypt / secure Elasticsearch's password in logstash.conf file
**URL:** https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549
**Category:** Logstash
**Created:** [December 20, 2017, 5:40am UTC](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549 "2017-12-20T05:40:25Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)
#### Post date: [December 20, 2017, 5:40am UTC](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549/1 "2017-12-20T05:40:26Z")
I'm using x-pack to secure ELK stack , I don't want to specify plain text "username" and "password" in logstash.conf for elasticsearch output plugin. Is there any way to do that?
```
output {
elasticsearch {
hosts => "hostname"
user => "username"
password => "password"
ssl => true
ssl_certificate_verification => true
truststore => "keystore.jks"
truststore_password => changeme
index => "logstash-%{+YYYY.MM.dd}"
template => "log-template.json"
template_name => "logstash*"
template_overwrite => true
}
}
```
---
### Author:  [@simmel](https://discuss.elastic.co/u/simmel)
#### Post date: [December 20, 2017, 10:54am UTC](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549/2 "2017-12-20T10:54:42Z")
You could always put the password as an environment variable, see
[https://www.elastic.co/guide/en/logstash/6.1/environment-variables.html](https://www.elastic.co/guide/en/logstash/6.1/environment-variables.html)
---
### Author:  [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)
#### Post date: [December 20, 2017, 11:32am UTC](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549/3 "2017-12-20T11:32:41Z")
Yes I know logstash supports environment variables, but that would be more security problem. I'm looking for same certificate based authentication without implicitly specify username and password(even not as environment variable) or some type of encryption for username and password.
---
### Author:  [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)
#### Post date: [December 21, 2017, 5:55am UTC](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549/4 "2017-12-21T05:55:08Z")
Any luck?
---
### Author:  [@simmel](https://discuss.elastic.co/u/simmel)
#### Post date: [December 28, 2017, 7:24am UTC](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549/5 "2017-12-28T07:24:11Z")
Environment variables are only visible by the user running logstash and
root. No matter what you do the user running logstash can and must be
able to read the password and root will always be able to, no matter
what.
If you're using an encrypted password where do you store the encryption
key? The user running logstash will need to read that to and root will
always be able to, no matter what.
Besides, using a certificate file will have the same issue especially
since if you want to protect it you need a password on it.
---
### Author:  [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)
#### Post date: [December 28, 2017, 3:12pm UTC](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549/6 "2017-12-28T15:12:50Z")
X-pack supports PKI based authentication. I have implemented that.If anyone looking for some sort of certificate based solution then check this link [pki](https://www.elastic.co/guide/en/x-pack/current/pki-realm.html)
Anyway thanks for your reply.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 25, 2018, 3:12pm UTC](https://discuss.elastic.co/t/encrypt-secure-elasticsearchs-password-in-logstash-conf-file/112549/7 "2018-01-25T15:12:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.