How to use keystore for basic auth password for the input watch

That is an absolute valid requirement. Do you mind opening an issue in https://github.com/elastic/elasticsearch/ (thanks to the x-pack merge we can now manage those kind of things in the ES repo).