# How to use keystore in Dockerized logstash?

**URL:** <https://discuss.elastic.co/t/how-to-use-keystore-in-dockerized-logstash/199694>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [September 16, 2019, 3:51pm UTC](https://discuss.elastic.co/t/how-to-use-keystore-in-dockerized-logstash/199694 "2019-09-16T15:51:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![furiabhavesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/furiabhavesh/32/52498_2.png) [@furiabhavesh](https://discuss.elastic.co/u/furiabhavesh)\
**Post date:** [September 16, 2019, 3:51pm UTC](https://discuss.elastic.co/t/how-to-use-keystore-in-dockerized-logstash/199694/1 "2019-09-16T15:51:34Z")

</div>

I am referring [this help document](https://www.elastic.co/guide/en/logstash/current/docker-config.html) to setup logstash 7.3.2 using docker and wanted to pass few environment variables which I further want to access in my input block of the`.conf` files

Eg:

`docker run -e TCP_PORT=123...`

```
input {
  tcp {
    port => "${TCP_PORT}"
  }
}

```

But I am getting some ERROR message saying that keystore must be setup to access the ENV variables

I came across [this guide for configuring keystore](https://www.elastic.co/guide/en/logstash/current/keystore.html) and would like to know what should my Dockerfile look like such that I have keystore setup and my conf file can access ENV variables as well ?

**Current Dockerfile**  
`FROM docker.elastic.co/logstash/logstash:7.3.2`  
`RUN rm -f /usr/share/logstash/pipeline/logstash.conf`  
`ADD logstash.yml /usr/share/logstash/config/logstash.yml`  
`ADD service.conf /usr/share/logstash/pipeline/service.conf`

Should I also ADD my local keystore file to the docker image ?  
If yes, does that mean everytime I need to add new ENV variable, I have to rebuild the image ?

---

<div class="post-metadata">

**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\
**Post date:** [October 11, 2019, 3:37pm UTC](https://discuss.elastic.co/t/how-to-use-keystore-in-dockerized-logstash/199694/2 "2019-10-11T15:37:34Z")

</div>

Others might run into the same issue, so quickly writing down the answer for the problem would be great 🙂

---

<div class="post-metadata">

**Author:** ![furiabhavesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/furiabhavesh/32/52498_2.png) [@furiabhavesh](https://discuss.elastic.co/u/furiabhavesh)\
**Post date:** [October 13, 2019, 6:35am UTC](https://discuss.elastic.co/t/how-to-use-keystore-in-dockerized-logstash/199694/3 "2019-10-13T06:35:07Z")

</div>

Yes, I had to add my keystore file in docker image so that I can access those credentials in the container.

```auto
FROM docker.elastic.co/logstash/logstash:7.3.2

RUN rm -f /usr/share/logstash/pipeline/logstash.conf

ADD logstash.yml /usr/share/logstash/config/logstash.yml
ADD logstash.conf /usr/share/logstash/pipeline/logstash.conf
ADD logstash.keystore /usr/share/logstash/config/logstash.keystore 

```

Which also means, I had to rebuild the image every time there was a change in keystore.

I was confused about defining **every key** in keystore if that needs to be accessible as environment variable, but after [discussing it from here](https://github.com/elastic/logstash/issues/9007#issuecomment-540686940) I realized that it's not the case.

> I can access any environment variable passed in .conf file, even if that's not declared in keystore file. Declaring every environment variable in keystore is not mandatory.

[It also helped me to understand that:](https://github.com/elastic/logstash/issues/9007#issuecomment-540814069)

> If the variable exists in the keystore, the value from the keystore is **always** used; only if it is _missing_ from the keystore is it sourced from the environment.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 10, 2019, 6:35am UTC](https://discuss.elastic.co/t/how-to-use-keystore-in-dockerized-logstash/199694/4 "2019-11-10T06:35:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.