# Logstash keystore elasticsearch password
**URL:** https://discuss.elastic.co/t/logstash-keystore-elasticsearch-password/185085
**Category:** Logstash
**Created:** [June 11, 2019, 4:18am UTC](https://discuss.elastic.co/t/logstash-keystore-elasticsearch-password/185085 "2019-06-11T04:18:19Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)
#### Post date: [June 11, 2019, 4:18am UTC](https://discuss.elastic.co/t/logstash-keystore-elasticsearch-password/185085/1 "2019-06-11T04:18:19Z")
How can I use the keystore for password instead of specifying it in the logstash.yml?
xpack.monitoring.elasticsearch.password:
I tried adding the ES\_PWD and listing it from the keystore
/usr/share/logstash/bin/logstash-keystore list --path.settings /etc/logstash/
es\_pwd
and adding
xpack.monitoring.elasticsearch.password: "es\_pwd"
but it's not working
Thanks
---
### Author:  [@axrayn](https://discuss.elastic.co/u/axrayn)
#### Post date: [June 11, 2019, 8:08am UTC](https://discuss.elastic.co/t/logstash-keystore-elasticsearch-password/185085/2 "2019-06-11T08:08:01Z")
In your logstash.yml, you need to specify it as ${ES\_PWD}
Documentation for it is here -\> [https://www.elastic.co/guide/en/logstash/current/keystore.html](https://www.elastic.co/guide/en/logstash/current/keystore.html)
---
### Author:  [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)
#### Post date: [June 11, 2019, 11:33pm UTC](https://discuss.elastic.co/t/logstash-keystore-elasticsearch-password/185085/3 "2019-06-11T23:33:00Z")
Thanks for your reply
When I use this it works:
```
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password: "password"
```
[2019-06-12T07:36:15,552][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[http://logstash\_system:xxxxxx@localhost:9200/](http://logstash_system:xxxxxx@localhost:9200/)]}}
When I specify as this it doesn't work:
> xpack.monitoring.elasticsearch.username: "logstash\_system"
> xpack.monitoring.elasticsearch.password: ${ES\_PWD}
```
> [2019-06-12T08:16:04,176][WARN][logstash.runner] SIGTERM received. Shutting down.
> [2019-06-12T08:16:09,365][WARN][org.logstash.execution.ShutdownWatcherExt] {"inflight_count"=>0, "stalling_threads_info"=>{"other"=>[{"thread_id"=>29, "name"=>"[main]"[...]/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats-6.0.0-java/lib/logstash/inputs/beats.rb:204:in `run'"}], ["LogStash::Filters::GeoIP", {"database"=>"/etc/logstash/GeoLite2-ASN.mmdb", "source"=>"[source][ip]", "id"=>"29a40f7c73feaa37ffe99814f4ce339cebf28d761028438fb997fd519d06be16"}]=>[{"thread_id"=>25, "name"=>"[main]>worker0", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:235:in `block in start_workers'"}, {"thread_id"=>26, "name"=>"[main]>worker1", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:235:in `block in start_workers'"}, {"thread_id"=>27, "name"=>"[main]>worker2", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:235:in `block in start_workers'"}, {"thread_id"=>28, "name"=>"[main]>worker3", "current_call"=>"[...]/logstash-core/lib/logstash/java_pipeline.rb:235:in `block in start_workers'"}]}}
> [2019-06-12T08:16:09,369][ERROR][org.logstash.execution.ShutdownWatcherExt] The shutdown process appears to be stalled due to busy or blocked plugins. Check the logs for more information.
> [2019-06-12T08:16:10,645][INFO][logstash.javapipeline] Pipeline terminated {"pipeline.id"=>"main"}
> [2019-06-12T08:16:10,649][INFO][logstash.runner] Logstash shut down.
```
I'm looking at the monitoring not the management
> **[Monitoring Logstash (legacy) | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/configuring-logstash.html#monitoring-settings)**
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 9, 2019, 11:33pm UTC](https://discuss.elastic.co/t/logstash-keystore-elasticsearch-password/185085/4 "2019-07-09T23:33:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.