# Masking password in logstash config file

**URL:** <https://discuss.elastic.co/t/masking-password-in-logstash-config-file/253368>\
**Category:** Logstash\
**Created:** [October 26, 2020, 9:05pm UTC](https://discuss.elastic.co/t/masking-password-in-logstash-config-file/253368 "2020-10-26T21:05:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [October 26, 2020, 9:05pm UTC](https://discuss.elastic.co/t/masking-password-in-logstash-config-file/253368/1 "2020-10-26T21:05:38Z")

</div>

Hello all,

As logstash config file is not centrally controlled, I want to mask the elasticsearch password in logstash.conf file so that it is not visible to all. Also user with what "security role" should suffice for mentioning in the conf file?

```
 **user => "abcd"
   password => "xyz"**

```

Please help

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 26, 2020, 9:12pm UTC](https://discuss.elastic.co/t/masking-password-in-logstash-config-file/253368/2 "2020-10-26T21:12:27Z")

</div>

There is a [keystore](https://www.elastic.co/guide/en/logstash/current/keystore.html) that can be used with logstash, beats, elasticsearch, and kibana configuration files.

---

<div class="post-metadata">

**Author:** ![zaeemmasood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zaeemmasood/32/102383_2.png) [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Post date:** [October 27, 2020, 8:44pm UTC](https://discuss.elastic.co/t/masking-password-in-logstash-config-file/253368/3 "2020-10-27T20:44:41Z")

</div>

Thanks. What should be the least privileged "security role" that could be used in the logtsash conf?

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [October 27, 2020, 9:03pm UTC](https://discuss.elastic.co/t/masking-password-in-logstash-config-file/253368/4 "2020-10-27T21:03:53Z")

</div>

This [guide](https://www.elastic.co/guide/en/logstash/current/ls-security.html) has the appropriate roles and permissions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2020, 9:03pm UTC](https://discuss.elastic.co/t/masking-password-in-logstash-config-file/253368/5 "2020-11-24T21:03:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.