# Request to Externalize Hardcoded Credentials from filebeat.yml

**URL:** <https://discuss.elastic.co/t/request-to-externalize-hardcoded-credentials-from-filebeat-yml/379282>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 18, 2025, 7:56am UTC](https://discuss.elastic.co/t/request-to-externalize-hardcoded-credentials-from-filebeat-yml/379282 "2025-06-18T07:56:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thirupathi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thirupathi/32/145431_2.png) [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\
**Post date:** [June 18, 2025, 7:56am UTC](https://discuss.elastic.co/t/request-to-externalize-hardcoded-credentials-from-filebeat-yml/379282/1 "2025-06-18T07:56:21Z")

</div>

Currently, the Filebeat configuration (`filebeat.yml`) includes hardcoded values for the Elasticsearch and kafka host IP, username, and password. This poses a potential security risk and makes configuration changes non-scalable.

I request assistance in externalizing these sensitive values using external configuration variables, secret management tools,

Details:output.kafka:  
hosts: ["xx.xx.xx:9092"]  
topic: "npc-raw-msg"  
key: "apache-request-response-dump" # Using random number as part of the key  
codec.format:  
string: '%{[message]}' # Send the full message to Kafka  
partition.round\_robin:  
reachable\_only: false  
required\_acks: 1  
compression: gzip  
max\_message\_bytes: 1000000  
close\_inactive: 10m

hosts: ["[https://xx.xx.xx:9200](https://xx.xx.xx:9200)"]  
username: "elastic"  
password: "yX\*xwYQtooCRmtLwgoWH"  
ssl.verification\_mode: none  
index: "npc-raw-msg"

# document\_id: "{{{versionedKey}}}"

# pipeline: "remove\_fields\_pipeline"

#Define the index template  
setup.template.name: "npc-raw-thiru"  
setup.template.pattern: "npc-raw-thiru-\*"  
setup.template.enabled: true

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [June 18, 2025, 11:39am UTC](https://discuss.elastic.co/t/request-to-externalize-hardcoded-credentials-from-filebeat-yml/379282/2 "2025-06-18T11:39:07Z")

</div>

Hi,

What exactly is your problem? I assume you already found the documentation for the [Filebeat Keystore](https://www.elastic.co/guide/en/beats/filebeat/8.18/keystore.html)?

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![TiagoQueiroz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tiagoqueiroz/32/107061_2.png) [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)\
**Post date:** [June 30, 2025, 12:42pm UTC](https://discuss.elastic.co/t/request-to-externalize-hardcoded-credentials-from-filebeat-yml/379282/3 "2025-06-30T12:42:08Z")

</div>

Hi @Thirupathi, I moved the post to a more appropriated category.

@Wolfram_Haussig answer is pretty good, the linked documentation also touches [environment variables](https://www.elastic.co/docs/reference/beats/libbeat/config-file-format-env-vars) that is another way to not hard-code secrets in the configuration files.

Did it solve your problem? If so, could you accept the answer?