Steps to change elastic password

[elasticforme (Sachin)]

I try changing password for user elastic.

I had many pipeline running and they all use this password.

this is what I did and it starting giving me lot of error in logstash. is there step I missed?

stop logstash
went to kibana and change password for user "elastic"
log out from kibana and relogin using new password and it worked.

started logstash after change elastic password line in config file.
and it started giving me this errors

2020-07-23T11:37:09,046][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://elastic:xxxxxx@elkd04:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://ekd04:9200/'"}

[2020-07-23T11:36:22,999][ERROR][logstash.outputs.elasticsearch][top_session][6188245ab96b0fe0345c4a86b8d7232117642527a4977e4d9a561e74af677ea9] Encountered a retryable error. Will Retry with exponential backoff {:code=>401, :url=>"http://elkd04:9200/_bulk"}

what did I miss?

hence I went back and put same password back and everything started working.

[elasticforme (Sachin)]

@elasticforme

2020-07-23T11:37:09,046][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://elastic:xxxxxx@elkd04:9200/", :error_type=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://ekd04:9200/'"}

I don't have hardcoded elastic:xxxxx anywhere in logstash.yml or elasticsearch.yml.
where is this coming from?

[elasticforme (Sachin)]

oh found it. it was just me.
didn't check /etc/default/logstash has this password. change that and everything is working.