# Steps to change elastic password
**URL:** https://discuss.elastic.co/t/steps-to-change-elastic-password/242374
**Category:** Elasticsearch
**Created:** [July 23, 2020, 4:53pm UTC](https://discuss.elastic.co/t/steps-to-change-elastic-password/242374 "2020-07-23T16:53:31Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [July 23, 2020, 4:53pm UTC](https://discuss.elastic.co/t/steps-to-change-elastic-password/242374/1 "2020-07-23T16:53:32Z")
I try changing password for user elastic.
I had many pipeline running and they all use this password.
this is what I did and it starting giving me lot of error in logstash. is there step I missed?
stop logstash
went to kibana and change password for user "elastic"
log out from kibana and relogin using new password and it worked.
started logstash after change elastic password line in config file.
and it started giving me this errors
2020-07-23T11:37:09,046][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://elastic:xxxxxx@elkd04:9200/](http://elastic:xxxxxx@elkd04:9200/)", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://ekd04:9200/](http://ekd04:9200/)'"}
[2020-07-23T11:36:22,999][ERROR][logstash.outputs.elasticsearch][top\_session][6188245ab96b0fe0345c4a86b8d7232117642527a4977e4d9a561e74af677ea9] Encountered a retryable error. Will Retry with exponential backoff {:code=\>401, :url=\>"[http://elkd04:9200/\_bulk](http://elkd04:9200/_bulk)"}
what did I miss?
hence I went back and put same password back and everything started working.
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [July 23, 2020, 6:34pm UTC](https://discuss.elastic.co/t/steps-to-change-elastic-password/242374/2 "2020-07-23T18:34:11Z")
> [@elasticforme](#):
>
> 2020-07-23T11:37:09,046][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"[http://elastic:xxxxxx@elkd04:9200/](http://elastic:xxxxxx@elkd04:9200/)", :error\_type=\>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at URL '[http://ekd04:9200/](http://ekd04:9200/)'"}
I don't have hardcoded elastic:xxxxx anywhere in logstash.yml or elasticsearch.yml.
where is this coming from?
---
### Author:  [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [July 23, 2020, 6:43pm UTC](https://discuss.elastic.co/t/steps-to-change-elastic-password/242374/3 "2020-07-23T18:43:20Z")
oh found it. it was just me.
didn't check /etc/default/logstash has this password. change that and everything is working.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2020, 6:43pm UTC](https://discuss.elastic.co/t/steps-to-change-elastic-password/242374/4 "2020-08-20T18:43:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.