# Unable to start elasticsearch after add keystore on RHEL7 **URL:** \ **Category:** Elastic Security\ **Created:** [June 7, 2020, 2:57pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-add-keystore-on-rhel7/236091 "2020-06-07T14:57:03Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Bikash\_Swain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bikash_swain/32/69606_2.png) [@Bikash\_Swain](https://discuss.elastic.co/u/Bikash_Swain)\ **Post date:** [June 7, 2020, 2:57pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-add-keystore-on-rhel7/236091/1 "2020-06-07T14:57:03Z")
I freshly installed elasticsearch 7.6 in RHEL7 and started it successfully. When I add "test" keystore with command "./elasticsearch-keystore add test" and restarted elasticsearch service, its not starting up and showing below error "unknown secure setting [test]". What is the steps to add a keystore so that the key can be use in elasticsearch.yml file to replace clear text password of "auth.password:" logs: ` at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:126) [elasticsearch-7.6.0.jar:7.6.0] at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) [elasticsearch-7.6.0.jar:7.6.0] [2020-06-06T13:28:46,126][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [biks-m03] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.IllegalArgumentException: unknown secure setting [test] please check that any required plugins are installed, or check the breaking changes documentation for removed settings at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:174) ~[elasticsearch-7.6.0.jar:7.6.0] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:161) ~[elasticsearch-7.6.0.jar:7.6.0] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.6.0.jar:7.6.0]` ---
**Author:** ![Coinology](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Coinology](https://discuss.elastic.co/u/Coinology)\ **Post date:** [June 7, 2020, 9:42pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-add-keystore-on-rhel7/236091/2 "2020-06-07T21:42:19Z")
The elasticsearch keystore works a bit differently. Rather than creating keys and then using those keys in place of a value in your `elasticsearch.yml`, you just add the setting name as a key within the keystore. In other words, you could create a key within the keystore named `xpack.security.transport.ssl.keystore.secure_password` and then for the value specify whatever you want the value for the setting to be. Then, in `elasticsearch.yml`, you just omit that setting. Elasticsearch will read it directly out of the keystore. It's worth noting that not all settings are supported. The setting will have (secure) within the documentation to indicate that it can be used within the keystore. I recommend seeing [this](https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-settings.html) and [this](https://www.elastic.co/guide/en/elasticsearch/reference/current/elasticsearch-keystore.html). Hopefully that helps. ---
**Author:** ![Bikash\_Swain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bikash_swain/32/69606_2.png) [@Bikash\_Swain](https://discuss.elastic.co/u/Bikash_Swain)\ **Post date:** [June 8, 2020, 4:29pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-add-keystore-on-rhel7/236091/3 "2020-06-08T16:29:25Z")
Thanks for reply.. I am using http exporter to send monitoring data and my elasticsearch.yml file is configured same as here[monitoring exporter](https://www.elastic.co/guide/en/elasticsearch/reference/current/collecting-monitoring-data.html) ```auto xpack.monitoring.exporters: id1: type: http host: ["http://es-mon-1:9200", "http://es-mon2:9200"] auth.username: remote_monitoring_user auth.password: YOUR_PASSWORD ``` I want to hide cleartext `YOUR_PASSWORD` . how can I achieve this? ---
**Author:** ![Coinology](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Coinology](https://discuss.elastic.co/u/Coinology)\ **Post date:** [June 8, 2020, 10:02pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-add-keystore-on-rhel7/236091/4 "2020-06-08T22:02:55Z")
@Bikash_Swain Looking at the monitoring settings [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/monitoring-settings.html#http-exporter-settings) you will see two options to specify this password - `auth.password` and `auth.secure_password`. You will notice that `auth.secure_password` has (secure) next to it indicating it can be used in the keystore. Following your example, you would add a key named `xpack.monitoring.exporters.id1.auth.secure_password` to the keystore and set its value to whatever you want the value to be. Then, remove the `auth.password: YOUR_PASSWORD` line from your elasticsearch.yml. Elasticsearch will read it directly from the keystore. ---
**Author:** ![Bikash\_Swain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bikash_swain/32/69606_2.png) [@Bikash\_Swain](https://discuss.elastic.co/u/Bikash_Swain)\ **Post date:** [June 9, 2020, 3:09pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-add-keystore-on-rhel7/236091/5 "2020-06-09T15:09:42Z")
Thanks, it worked. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 8:01am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-after-add-keystore-on-rhel7/236091/6 "2022-11-04T08:01:28Z")