Where is the password stored?

as a root user, i could get all elasticsearch data files, but origin elasticsearch had password auth settings. Could i process the data file, remove the password relatived files and get the elasticsearch data without auth?

Welcome to our community! :smiley:

Elasticsearch doesn't password the underlying data structures, the authentication is for API access.

Theoretically you might be login to the cluster hosts, copy the Elasticsearch data files themselves and then put them in another cluster and access the data. That's theoretical because you would probably run into corruption issues and it may not even work, so it's more of a gedankenexperiment.

half year ago, i indexed 10B data into a cluster, and then i stop the cluster, redeploy four clusters the same as the origin one, and just copy the indexed data files to others without index again and angin. And all they work well till now.