Set the password for the built-in monitoring useredit

X-Pack security provides built-in user credentials in Elasticsearch that have a fixed set of privileges. In 6.3.0 and later releases, there is a beats_system built-in user, which Journalbeat uses to store monitoring information in Elasticsearch.

The initial passwords for all of the built-in users are set by using the setup-passwords tool in Elasticsearch. Thereafter, you can change the passwords by using the Management > Users page in Kibana or the Change Password API.

If you upgraded from Elasticsearch version 6.2 or earlier, you will not have set a password for the beats_system user. A user with the manage_security privilege must change the password for this built-in user.

For more information, see: