X-Pack security provides built-in user credentials in Elasticsearch that have a fixed set of
privileges. In 6.3.0 and later releases, there is a
beats_system built-in user, which Packetbeat uses to store
monitoring information in Elasticsearch.
The initial passwords for all of the built-in users are set by using the
setup-passwords tool in Elasticsearch. Thereafter, you can change the passwords by
using the Management > Users page in Kibana or the
Change Password API.
If you upgraded from Elasticsearch version 6.2 or earlier, you will not
have set a password for the
beats_system user. A user with the
manage_security privilege must change the password for this built-in user.
For more information, see: