Setting Up User Authentication

Authentication identifies an individual. To gain access to restricted resources, a user must prove their identity, via passwords, credentials, or some other means (typically referred to as authentication tokens).

You can use the native support for managing and authenticating users, or integrate with external user management systems such as LDAP and Active Directory. For information about managing native users, see Managing Native Users.

Built-in Users

X-Pack security provides built-in user credentials to help you get up and running. These users have a fixed set of privileges and cannot be authenticated until their passwords have been set. In order to set these passwords, the elastic user must have its password bootstrapped. To bootstrap the password, please read Bootstrap Elastic Password below.

Once the elastic user has its password bootstrapped, this user can be used to set all of the built-in user passwords.

Table 3. X-Pack security Built-in Users




A built-in superuser. See Built-in Roles.


The user Kibana uses to connect and communicate with Elasticsearch.


The user Logstash uses when storing monitoring information in Elasticsearch.

How the Built-in Users Work

These built-in users are stored within a special .security index managed by X-Pack security. This means that, if the password is changed, or a user is disabled, then that change is automatically reflected on each node in the cluster. It also means that if your .security index is deleted, or restored from a snapshot, then any changes you have applied will be lost.

Although they share the same API, the built-in users are separate and distinct from users managed by the native realm. Disabling the native realm will not have any effect on the built-in users. The built-in users can be disabled individually, using the user management API.

Bootstrap Elastic Password

The elastic user can have its password bootstrapped by placing a password in the keystore of at least one node. At startup, that node will pull the password out of the keystore and set the elastic password to that value. The password will only be set if the elastic user password has not already been set.

As the elastic user is stored in the native realm, the password will be synced to all the nodes in a cluster. It is safe to bootstrap the password with multiple nodes as long as the password is the same. If different passwords are set with different nodes, it is unpredictable which password will be bootstrapped.

Specifically, the setting for the bootstrap password is "bootstrap.password". If the keystore has not been created before, it must be created first.

bin/elasticsearch-keystore create
bin/elasticsearch-keystore add "bootstrap.password"

After running the "add" command, you will be prompted to enter your password.

The bootstrap password is only intended to be a transient password used to help you set all the built-in user passwords. As the password will remain accessible in the keystore on the machine, the elastic user’s password should be changed to a different password when you <set-built-in-user-passwords,set all the built-in passwords>.

Set Built-in User Passwords


You must set the passwords for all built-in users. You can update passwords from the Management > Users UI in Kibana, using the setup-passwords tool, or with the security user api.

The setup-passwords tool is a command line tool that is provided to assist with setup. When it is run, it will use the elastic user bootstrap password to execute api requests that will change the passwords of the elastic, kibana, and logstash_system users. In "auto" mode the passwords will be generated randomly and printed to the console.

bin/x-pack/setup-passwords auto

There is also an "interactive" mode that will prompt you to manually enter passwords.

bin/x-pack/setup-passwords interactive

If the node is not listening at "http://localhost:9200", you will need to pass the url parameter to tell the tool where to submit the requests.

bin/x-pack/setup-passwords auto -u "http://localhost:9201"

The Reset Password API can also be used to change the passwords manually.

PUT _xpack/security/user/elastic/_password
  "password": "elasticpassword"
PUT _xpack/security/user/kibana/_password
  "password": "kibanapassword"
PUT _xpack/security/user/logstash_system/_password
  "password": "logstashpassword"

Once the kibana user password is reset, you need to update the Kibana server with the new password by setting elasticsearch.password in the kibana.yml configuration file:

elasticsearch.password: kibanapassword

The logstash_system user is used internally within Logstash when monitoring is enabled for Logstash.

To enable this feature in Logstash, you need to update the Logstash configuration with the new password by setting xpack.monitoring.elasticsearch.password in the logstash.yml configuration file:

xpack.monitoring.elasticsearch.password: logstashpassword

If you have upgraded from an older version of elasticsearch/x-pack, the logstash_system user may have defaulted to disabled for security reasons. Once the password has been changed, you can enable the user via the following API call:

PUT _xpack/security/user/logstash_system/_enable

Disable Default Password Functionality


This setting is deprecated. The elastic user no longer has a default password. The password must be set before the user can be used.

Internal Users

X-Pack security has two internal users (_system and _xpack) that are responsible for the operations that take place inside an Elasticsearch cluster.

These users are only used by requests that originate from within the cluster. For this reason, they cannot be used to authenticate against the API, and there is no password to manage or reset.

From time-to-time you may find a reference to one of these users inside your logs, including audit logs.