Secrets keystore for secure settingsedit

When you configure Packetbeat, you might need to specify sensitive settings, such as passwords. Rather than relying on file system permissions to protect these values, you can use the Packetbeat keystore to securely store secret values for use in configuration settings.




Where KEY is the name of the key.



When Packetbeat unpacks the configuration, it resolves keys before resolving environment variables and other variables.

Notice that the Packetbeat keystore differs from the Elasticsearch keystore. Whereas the Elasticsearch keystore lets you store elasticsearch.yml values by name, the Packetbeat keystore lets you specify arbitrary names that you can reference in the Packetbeat configuration.


The keystore command must be run by the same user who will run Packetbeat.

Create a keystoreedit

To create a secrets keystore, use:

packetbeat keystore create

Packetbeat creates the keystore in the directory defined by the path.config configuration setting.

Add keysedit


packetbeat keystore add ES_PWD

When prompted, enter a value for the key.


packetbeat keystore add ES_PWD --force


cat /file/containing/setting/value | packetbeat keystore add ES_PWD --stdin --force

List keysedit

To list the keys defined in the keystore, use:

packetbeat keystore list

Remove keysedit

To remove a key from the keystore, use:

packetbeat keystore remove ES_PWD