Secrets keystore for secure settings
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Stack
Generally available
The APM Server keystore only applies to the APM Server binary installation method.
When you configure APM Server, you might need to specify sensitive settings, such as passwords. Rather than relying on file system permissions to protect these values, you can use the APM Server keystore to securely store secret values for use in configuration settings.
After adding a key and its secret value to the keystore, you can use the key in place of the secret value when you configure sensitive settings.
The syntax for referencing keys is identical to the syntax for environment variables:
${KEY}
Where KEY is the name of the key.
For example, imagine that the keystore contains a key called ES_PWD with the value yourelasticsearchpassword:
- In the configuration file, use
output.elasticsearch.password: "${ES_PWD}" - On the command line, use:
-E "output.elasticsearch.password=\${ES_PWD}"
When APM Server unpacks the configuration, it resolves keys before resolving environment variables and other variables.
Notice that the APM Server keystore differs from the Elasticsearch keystore. Whereas the Elasticsearch keystore lets you store elasticsearch.yml values by name, the APM Server keystore lets you specify arbitrary names that you can reference in the APM Server configuration.
To create and manage keys, use the keystore command. See the command reference for the full command syntax, including optional flags.
The keystore command must be run by the same user who will run APM Server.
To create a secrets keystore, use:
apm-server keystore create
APM Server creates the keystore in the directory defined by the path.data configuration setting.
To store sensitive values, such as authentication credentials for Elasticsearch, use the keystore add command:
apm-server keystore add ES_PWD
When prompted, enter a value for the key.
To overwrite an existing key’s value, use the --force flag:
apm-server keystore add ES_PWD --force
To pass the value through stdin, use the --stdin flag. You can also use --force:
cat /file/containing/setting/value | apm-server keystore add ES_PWD --stdin --force
To list the keys defined in the keystore, use:
apm-server keystore list
To remove a key from the keystore, use:
apm-server keystore remove ES_PWD