Where Elasticsearch stores your login credentials

Elasticsearch doesn't create a username and password for you automatically. Instead, it depends on how you set it up. If you installed Elasticsearch yourself, you either created credentials during setup, or you're running it without security enabled at all. If you're using Elasticsearch through a cloud provider like Elastic Cloud, AWS, or Google Cloud, the provider gave you credentials when you first created the cluster.

The location of your credentials depends entirely on your setup method. Self-hosted Elasticsearch stores user information in a file called users (no extension) inside the config/users_roles directory, but that file contains hashed passwords, not readable ones. Cloud-hosted Elasticsearch typically shows credentials in your account dashboard or sends them to you by email during initial setup.

If you set up Elasticsearch 8.0 or later, the installation process generated a temporary password and printed it to your terminal. That output is gone now unless you saved it, which means you'll need to reset the password rather than retrieve it.

Key Takeaways

  • Elasticsearch doesn't store readable passwords anywhere—they're hashed for security—so you cannot retrieve a forgotten password, only reset it.
  • During Elasticsearch 8.0+ installation, a temporary password appears in your terminal output; if you didn't save it, you must reset the password using the elasticsearch-reset-password tool.
  • Cloud providers like Elastic Cloud show credentials in your account dashboard or email them to you when you create a cluster.
  • The default username for Elasticsearch is elastic, but you can create additional users with different permissions.
  • Self-hosted Elasticsearch requires you to run a command-line tool to change passwords; there is no web interface for password recovery.

Resetting the password on self-hosted Elasticsearch

If you installed Elasticsearch on your own server and lost the temporary password, use the elasticsearch-reset-password tool. This tool comes with Elasticsearch and lives in the bin directory of your Elasticsearch installation.

Open a terminal, navigate to your Elasticsearch directory, and run this command:

./bin/elasticsearch-reset-password -u elastic -i

The -u elastic part specifies the username (elastic is the default built-in user). The -i flag makes the tool ask you to enter a new password interactively instead of generating a random one. If you want Elasticsearch to generate a strong random password instead, omit the -i flag and the new password will print to your terminal.

On Windows, use backslashes instead: .\bin\elasticsearch-reset-password.bat -u elastic -i

After you run this command, your new password takes effect when ready. You don't need to restart Elasticsearch.

Finding credentials in Elastic Cloud

Elastic Cloud is Elasticsearch's official cloud hosting service. When you create a new deployment, Elastic Cloud displays the username and password on the screen when ready after creation. The username is always elastic unless you created additional users.

If you didn't save that password, log into your Elastic Cloud account, go to your deployment, and click Security in the left menu. From there, select Users and find the elastic user. Click the three-dot menu next to it and choose Reset password. Elastic Cloud will generate a new password and show it to you once—save it when ready because you won't see it again.

Your Elasticsearch endpoint (the URL you use to connect) also appears in the Security section under Endpoints. It typically looks like https://[deployment-id].es.us-central1.gcp.cloud.es.io:9243.

Finding credentials in AWS Elasticsearch Service

AWS Elasticsearch Service (now called OpenSearch Service, though Elasticsearch is still available) stores credentials differently depending on whether you enabled fine-grained access control during setup.

If you enabled fine-grained access control, AWS created a master username and password during cluster creation. You can view and reset this password in the AWS console by going to your domain, clicking Security configuration, and then Master user. Click Change master user password to set a new one.

If you did not enable fine-grained access control, your cluster uses IP-based access instead of usernames and passwords. In that case, you authenticate by making requests from an allowed IP address, not by providing credentials. Check your access policy in the Security configuration section to see which IPs are allowed.

Finding credentials in Google Cloud Elasticsearch

Google Cloud doesn't host Elasticsearch directly, but you can run Elasticsearch on Google Cloud using Compute Engine or Google Kubernetes Engine. If you deployed Elasticsearch yourself on Google Cloud, your credentials are wherever you stored them during installation—typically in a configuration file or in your terminal history.

If you're using a third-party Elasticsearch service through Google Cloud Marketplace, check the service's own dashboard or documentation. Each provider handles credentials differently.

Creating additional users and checking permissions

The elastic user is the default superuser with full permissions. If you need to create additional users with limited permissions, use the elasticsearch-users tool on self-hosted Elasticsearch.

To create a new user, run:

./bin/elasticsearch-users useradd newusername -p

The -p flag prompts you to enter a password. After you create the user, assign them to a role using:

./bin/elasticsearch-users roles -a role_name newusername

Common roles include superuser (full access), viewer (read-only), and editor (read and write). Cloud providers have their own user management interfaces—check your provider's documentation for the exact steps.

Checking if security is enabled

If you're not sure whether your Elasticsearch instance requires a username and password at all, try connecting without credentials. Open a terminal and run:

curl http://localhost:9200

If Elasticsearch responds with cluster information, security is not enabled and you don't need credentials. If you get an authentication error, security is enabled and you need a username and password.

For cloud-hosted Elasticsearch, you always need credentials. The endpoint URL itself requires HTTPS (not HTTP), and the connection will fail without valid credentials.

Frequently Asked Questions

Can I see my password after I set it?

No. Elasticsearch hashes passwords for security, so even administrators cannot read them back. If you forget your password, you must reset it using the elasticsearch-reset-password tool or your cloud provider's dashboard. Write down new passwords when ready after creating them.

What if I'm locked out and can't run the reset tool?

If you can't access the server where Elasticsearch is running, you cannot reset the password without help from someone who can. For cloud-hosted Elasticsearch, contact your cloud provider's support. For self-hosted Elasticsearch, you may need to restore from a backup or reinstall.

Is the default username always "elastic"?

Yes, the built-in superuser is always named elastic. You can create other users with different names and permissions, but elastic is the default account that comes with every Elasticsearch installation.

Do I need different credentials for different parts of Elasticsearch?

No. A single username and password authenticates you to the entire Elasticsearch cluster. Once you're logged in, your permissions depend on which roles are assigned to your user. You don't need separate credentials for Kibana or other tools—they all use the same Elasticsearch users.