The default Kibana username is elastic

When you deploy Kibana in Kubernetes using the standard Elastic Stack configuration, the default username is elastic. This account comes pre-configured in most Kubernetes manifests and Helm charts that set up Kibana alongside Elasticsearch. The password is generated during deployment and stored in a Kubernetes secret, not hardcoded in the container.

The elastic user is a built-in superuser account with full permissions across Kibana and Elasticsearch. It can create spaces, manage users, configure alerting, and access all data. Because it has unrestricted access, many teams create additional users with narrower permissions for day-to-day work and reserve the elastic account for administrative tasks only.

Key Takeaways

  • The default Kibana username in Kubernetes is elastic, a superuser account created automatically during Elastic Stack deployment.
  • The password for the elastic user is generated randomly and stored in a Kubernetes secret named elastic-credentials or similar, not visible in deployment files.
  • You retrieve the elastic password by reading the secret from your Kubernetes cluster using kubectl, not by looking it up in documentation.
  • The elastic account should be used for administrative work; creating separate users with limited permissions is a common security practice for regular access.

How to retrieve the elastic password from Kubernetes

The password is not stored in your deployment manifest or Helm values. Instead, it lives in a Kubernetes secret that the Elastic operator or Helm chart creates automatically. To find it, you need to read the secret directly from your cluster.

If you deployed Kibana using the Elastic Cloud on Kubernetes (ECK) operator, run this command in your terminal:

kubectl get secret elasticsearch-es-elastic-user -o jsonpath='{.data.elastic}' | base64 --decode

Replace elasticsearch-es-elastic-user with the actual secret name in your namespace if it differs. If you deployed using a Helm chart, the secret name might be elasticsearch-credentials or elastic-credentials instead. You can list all secrets in your namespace with kubectl get secrets to find the exact name.

Once you have the password, log into Kibana using the username elastic and the password you retrieved. The Kibana URL is typically accessible through a Kubernetes service named kibana or through an ingress rule you configured.

Why Kubernetes uses a secret for the password

Storing the password in a Kubernetes secret keeps it out of your deployment files, which you might commit to version control or share with other team members. Secrets are base64-encoded by default and can be encrypted at rest if you configure your cluster to do so. This separation means the password is generated fresh each time you deploy, and you do not have to manage it manually.

The Elastic operator and Helm charts both follow this pattern because it is the standard Kubernetes way to handle sensitive data. If you need to change the password later, you can update the secret directly without redeploying Kibana.

Creating additional users instead of sharing the elastic account

The elastic user is powerful enough to delete data, change permissions, and shut down features. For that reason, many teams create separate user accounts for developers, analysts, and operators, each with only the permissions they need. This approach reduces the risk if a password is compromised and makes it easier to audit who did what in Kibana.

You create new users by logging into Kibana as elastic, navigating to Management > Users, and clicking Create User. You can assign roles like viewer, editor, or analyst, or create custom roles that restrict access to specific indices or spaces. Once the user is created, they can log in with their own username and password.

Changing the elastic password after deployment

If you need to change the elastic password, you can update the Kubernetes secret directly. First, generate a new password or decide what you want it to be. Then encode it in base64 and patch the secret:

kubectl patch secret elasticsearch-es-elastic-user -p '{"data":{"elastic":"'$(echo -n 'your-new-password' | base64)'"}}'

Replace your-new-password with the actual password you want to set. Elasticsearch and Kibana will recognize the change within a few seconds. You do not need to restart the pods.

What to do if you cannot find the secret

If the secret does not exist or you cannot retrieve it, the deployment may have failed or the Elastic operator may not be running. Check that the Elasticsearch pod is running by typing kubectl get pods and looking for a pod with elasticsearch in its name. If it is not running, describe the pod to see error messages: kubectl describe pod elasticsearch-es-0 (adjust the pod name as needed).

If Elasticsearch is running but the secret is missing, the operator may not have created it yet. Wait a minute and try again, or check the operator logs with kubectl logs -l app.kubernetes.io/name=elastic-operator. If you deployed with Helm instead of the operator, make sure the Helm chart version you used includes automatic secret generation.

Frequently Asked Questions

Can I set my own password instead of using the generated one?

Yes. You can create the secret yourself before deploying Kibana, or you can patch it afterward using kubectl. If you use the Elastic operator, you can specify a password in the Elasticsearch custom resource. Check the operator documentation for your version to see the exact syntax.

Is the elastic user the same across Elasticsearch and Kibana?

Yes. The elastic user exists in Elasticsearch, and Kibana uses it to authenticate. When you log into Kibana with the elastic username and password, Kibana sends those credentials to Elasticsearch to verify them. Creating a new user in Kibana actually creates it in Elasticsearch.

What happens if I delete the secret?

Kibana will not be able to start or authenticate users until the secret is restored. If you deleted it by accident, you can recreate it manually with a new password, or redeploy Kibana to have the operator generate a new one. Existing Kibana pods will fail to connect to Elasticsearch until the secret is available again.

Can I use a different username instead of elastic?

The elastic user is built into Elasticsearch and cannot be renamed or removed. You can create other users with different usernames and assign them permissions, but elastic is always the default superuser. Most teams use elastic only for setup and administration, then create custom users for regular work.