how to change default elastic user's password

[bosbill88]

I forgot what was the user "elastic" password.  Can someone please tell me how to go about change the password?  I have tried the default "changeme" and it fails.  thanks

[Camila Salome Romero]

Hello! I hope you are well!

If you want to get it back your password you can check the Filebeat configuration file located in /etc/filebeat/filebeat.yml. This file contains the information about the username and password to connect with Elasticsearch.

But if you want to change the password or username of Elasticsearch you need to follow these steps:

Download script wazuh-passwords-tool.sh:

curl -so wazuh-passwords-tool.sh https://packages.wazuh.com/resources/4.2/open-distro/tools/wazuh-passwords-tool.sh

Run the script:

bash wazuh-passwords-tool.sh -u admin -p mypassword

The password may need to be updated in both /var/ossec/etc/filebeat/filebeat.yml and /var/ossec/etc/kibana/kibana.yml. After changing the configuration files, remember to restart the corresponding services.

I hope this helps you!

Regards, Camila!

​