elasticsearch username and password security

[ofcerci4826]

Hello,
How can Elasticsearch username and password be stored more securely outside of the environment variable?
thanks

[jertel]

ElastAlert 2 can read the ES credentials from the config.yml or from env vars. If you are using Kubernetes, the config file or env vars can be reconstructed from Kube Secrets. If you're not using Kubernetes, you can use a config.yml with permissions set to 600.

If you need more security beyond that, such as reading the credentials from a credential vault over the network, then you can create a custom front-end Python wrapper for the ElastAlert 2 module, and after init'ing the ElastAlert object, update the loaded config dict with the secure ES credentials. Then hand off the flow back to the ElastAlert module via obj.start(), where obj is the ElastAlert object.

Alternatively, you can submit a PR to this project, following the contribution guidelines located in the root of the project, where your PR introduces an alternative method of loading those credentials.