. If {es} and {kib} are secured, set credentials in the +{beatname_lc}.yml+ config
file before you run the commands that set up and start {beatname_uc}.

* If you're running our
https://www.elastic.co/cloud/elasticsearch-service[hosted {es} Service]
on Elastic Cloud, specify your <<configure-cloud-id,cloud auth>> credentials.
For example:
+
["source","yaml",subs="attributes"]
----------------------------------------------------------------------
cloud.auth: "elastic:{pwd}"
----------------------------------------------------------------------

* If you're running {es} on your own hardware, specify your {es} and {kib}
credentials:
+
["source","yaml",subs="attributes"]
----
output.elasticsearch:
  hosts: ["myEShost:9200"]
  username: "filebeat_internal"
  password: "{pwd}" <1>
setup.kibana:
  host: "mykibanahost:5601"
  username: "my_kibana_user" <2> <3>
  password: "{pwd}"
----
<1> This examples shows a hard-coded password, but you should store sensitive
values in the <<keystore,secrets keystore>>.
<2> The `username` and `password` settings for {kib} are optional. If you don't
specify credentials for {kib}, {beatname_uc} uses the `username` and `password`
specified for the {es} output.
<3> If you are planning to <<load-kibana-dashboards,set up the {kib} dashboards>>,
the user must have the `kibana_user`
{xpack-ref}/built-in-roles.html[built-in role] or equivalent privileges.
+
For more information, see <<securing-{beatname_lc}>>.