Internal users
These users are designed for internal use by Elasticsearch only. Authenticating with these users is not supported.
The Elastic Stack security features use eight internal users (_system, _xpack, _xpack_security, _async_search, _security_profile, _data_stream_lifecycle, _synonyms and _storage), which are responsible for the operations that take place inside an Elasticsearch cluster.
These users are only used by requests that originate from within the cluster. For this reason, they cannot be used to authenticate against the API and there is no password to manage or reset.
From time-to-time you may find a reference to one of these users inside your logs, including audit logs.
© 2023-2025 Elasticsearch
As of September 2024, Elasticsearch is available under a choice of three licenses: the Server Side Public License (SSPL), the Elastic License, or the AGPLv3 (OSI approved).
Elasticsearch and the Elasticsearch logo are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries.
https://www.elastic.co/guide/en/elasticsearch/reference/8.17/internal-users.html
