title: Where does Elaticsearch take the elasticsearch-keystore password from?
body: <p>I've been reading the little <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/elasticsearch-keystore.html" rel="nofollow noreferrer">documentation Elastic provides</a>, but it is just about how to operate it. And I don't really understand the fundamentals of it.</p>
  <ol>
  <li>You initialise the keystore with a password: <code>bin/elasticsearch-keystore passwd</code></li>
  <li>You add a key-value to it <code>bin/elasticsearch-keystore add mySecret</code> (prompts for secret)</li>
  <li>You refer to the key inside elasticsearch.yml i.e. <code>${mySecret}</code></li>
  <li>Start Elasticsearch, and the value is magically extracted and replaced from the keystore.</li>
  </ol>
  <p>My doubt is: how does Elasticsearch get the password to decrypt the keystore and use the values in the configuration file? Or is the keystore password stored somewhere?</p>
  <p>If yes, where? In this case I don't see the benefit of using keystore at all?</p>