[Elasticsearch] Fix authentication failure when password contains YAML special characters

[maramos-elastic]

Summary

Fixes #18434

Passwords containing YAML special characters (e.g. double quotes ") cause 401 Unauthorized errors in all Elasticsearch metrics datasets because the compiled agent configuration strips those characters during YAML parsing.

Root cause

All 12 Elasticsearch metrics dataset stream templates used the bare Handlebars expression:

{{#if password}}
password: {{password}}
{{/if}}

When a password such as "mysecret" is rendered, the template produces:

password: "mysecret"

YAML treats the double quotes as string delimiters, so the parsed value is mysecret — the characters are silently dropped. The Beat then authenticates with a truncated password and receives a 401 Unauthorized response.

Fix

Replace {{password}} with {{escape_string password}} in all 12 metrics dataset stream templates:

• data_stream/cluster_stats/agent/stream/stream.yml.hbs
• data_stream/node_stats/agent/stream/stream.yml.hbs
• data_stream/node/agent/stream/stream.yml.hbs
• data_stream/index/agent/stream/stream.yml.hbs
• data_stream/index_recovery/agent/stream/stream.yml.hbs
• data_stream/index_summary/agent/stream/stream.yml.hbs
• data_stream/ccr/agent/stream/stream.yml.hbs
• data_stream/enrich/agent/stream/stream.yml.hbs
• data_stream/ingest_pipeline/agent/stream/stream.yml.hbs
• data_stream/ml_job/agent/stream/stream.yml.hbs
• data_stream/pending_tasks/agent/stream/stream.yml.hbs
• data_stream/shard/agent/stream/stream.yml.hbs

The escape_string helper (registered in Fleet's Handlebars engine) wraps the value in YAML single quotes and escapes any interior single quotes by doubling them — safely preserving all special characters including ", \, :, #, etc.

Before (password "mysecret" → stored as mysecret):

password: "mysecret"

After (password "mysecret" → stored correctly as "mysecret"):

password: '"mysecret"'

This pattern is already used correctly by other integrations for similar fields (e.g. ibmmq, apache_tomcat, websphere_application_server, cloudflare).

Testing

Configure an Elasticsearch integration policy with a password containing " characters and confirm the components-actual.yaml preserves the full password value, and that metrics collection succeeds without 401 errors.

Checklist

• I have reviewed the guidelines for contributing to this repository.
• I have verified that my code works as expected.
• I have incremented the package's version per the versioning guidelines and updated the changelog.
• I have updated the package's changelog.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 8307be9

Failed CI Steps

• Check integrations elasticsearch

History

cc @maramos-elastic