diff --git a/auditbeat/auditbeat.reference.yml b/auditbeat/auditbeat.reference.yml
index 8f684d78d03..5927a95f067 100644
--- a/auditbeat/auditbeat.reference.yml
+++ b/auditbeat/auditbeat.reference.yml
@@ -477,7 +477,7 @@ output.elasticsearch:
 
   # Authentication credentials - either API key or username/password.
   #api_key: "id:api_key"
-  #username: "elastic"
+  #username: "username"
   #password: "changeme"
 
   # Dictionary of HTTP parameters to pass within the URL with index operations.
@@ -1405,7 +1405,7 @@ setup.kibana:
 
   # Optional protocol and basic auth credentials.
   #protocol: "https"
-  #username: "elastic"
+  #username: "username"
   #password: "changeme"
 
   # Optional HTTP path
diff --git a/auditbeat/auditbeat.yml b/auditbeat/auditbeat.yml
index eb87fec7e7e..50dc18f2df2 100644
--- a/auditbeat/auditbeat.yml
+++ b/auditbeat/auditbeat.yml
@@ -130,7 +130,7 @@ output.elasticsearch:
 
   # Authentication credentials - either API key or username/password.
   #api_key: "id:api_key"
-  #username: "elastic"
+  #username: "username"
   #password: "changeme"
 
 # ------------------------------ Logstash Output -------------------------------
diff --git a/deploy/cloudfoundry/filebeat/filebeat.yml b/deploy/cloudfoundry/filebeat/filebeat.yml
index f3d58f079a1..e203e5a23f1 100644
--- a/deploy/cloudfoundry/filebeat/filebeat.yml
+++ b/deploy/cloudfoundry/filebeat/filebeat.yml
@@ -30,7 +30,7 @@ output.elasticsearch:
 
   # Authentication credentials - either API key or username/password.
   #api_key: "id:api_key"
-  #username: "elastic"
+  #username: "username"
   #password: "changeme"
 
 #----------------------------- Elastic Cloud ----------------------------------
diff --git a/deploy/cloudfoundry/metricbeat/metricbeat.yml b/deploy/cloudfoundry/metricbeat/metricbeat.yml
index 12cfee75f00..47fe03f8751 100644
--- a/deploy/cloudfoundry/metricbeat/metricbeat.yml
+++ b/deploy/cloudfoundry/metricbeat/metricbeat.yml
@@ -30,7 +30,7 @@ output.elasticsearch:
 
   # Authentication credentials - either API key or username/password.
   #api_key: "id:api_key"
-  #username: "elastic"
+  #username: "username"
   #password: "changeme"
 
 #----------------------------- Elastic Cloud ----------------------------------
diff --git a/dev-tools/packaging/files/ironbank/auditbeat/config/auditbeat.yml b/dev-tools/packaging/files/ironbank/auditbeat/config/auditbeat.yml
index 5e18b623d32..741f3dc7b0e 100644
--- a/dev-tools/packaging/files/ironbank/auditbeat/config/auditbeat.yml
+++ b/dev-tools/packaging/files/ironbank/auditbeat/config/auditbeat.yml
@@ -153,7 +153,7 @@ output.elasticsearch:
 
   # Authentication credentials - either API key or username/password.
   #api_key: "id:api_key"
-  #username: "elastic"
+  #username: "username"
   #password: "changeme"
 
 # ------------------------------ Logstash Output -------------------------------
diff --git a/filebeat/filebeat.reference.yml b/filebeat/filebeat.reference.yml
index 55b0290e21c..9c987680eaf 100644
--- a/filebeat/filebeat.reference.yml
+++ b/filebeat/filebeat.reference.yml
@@ -1567,7 +1567,7 @@ output.elasticsearch:
 
   # Authentication credentials - either API key or username/password.
   #api_key: "id:api_key"
-  #username: "elastic"
+  #username: "username"
   #password: "changeme"
 
   # Dictionary of HTTP parameters to pass within the URL with index operations.
@@ -2495,7 +2495,7 @@ setup.kibana:
 
   # Optional protocol and basic auth credentials.
   #protocol: "https"
-  #username: "elastic"
+  #username: "username"
   #password: "changeme"
 
   # Optional HTTP path
diff --git a/filebeat/filebeat.yml b/filebeat/filebeat.yml
index aa50779b922..5824b80ed37 100644
--- a/filebeat/filebeat.yml
+++ b/filebeat/filebeat.yml
@@ -149,7 +149,7 @@ output.elasticsearch:
 
   # Authentication credentials - either API key or username/password.
   #api_key: "id:api_key"
-  #username: "elastic"
+  #username: "username"
   #password: "changeme"
 
 # ------------------------------ Logstash Output -------------------------------