diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1db71c7..90b669ae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ The **patch** part changes incrementally at each release.
 ## [Unreleased]
 
 ### Added
+* metricbeat: new variables to configure elasticsearch hosts and auth
 
 ### Changed
 
diff --git a/metricbeat/defaults/main.yml b/metricbeat/defaults/main.yml
index fc833c4f..28b7e084 100644
--- a/metricbeat/defaults/main.yml
+++ b/metricbeat/defaults/main.yml
@@ -1,2 +1,7 @@
 ---
 elastic_stack_version: "6.x"
+
+metricbeat_elasticsearch_hosts:
+  - "localhost:9200"
+metricbeat_elasticsearch_auth_username: ""
+metricbeat_elasticsearch_auth_password: ""
diff --git a/metricbeat/tasks/main.yml b/metricbeat/tasks/main.yml
index 07ffb67a..94c75614 100644
--- a/metricbeat/tasks/main.yml
+++ b/metricbeat/tasks/main.yml
@@ -39,3 +39,27 @@
   systemd:
     name: metricbeat
     enabled: yes
+
+- name: Metricbeat knows where to find Elasticsearch
+  lineinfile:
+    dest: /etc/metricbeat/metricbeat.yml
+    regexp: '^  hosts: .*'
+    line: "  hosts: [\"{{ metricbeat_elasticsearch_hosts | join('\", \"') }}\"]"
+    insertafter: "output.elasticsearch:"
+  notify: restart metricbeat
+  when:
+    - metricbeat_elasticsearch_hosts
+
+- name: Metricbeat auth/username for Elasticsearch are configured
+  lineinfile:
+    dest: /etc/metricbeat/metricbeat.yml
+    regexp: '{{ item.regexp }}'
+    line: '{{ item.line }}'
+    insertafter: "output.elasticsearch:"
+  with_items:
+    - { regexp: '^  #username: .*', line: '  username: "{{ metricbeat_elasticsearch_auth_username }}"' }
+    - { regexp: '^  #password: .*', line: '  password: "{{ metricbeat_elasticsearch_auth_password }}"' }
+  notify: restart metricbeat
+  when:
+    - metricbeat_elasticsearch_auth_username != ""
+    - metricbeat_elasticsearch_auth_password != ""