diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e7fe10f..56758994 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,10 +22,11 @@ The **patch** part changes incrementally at each release.
 * redis: distinction between main and master password
 
 ### Fixed
+* metricbeat: fix username/password replacement
+* nagios-nrpe: check_process now return the error code (making the check more usefull than /bin/true)
 * nginx: Munin url config is now a template to insert the server-status prefix
 * redis: In instance mode, ensure to replace the nrpe check_redis with the instance check script
 * redis: Don't set the owner of /var/{lib,log}/redis to a redis instance account
-* nagios-nrpe: check_process now return the error code (making the check more usefull than /bin/true)
 
 ### Security
 
diff --git a/metricbeat/tasks/main.yml b/metricbeat/tasks/main.yml
index 94c75614..3e7fbea7 100644
--- a/metricbeat/tasks/main.yml
+++ b/metricbeat/tasks/main.yml
@@ -57,8 +57,8 @@
     line: '{{ item.line }}'
     insertafter: "output.elasticsearch:"
   with_items:
-    - { regexp: '^  #username: .*', line: '  username: "{{ metricbeat_elasticsearch_auth_username }}"' }
-    - { regexp: '^  #password: .*', line: '  password: "{{ metricbeat_elasticsearch_auth_password }}"' }
+    - { regexp: '^  #?username: .*', line: '  username: "{{ metricbeat_elasticsearch_auth_username }}"' }
+    - { regexp: '^  #?password: .*', line: '  password: "{{ metricbeat_elasticsearch_auth_password }}"' }
   notify: restart metricbeat
   when:
     - metricbeat_elasticsearch_auth_username != ""