diff --git a/_meta/beat.yml b/_meta/beat.yml
index 407f95d379d..42571548f56 100644
--- a/_meta/beat.yml
+++ b/_meta/beat.yml
@@ -264,8 +264,11 @@ apm-server:
         # IPv6 addresses should always be defined as: `https://[2001:db8::1]:9200`.
         # hosts: ["localhost:9200"]
 
-        # Optional protocol and basic auth credentials.
+        # Protocol - either `http` (default) or `https`.
         #protocol: "https"
+
+        # Authentication credentials - either API key or username/password.
+        #api_key: "id:api_key"
         #username: "elastic"
         #password: "changeme"
 
@@ -513,8 +516,11 @@ output.elasticsearch:
   # Set gzip compression level.
   #compression_level: 0
 
-  # Optional protocol and basic auth credentials.
+  # Protocol - either `http` (default) or `https`.
   #protocol: "https"
+
+  # Authentication credentials - either API key or username/password.
+  #api_key: "id:api_key"
   #username: "elastic"
   #password: "changeme"
 
@@ -1014,10 +1020,13 @@ output.elasticsearch:
 # you can simply uncomment the following line.
 #monitoring.elasticsearch:
 
-  # Optional protocol and basic auth credentials.
+  # Protocol - either `http` (default) or `https`.
   #protocol: "https"
-  #username: "apm_system"
-  #password: ""
+
+  # Authentication credentials - either API key or username/password.
+  #api_key: "id:api_key"
+  #username: "elastic"
+  #password: "changeme"
 
   # Array of hosts to connect to.
   # Scheme and port can be left out and will be set to the default (`http` and `9200`).
diff --git a/apm-server.docker.yml b/apm-server.docker.yml
index fbcd71a4947..fdf51bfbd65 100644
--- a/apm-server.docker.yml
+++ b/apm-server.docker.yml
@@ -264,8 +264,11 @@ apm-server:
         # IPv6 addresses should always be defined as: `https://[2001:db8::1]:9200`.
         # hosts: ["localhost:9200"]
 
-        # Optional protocol and basic auth credentials.
+        # Protocol - either `http` (default) or `https`.
         #protocol: "https"
+
+        # Authentication credentials - either API key or username/password.
+        #api_key: "id:api_key"
         #username: "elastic"
         #password: "changeme"
 
@@ -513,8 +516,11 @@ output.elasticsearch:
   # Set gzip compression level.
   #compression_level: 0
 
-  # Optional protocol and basic auth credentials.
+  # Protocol - either `http` (default) or `https`.
   #protocol: "https"
+
+  # Authentication credentials - either API key or username/password.
+  #api_key: "id:api_key"
   #username: "elastic"
   #password: "changeme"
 
@@ -1014,10 +1020,13 @@ output.elasticsearch:
 # you can simply uncomment the following line.
 #monitoring.elasticsearch:
 
-  # Optional protocol and basic auth credentials.
+  # Protocol - either `http` (default) or `https`.
   #protocol: "https"
-  #username: "apm_system"
-  #password: ""
+
+  # Authentication credentials - either API key or username/password.
+  #api_key: "id:api_key"
+  #username: "elastic"
+  #password: "changeme"
 
   # Array of hosts to connect to.
   # Scheme and port can be left out and will be set to the default (`http` and `9200`).
diff --git a/apm-server.yml b/apm-server.yml
index cd9ebe676df..f25b5233433 100644
--- a/apm-server.yml
+++ b/apm-server.yml
@@ -264,8 +264,11 @@ apm-server:
         # IPv6 addresses should always be defined as: `https://[2001:db8::1]:9200`.
         # hosts: ["localhost:9200"]
 
-        # Optional protocol and basic auth credentials.
+        # Protocol - either `http` (default) or `https`.
         #protocol: "https"
+
+        # Authentication credentials - either API key or username/password.
+        #api_key: "id:api_key"
         #username: "elastic"
         #password: "changeme"
 
@@ -513,8 +516,11 @@ output.elasticsearch:
   # Set gzip compression level.
   #compression_level: 0
 
-  # Optional protocol and basic auth credentials.
+  # Protocol - either `http` (default) or `https`.
   #protocol: "https"
+
+  # Authentication credentials - either API key or username/password.
+  #api_key: "id:api_key"
   #username: "elastic"
   #password: "changeme"
 
@@ -1014,10 +1020,13 @@ output.elasticsearch:
 # you can simply uncomment the following line.
 #monitoring.elasticsearch:
 
-  # Optional protocol and basic auth credentials.
+  # Protocol - either `http` (default) or `https`.
   #protocol: "https"
-  #username: "apm_system"
-  #password: ""
+
+  # Authentication credentials - either API key or username/password.
+  #api_key: "id:api_key"
+  #username: "elastic"
+  #password: "changeme"
 
   # Array of hosts to connect to.
   # Scheme and port can be left out and will be set to the default (`http` and `9200`).
diff --git a/elasticsearch/client.go b/elasticsearch/client.go
index aadadfdfdf9..b63ecdc601d 100644
--- a/elasticsearch/client.go
+++ b/elasticsearch/client.go
@@ -19,6 +19,7 @@ package elasticsearch
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"io"
@@ -92,6 +93,9 @@ func NewClient(config *Config) (Client, error) {
 
 // NewVersionedClient returns the right elasticsearch client for the current Stack version, as an interface
 func NewVersionedClient(apikey, user, pwd string, addresses []string, transport http.RoundTripper) (Client, error) {
+	if apikey != "" {
+		apikey = base64.StdEncoding.EncodeToString([]byte(apikey))
+	}
 	version := common.MustNewVersion(version.GetDefaultVersion())
 	if version.IsMajor(8) {
 		c, err := newV8Client(apikey, user, pwd, addresses, transport)