diff --git a/charts/fluent-operator/templates/fluentbit-output-elasticsearch.yaml b/charts/fluent-operator/templates/fluentbit-output-elasticsearch.yaml
index 809d2e56b..571d0f3e2 100644
--- a/charts/fluent-operator/templates/fluentbit-output-elasticsearch.yaml
+++ b/charts/fluent-operator/templates/fluentbit-output-elasticsearch.yaml
@@ -24,10 +24,12 @@ spec:
     index: {{ . | quote }}
     {{- end }}
     {{- with .Values.fluentbit.output.es.httpUser }}
-    httpUser: {{ . | quote }}
+    httpUser: 
+      {{- toYaml . | nindent 6 }}
     {{- end }}
     {{- with .Values.fluentbit.output.es.httpPassword }}
-    httpPassword: {{ . | quote }}
+    httpPassword: 
+      {{- toYaml . | nindent 6 }}
     {{- end }}
     logstashFormat: {{ .Values.fluentbit.output.es.logstashFormat | default true }}
     {{- with .Values.fluentbit.output.es.logstashPrefix }}
diff --git a/charts/fluent-operator/values.yaml b/charts/fluent-operator/values.yaml
index 595349b5b..891b15ad8 100644
--- a/charts/fluent-operator/values.yaml
+++ b/charts/fluent-operator/values.yaml
@@ -305,26 +305,33 @@ fluentbit:
       logstashPrefix: ks-logstash-log
       bufferSize: 20MB
       traceError: true
-    #      logstashPrefixKey: ks-logstash-log
-    #      suppressTypeName: "On"
-    #      path: ""
-    #      bufferSize: "4KB"
-    #      index: "fluent-bit"
-    #      httpUser:
-    #      httpPassword:
-    #      logstashFormat: true
-    #      replaceDots: false
-    #      writeOperation: upsert
-    #      tls:
-    #        enable: false
-    #        verify: On
-    #        debug: 1
-    #        caFile: "<Absolute path to CA certificate file>"
-    #        caPath: "<Absolute path to scan for certificate files>"
-    #        crtFile: "<Absolute path to private Key file>"
-    #        keyFile: "<Absolute path to private Key file>"
-    #        keyPassword:
-    #        vhost: "<Hostname to be used for TLS SNI extension>"
+      # logstashPrefixKey: ks-logstash-log
+      # suppressTypeName: "On"
+      # path: ""
+      # index: "fluent-bit"
+      # httpUser:
+      #   valueFrom:
+      #     secretKeyRef:
+      #       key: value
+      #       name: husersecret
+      # httpPassword:
+      #   valueFrom:
+      #     secretKeyRef:
+      #       key: value
+      #       name: hpasssecret
+      # logstashFormat: true
+      # replaceDots: false
+      # writeOperation: upsert
+      # tls:
+      #   enable: false
+      #   verify: On
+      #   debug: 1
+      #   caFile: "<Absolute path to CA certificate file>"
+      #   caPath: "<Absolute path to scan for certificate files>"
+      #   crtFile: "<Absolute path to private Key file>"
+      #   keyFile: "<Absolute path to private Key file>"
+      #   keyPassword:
+      #   vhost: "<Hostname to be used for TLS SNI extension>"
     kafka:
       enable: false
       logLevel: info
@@ -351,11 +358,11 @@ fluentbit:
     # See https://docs.fluentbit.io/manual/pipeline/outputs/loki
     loki:
       # Switch for generation of fluentbit loki ClusterOutput (and loki basic auth http user and pass secrets if required)
-      enable: false  # Bool
+      enable: false # Bool
       retryLimit: "no_limits"
       logLevel: "info"
-      host: 127.0.0.1  # String
-      port: 3100  # Int
+      host: 127.0.0.1 # String
+      port: 3100 # Int
       # Either, give http{User,Password},tenantID string values specifying them directly
       httpUser: myuser
       httpPassword: mypass