I would say go ahead and save all this information in ElasticSearch ONLY if you can somehow protect the database. AFAIK, ES does not support any method of protecting the application with authentication, keys, etc. Therefore, if you cannot protect this data, you do not want to post any data for logging in.
In my application, I blocked port access for my ES instance only on localhost. I then built on top of the service layer in ES node.js . All my authentication is processed before I get to the data layer.
ES , , . , "_source". , , , , - , .