# Api key & error
**URL:** https://discuss.elastic.co/t/api-key-error/243873
**Category:** Beats
**Tags:** elastic-stack-security, docker
**Created:** [August 5, 2020, 1:38pm UTC](https://discuss.elastic.co/t/api-key-error/243873 "2020-08-05T13:38:30Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@maxxitutti](https://discuss.elastic.co/u/maxxitutti)
#### Post date: [August 5, 2020, 1:38pm UTC](https://discuss.elastic.co/t/api-key-error/243873/1 "2020-08-05T13:38:30Z")
Hello .
i am new with elk sollution co forgive me :).
i want to run my first beat on my remote machine ... from the begining i want to deploy api-key for my auditbeat.
according to documentation [https://www.elastic.co/guide/en/beats/auditbeat/current/beats-api-keys.html](https://www.elastic.co/guide/en/beats/auditbeat/current/beats-api-keys.html)
on my kibana i run (only):
```auto
POST /_security/api_key
{
"name": "auditbeat_host001",
"role_descriptors": {
"auditbeat_writer": {
"cluster": ["monitor", "read_ilm"],
"index": [
{
"names": ["auditbeat-*"],
"privileges": ["view_index_metadata", "create_doc"]
}
]
}
}
}
```
on my kibana on apikey i see:
auditbeat\_host001
elastic
reserved
August 5th 2020 15:15:14
Never
but on beat log i see:
Connection marked as failed because the onConnect callback failed: 403 Forbidden: {"error":{"root\_cause":[{"type":"security\_exception","reason":"action [cluster:admin/ilm/put] is unauthorized for API key id [0\_\_CvnMByUXjOQWk9Wum] of user [elastic]"}],"type":"security\_exception","reason":"action [cluster:admin/ilm/put] is unauthorized for API key id [0\_\_CvnMByUXjOQWk9Wum] of user [elastic]"},"status":403}
am i missing something ? second question it is ok that this api key is generated for user elastic ? ;/
thanks for advice ..
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [August 10, 2020, 1:17pm UTC](https://discuss.elastic.co/t/api-key-error/243873/2 "2020-08-10T13:17:48Z")
> [@maxxitutti](#):
>
> ```auto
> "cluster": ["monitor", "read_ilm"],
>
> ```
> [@](#):
>
> ```auto
> action [cluster:admin/ilm/put] is unauthorized for API key id [0__CvnMByUXjOQWk9Wum] of user [elastic]
>
> ```
`cluster:admin/ilm/put` is not a `read_ilm` action, it is part of `manage_ilm`.
Your beat is trying to configure ILM and the authorization system is preventing that (correctly) because your API Key is not permitted to update ILM policies.
---
### Author:  [@maxxitutti](https://discuss.elastic.co/u/maxxitutti)
#### Post date: [August 10, 2020, 3:27pm UTC](https://discuss.elastic.co/t/api-key-error/243873/3 "2020-08-10T15:27:26Z")
Thanks for your reply ... but tell me what exactly that mean ? This error occur when i run setup ( so the Dashboards is deployed into kibana ) - so this is ok ? Secondly on this credentials this beat should working but only for deploying the Dashboards i need to change credentials ?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [August 11, 2020, 2:01am UTC](https://discuss.elastic.co/t/api-key-error/243873/4 "2020-08-11T02:01:06Z")
I moved this to the `Beats` forum, because it actually about how to configure and run auditbeat.
The problem here is that you copied an example that configures an API key for [_publishing_](https://www.elastic.co/guide/en/beats/auditbeat/current/privileges-to-publish-events.html), but you
are trying to use it for [_setup_](https://www.elastic.co/guide/en/beats/auditbeat/current/privileges-to-setup-beats.html).
If you want the API key to be useful for beat setup, then you need to include the required setup privileges in the API key's roles.
---
### Author:  [@maxxitutti](https://discuss.elastic.co/u/maxxitutti)
#### Post date: [August 11, 2020, 7:38am UTC](https://discuss.elastic.co/t/api-key-error/243873/5 "2020-08-11T07:38:34Z")
ok ... as i understand the setup operation need more privileges (for deploying dashboards ) - it is clear ... but after when i deploy dashboards (used elastic user and password) i change the config file to use api-key ... and i still have
```auto
Aug 11 09:36:11 radius auditbeat: 2020-08-11T09:36:11.261+0200#011ERROR#011[publisher_pipeline_output]#011pipeline/output.go:155#011Failed to connect to backoff(elasticsearch(https://kibana-host.xxx.xxx:9200)): Connection marked as failed because the onConnect callback failed: failed to check for alias 'auditbeat-7.8.1': (status=403) : 403 Forbidden:
```
can you tell me how to fix it ? or what post i need to send to fix it ? .. ☹
---
### Author:  [@Robert\_Necela](https://discuss.elastic.co/u/Robert_Necela)
#### Post date: [August 19, 2020, 11:11am UTC](https://discuss.elastic.co/t/api-key-error/243873/6 "2020-08-19T11:11:48Z")
Hello Tim,
could you please provide how to create API key for setup? I found how to create API key for publishing here [https://www.elastic.co/guide/en/beats/auditbeat/master/beats-api-keys.html](https://www.elastic.co/guide/en/beats/auditbeat/master/beats-api-keys.html) .
Thank you
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 16, 2020, 11:12am UTC](https://discuss.elastic.co/t/api-key-error/243873/7 "2020-09-16T11:12:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.