# Api Key Help

**URL:** <https://discuss.elastic.co/t/api-key-help/262576>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [January 28, 2021, 10:34pm UTC](https://discuss.elastic.co/t/api-key-help/262576 "2021-01-28T22:34:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ukuleleplayer](https://avatars.discourse-cdn.com/v4/letter/u/7c8e57/32.png) [@ukuleleplayer](https://discuss.elastic.co/u/ukuleleplayer)\
**Post date:** [January 28, 2021, 10:34pm UTC](https://discuss.elastic.co/t/api-key-help/262576/1 "2021-01-28T22:34:48Z")

</div>

I apologize in advance, I'm new to auditbeat and could use some help.

Basically, I'm trying to get just system logs from machines I'm monitoring. I previously had this working by just putting **cloud.id** and **cloud.auth** into the default auditbeat.yml. But now, I'm trying to replace **cloud.auth** with an api-key. So, I removed the **cloud.auth** line, and went to this link:

> **[Grant access using API keys | Auditbeat Reference \[master\] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/master/beats-api-keys.html)**

and generated an api key for monitoring. So, I put the api key into auditbeat.yml in the **output.elasticsearch** section, and in **monitoring.elasticsearch**. First it gave me an error that it said

**"Overwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling.", "stdout\_lines": ["Overwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling."**

So , set setup.ilm.overwrite to true, but now it's giving me 403 errors, saying that the user:

**is unauthorized for API key id [] of user [123456789]"},"status":403**

Any help and advice of what I'm doing wrong would be great.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2021, 12:35am UTC](https://discuss.elastic.co/t/api-key-help/262576/2 "2021-02-26T00:35:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.