# Constant API Key Failures in Logs after enabling security

**URL:** <https://discuss.elastic.co/t/constant-api-key-failures-in-logs-after-enabling-security/286668>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 14, 2021, 3:39am UTC](https://discuss.elastic.co/t/constant-api-key-failures-in-logs-after-enabling-security/286668 "2021-10-14T03:39:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Heroj04](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/heroj04/32/92734_2.png) [@Heroj04](https://discuss.elastic.co/u/Heroj04)\
**Post date:** [October 14, 2021, 3:39am UTC](https://discuss.elastic.co/t/constant-api-key-failures-in-logs-after-enabling-security/286668/1 "2021-10-14T03:39:06Z")

</div>

Just recently set up an Elasticsearch server. after enabling security and SSL I am seeing just constant apikey errors in the logs.  
Even if I shut down all other parts of the system (kibana/beats/fleet) they are still coming through.  
with several different keys too.  
Any idea what this could be or how I can see what host the connection is coming from.

```auto
14:01:14.879
elasticsearch.server
[elasticsearch.server][WARN] Authentication using apikey failed - unable to find apikey with id <keyRemoved>
14:01:14.879
elasticsearch.server
[elasticsearch.server][WARN] Authentication using apikey failed - unable to find apikey with id <keyRemoved>
14:01:15.010
elasticsearch.server
[elasticsearch.server][WARN] Authentication using apikey failed - unable to find apikey with id <keyRemoved>
14:01:15.010
elasticsearch.server
[elasticsearch.server][WARN] Authentication using apikey failed - unable to find apikey with id <keyRemoved>

```

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [October 14, 2021, 4:16am UTC](https://discuss.elastic.co/t/constant-api-key-failures-in-logs-after-enabling-security/286668/2 "2021-10-14T04:16:38Z")

</div>

You can check the source IP in [audit logs](https://www.elastic.co/guide/en/elasticsearch/reference/current/enable-audit-logging.html) if the cluster license is Gold+ (or Trial).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 11, 2021, 4:17am UTC](https://discuss.elastic.co/t/constant-api-key-failures-in-logs-after-enabling-security/286668/3 "2021-11-11T04:17:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.