# Heartbeat: Locking-Down Heartbeat and Beats when "HTTP Endpoint" is Enabled on the Beats?

**URL:** <https://discuss.elastic.co/t/heartbeat-locking-down-heartbeat-and-beats-when-http-endpoint-is-enabled-on-the-beats/278292>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [July 9, 2021, 4:29pm UTC](https://discuss.elastic.co/t/heartbeat-locking-down-heartbeat-and-beats-when-http-endpoint-is-enabled-on-the-beats/278292 "2021-07-09T16:29:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Log\_Gobbler](https://avatars.discourse-cdn.com/v4/letter/l/a183cd/32.png) [@Log\_Gobbler](https://discuss.elastic.co/u/Log_Gobbler)\
**Post date:** [July 9, 2021, 4:29pm UTC](https://discuss.elastic.co/t/heartbeat-locking-down-heartbeat-and-beats-when-http-endpoint-is-enabled-on-the-beats/278292/1 "2021-07-09T16:29:59Z")

</div>

I have a test Heartbeat and test Filebeat (with "HTTP Endpoint" enabled) set-up and working (via Uptime) but they do not have security features enabled/configured _between them_.

I've stored the credentials in the Heartbeat's keystore, so they can be retrieved and used to authenticate to the Filebeat. However, how do you store and configure the same on the Filebeat side (with "HTTP Endpoint" enabled) _so that the Filebeat can "allow" or "deny" the authentication attempts made by the Heartbeat_?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2021, 6:30pm UTC](https://discuss.elastic.co/t/heartbeat-locking-down-heartbeat-and-beats-when-http-endpoint-is-enabled-on-the-beats/278292/2 "2021-08-06T18:30:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.