# Logstash: Variable substitution FAILS for "api\_key" in elasticsearch output
**URL:** https://discuss.elastic.co/t/logstash-variable-substitution-fails-for-api-key-in-elasticsearch-output/315339
**Category:** Logstash
**Tags:** elastic-stack-security
**Created:** [September 28, 2022, 9:05am UTC](https://discuss.elastic.co/t/logstash-variable-substitution-fails-for-api-key-in-elasticsearch-output/315339 "2022-09-28T09:05:42Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@George\_Kossionis](https://discuss.elastic.co/u/George_Kossionis)
#### Post date: [September 28, 2022, 9:05am UTC](https://discuss.elastic.co/t/logstash-variable-substitution-fails-for-api-key-in-elasticsearch-output/315339/1 "2022-09-28T09:05:42Z")
Hello,
I have configured logstash to use logstash.keystore to store secure credentials.
The ${ES\_PASSWD} substitutions are working perfectly on the following configuration:
```auto
elasticsearch {
...
user => "elastic"
password => "${ES_PASSWD}"
ssl => true
ssl_certificate_verification => true
...
}
```
But when I am trying to use a secure keystore variable for **api\_key** it doesn't get replaced/substituted with the value inside the secret store:
```auto
elasticsearch {
...
api_key => "${ES_API_KEY_SECRET}"
ssl => true
ssl_certificate_verification => true
...
}
```
Obviously the secret api key value is correct because when I use it as plaintext it works like a charm.
Is there any reason that vars from logstash.keystore are not replaced inside the api\_key attribute?
I am using logstash 8.4.1.1 on RHEL 8.6.
Any input is much appreciated.
Logstash Secure Keystore procedure followed: [Secrets keystore for secure settings | Logstash Reference [8.4] | Elastic](https://www.elastic.co/guide/en/logstash/current/keystore.html)
Thank you,
Georgios
---
### Author:  [@George\_Kossionis](https://discuss.elastic.co/u/George_Kossionis)
#### Post date: [September 29, 2022, 10:29am UTC](https://discuss.elastic.co/t/logstash-variable-substitution-fails-for-api-key-in-elasticsearch-output/315339/2 "2022-09-29T10:29:14Z")
Problem resolved. Passwd had ' at the end dispite the fact we didn't put it in there. We reset tha passwd on the keystore and it worked.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 27, 2022, 10:29am UTC](https://discuss.elastic.co/t/logstash-variable-substitution-fails-for-api-key-in-elasticsearch-output/315339/3 "2022-10-27T10:29:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.