# Unable to collect Windows logs through WinLogBeat & ElasticSearch 7.17

**URL:** <https://discuss.elastic.co/t/unable-to-collect-windows-logs-through-winlogbeat-elasticsearch-7-17/318897>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [November 14, 2022, 7:07pm UTC](https://discuss.elastic.co/t/unable-to-collect-windows-logs-through-winlogbeat-elasticsearch-7-17/318897 "2022-11-14T19:07:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tranceptor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tranceptor/32/113346_2.png) [@tranceptor](https://discuss.elastic.co/u/tranceptor)\
**Post date:** [November 14, 2022, 7:07pm UTC](https://discuss.elastic.co/t/unable-to-collect-windows-logs-through-winlogbeat-elasticsearch-7-17/318897/1 "2022-11-14T19:07:41Z")

</div>

Hello, I've just installed GrayLog + Elasticsearch and I need to collect Windows logs from a Windows machine. I installed WinLogBeat following this instructions: [[Grant access using API keys | Winlogbeat Reference [8.5] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/beats-api-keys.html)]([https://Create](https://Create) an API key for publishing).  
But when I try to run curl to set the API key:

```auto
curl -X POST "localhost:9200/_security/api_key?pretty" -H 'Content-Type: application/json' -d'
{
  "name": "winlogbeat_host001", 
  "role_descriptors": {
    "winlogbeat_writer": { 
      "cluster": ["monitor", "read_ilm", "read_pipeline"],
      "index": [
        {
          "names": ["winlogbeat-*"],
          "privileges": ["view_index_metadata", "create_doc"]
        }
      ]
    }
  }
}
'

```

I get the following error:

```auto
  "error" : {
    "root_cause" : [
      {
        "type" : "index_not_found_exception",
        "reason" : "no such index [_security]",
        "resource.type" : "index_expression",
        "resource.id" : "_security",
        "index_uuid" : "_na_",
        "index" : "_security"
      }
    ],
    "type" : "index_not_found_exception",
    "reason" : "no such index [_security]",
    "resource.type" : "index_expression",
    "resource.id" : "_security",
    "index_uuid" : "_na_",
    "index" : "_security"
  },
  "status" : 404
}

```

I faithfully followed the installation instructions on graylog pages: [Debian installation - Installing Graylog](https://docs.graylog.org/docs/debian)  
My o.s.: Debian 11.5 - Elasticsearch-Oss v. 7.17 - GrayLog v. 4.3

I didn't delete or uninstall anything. It's a fresh installation.  
Thank you all

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2022, 7:08pm UTC](https://discuss.elastic.co/t/unable-to-collect-windows-logs-through-winlogbeat-elasticsearch-7-17/318897/2 "2022-12-12T19:08:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.