# Unable to find apikey warning

**URL:** <https://discuss.elastic.co/t/unable-to-find-apikey-warning/335956>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 14, 2023, 8:55am UTC](https://discuss.elastic.co/t/unable-to-find-apikey-warning/335956 "2023-06-14T08:55:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\
**Post date:** [June 14, 2023, 8:55am UTC](https://discuss.elastic.co/t/unable-to-find-apikey-warning/335956/1 "2023-06-14T08:55:11Z")

</div>

Hello,  
for the info my cluster is on version 7.17.4 and it's based on 3 nodes that are all master eligible and data nodes.

I keep getting this warning on my master node logs non-stop,  
`[2023-06-13T15:44:07,212][WARN][o.e.x.s.a.ApiKeyAuthenticator] [node2] Authentication using apikey failed - unable to find apikey with id <id>`

To troubleshoot i used `GET /_security/api_key?id=<id>` API and effectively there were no key with the specified id.

What could happened to make this id disapear and what is the proper fix to this warnings ?

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [June 15, 2023, 4:57am UTC](https://discuss.elastic.co/t/unable-to-find-apikey-warning/335956/2 "2023-06-15T04:57:16Z")

</div>

Most likely someone or some process invalidate the API key and Elasticsearch subsequent removed it (the system automatically removes invalidated and expired keys after some retention time).

To fix, you'll need find out what process is using the API key and issue a new API key to it so that it can stop using the non-existing key.

---

<div class="post-metadata">

**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\
**Post date:** [June 15, 2023, 8:27am UTC](https://discuss.elastic.co/t/unable-to-find-apikey-warning/335956/3 "2023-06-15T08:27:14Z")

</div>

Thank you @Yang_Wang, I tried to take this approach but I wasn't able to find out the service using this apikey. is there any way to find out ?  
The only infromation I'm getting is this warning and it's happening very repeatedly (every 5 seconds or so).

I would like to know at least all process that use apikey by default, maybe it would help find an anomaly with one of them or maybe when listing apikeys I find someone missing.

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [June 19, 2023, 3:59am UTC](https://discuss.elastic.co/t/unable-to-find-apikey-warning/335956/4 "2023-06-19T03:59:38Z")

</div>

Please refer to this reply and see if it helps

> [@Authentication using apikey failed](https://discuss.elastic.co/t/authentication-using-apikey-failed/333244/5):
>
> In that case, you can try HttpTracer which will report the remote address of each request. PUT \_cluster/settings { "persistent" : { "logger.org.elasticsearch.http.HttpTracer" : "TRACE" } } The logs will get quite verbose. You should see something like the follows for the failed API key authentication received request from [Netty4HttpChannel{localAddress=/[0:0:0:0:0:0:0:1]:9200, remoteAddress=/[0:0:0:0:0:0:0:1]:53497}]org.elasticsearch.http.HttpHeadersValidationException: org.ela…

---

<div class="post-metadata">

**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\
**Post date:** [June 19, 2023, 1:41pm UTC](https://discuss.elastic.co/t/unable-to-find-apikey-warning/335956/5 "2023-06-19T13:41:05Z")

</div>

Thank you. I will try this config asap

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2023, 1:41pm UTC](https://discuss.elastic.co/t/unable-to-find-apikey-warning/335956/6 "2023-07-17T13:41:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.