# Why metricbeat is not picking up keystore entries?
**URL:** https://discuss.elastic.co/t/why-metricbeat-is-not-picking-up-keystore-entries/256011
**Category:** Beats
**Tags:** elastic-stack-security, metricbeat
**Created:** [November 19, 2020, 3:30pm UTC](https://discuss.elastic.co/t/why-metricbeat-is-not-picking-up-keystore-entries/256011 "2020-11-19T15:30:14Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [November 19, 2020, 3:30pm UTC](https://discuss.elastic.co/t/why-metricbeat-is-not-picking-up-keystore-entries/256011/1 "2020-11-19T15:30:14Z")
Hi,
I am using elastic stack 7.9. I have a 3 node cluster and https is I have created certificates using `elasticsearch-certutil` command, which are generic, and I am using it across all nodes. I have the below files;
1. `elastic-stack-ca.p12` (common for all nodes)
2. `elastic-certificates.p12` (common for all nodes)
3. `http.p12` (for https)
4. `elasticsearch-ca.pem` (for kibana)
Now, I am trying to integrate metricbeat. I have provided the below entries in metricbeat keystore;
```
setup.kibana.username
setup.kibana.password
output.elasticsearch.username
output.elasticsearch.password
monitoring.elasticsearch.username
monitoring.elasticsearch.password
```
When I try to setup metricbeat, using the command `metricbeat setup -e`, I am getting the below error;
```
2020-11-19T13:33:11.161Z ERROR [esclientleg] eslegclient/connection.go:261 error connecting to Elasticsearch at https://192.168.1.1:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}
2020-11-19T13:33:11.175Z ERROR [esclientleg] eslegclient/connection.go:261 error connecting to Elasticsearch at https://192.168.1.2:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}
2020-11-19T13:33:11.187Z ERROR [esclientleg] eslegclient/connection.go:261 error connecting to Elasticsearch at https://192.168.1.3:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}
2020-11-19T13:33:11.187Z ERROR instance/beat.go:951 Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://192.168.1.1:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401} error connecting to Elasticsearch at https://192.168.1.2:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401} error connecting to Elasticsearch at https://192.168.1.3:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}]
Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://192.168.1.1:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401} error connecting to Elasticsearch at https://192.168.1.2:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401} error connecting to Elasticsearch at https://192.168.1.3:9200: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}]
```
But, if I provide;
```
output.elasticsearch:
username: "elastic"
password: "password"
```
This works like charm. Why is this happening? Is there anywhere should I mention the `p12` files?
Thanks.
---
### Author:  [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [November 20, 2020, 5:20am UTC](https://discuss.elastic.co/t/why-metricbeat-is-not-picking-up-keystore-entries/256011/2 "2020-11-20T05:20:05Z")
Hello,
Beats do not automatically check for settings in keystore as ElasticSearch does. To solve your problem you need to add the settings to your yml file and reference the keys from your keystore:
```auto
output.elasticsearch:
username: "${output.elasticsearch.username}"
password: "${output.elasticsearch.password}"
```
I prefer this way over the ElasticSearch way as it is more readable (you do not have to assume that settings missing here are stored in the keystore) and you can rename the keys in the keystore to better describer what they contain(e.g. `output.prod-cluster-1.username` instead of`output.elasticsearch.username`).
Best regards
Wolfram
---
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [November 20, 2020, 11:19am UTC](https://discuss.elastic.co/t/why-metricbeat-is-not-picking-up-keystore-entries/256011/3 "2020-11-20T11:19:10Z")
Hi @Wolfram_Haussig , thank you for your time.
This is really helpful information and a handy tip as well. 🙂 👍
It works!
Best regards,
Alfred
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 18, 2020, 1:19pm UTC](https://discuss.elastic.co/t/why-metricbeat-is-not-picking-up-keystore-entries/256011/4 "2020-12-18T13:19:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.