# Winlogbeat Secrets Key Store
**URL:** https://discuss.elastic.co/t/winlogbeat-secrets-key-store/276457
**Category:** Beats
**Tags:** winlogbeat
**Created:** [June 20, 2021, 8:22am UTC](https://discuss.elastic.co/t/winlogbeat-secrets-key-store/276457 "2021-06-20T08:22:41Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@inf](https://discuss.elastic.co/u/inf)
#### Post date: [June 20, 2021, 8:22am UTC](https://discuss.elastic.co/t/winlogbeat-secrets-key-store/276457/1 "2021-06-20T08:22:41Z")
Hi there!
(Reference link that I used for what I tried: [Secrets keystore for secure settings](https://www.elastic.co/guide/en/beats/winlogbeat/current/keystore.html))
Here's with I did to setup my Winlogbeat's communication with Elasticsearch, with the use of an API key (instead of credentials).
These commands are executed in an high-integrity PowerShell:
Confirm that the keystore is empty/not created:
`.'C:\Program Files\Elastic\Winlogbeat\winlogbeat.exe' -c 'C:\Program Files\Elastic\Winlogbeat\winlogbeat.yml' keystore list`
Create the keystore:
`.'C:\Program Files\Elastic\Winlogbeat\winlogbeat.exe' -c 'C:\Program Files\Elastic\Winlogbeat\winlogbeat.yml' keystore create`
Add key to the keystore:
`.'C:\Program Files\Elastic\Winlogbeat\winlogbeat.exe' -c 'C:\Program Files\Elastic\Winlogbeat\winlogbeat.yml' keystore add ES_API`
`[API_key_string_placeholder]`
Confirm that the key was successfully added to the keystore:
`.'C:\Program Files\Elastic\Winlogbeat\winlogbeat.exe' -c 'C:\Program Files\Elastic\Winlogbeat\winlogbeat.yml' keystore list`
Next, I replaced the following in my `winlogbeat.yml`:
Original:
`output.elasticsearch.api_key: [API_key_string_placeholder]`
Modified:
`output.elasticsearch.api_key: "${ES_API}"`
I executed this command to confirm that Winlogbeat could communicate with Elasticsearch successfully:
`.'C:\Program Files\Elastic\Winlogbeat\winlogbeat.exe' -c 'C:\Program Files\Elastic\Winlogbeat\winlogbeat.yml' -e`
However, I cannot run `Start-Service winlogbeat` successfully:
Running `sc qc winlogbeat` in cmd.exe shows the command that the service runs when it is started:
Running the command from the above output directly tells us a clearer error of why `Start-Service winlogbeat` did not work (I think):
I added `-E "output.elasticsearch.api_key=\${ES_API}` to the above command, but it did not work too:
I also added `-E "output.elasticsearch.api_key=\${ES_API}"` to the command executed in PowerShell earlier, so the full command is `.'C:\Program Files\Elastic\Winlogbeat\winlogbeat.exe' -c 'C:\Program Files\Elastic\Winlogbeat\winlogbeat.yml' -e -E "output.elasticsearch.api_key=\${ES_API}"`. However, it says that the authentication with Elasticsearch failed. Not attaching any screenshots here tentatively for this one because of the verbose data shown.
Not sure what I did wrong, particularly why there is a `missing field accessing 'output.elasticsearch.api_key'`. Perhaps something to do with the formatting (particularly `$`)?
Seeking advice please!
---
### Author:  [@inf](https://discuss.elastic.co/u/inf)
#### Post date: [June 23, 2021, 12:16pm UTC](https://discuss.elastic.co/t/winlogbeat-secrets-key-store/276457/2 "2021-06-23T12:16:39Z")
Bump!
Wondering how we can solve this issue so that another layer of security is ensured when using Winlogbeat (or other Beats).
Also, if anyone can advice of a more secure method of authenticating with Elasticsearch (besides having an API Key + putting it in a Beats keystore), please advise!
Thank you. 🙂 And have a beautiful day!
---
### Author:  [@inf](https://discuss.elastic.co/u/inf)
#### Post date: [July 6, 2021, 5:37am UTC](https://discuss.elastic.co/t/winlogbeat-secrets-key-store/276457/3 "2021-07-06T05:37:53Z")
Bump!
Still looking for assistance regarding this please.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 3, 2021, 7:38am UTC](https://discuss.elastic.co/t/winlogbeat-secrets-key-store/276457/4 "2021-08-03T07:38:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.