diff --git a/salt/logstash/files/dynamic/9997_output_helix.conf b/salt/logstash/files/dynamic/9997_output_helix.conf
index fcb9d9367..495c4ea9e 100644
--- a/salt/logstash/files/dynamic/9997_output_helix.conf
+++ b/salt/logstash/files/dynamic/9997_output_helix.conf
@@ -1,4 +1,4 @@
-{% set HELIXAPIKEY = salt['pillar.get']('fireeye:helix:api_key', '') %}
+{% set HELIX_API_KEY = salt['pillar.get']('fireeye:helix:api_key', '') %}
 
 filter {
   if "fe_clone" in [type] {
@@ -100,7 +100,7 @@ output {
       url => "https://helix-integrations.cloud.aws.apps.fireeye.com/api/upload?source=test&format=json"
       http_method => post
       http_compression => true
-      headers => ["Authorization", "{{ helix_api_key }}"]
+      headers => ["Authorization", "{{ HELIX_API_KEY }}"]
       format => json_batch
     }
   }