Filebeat converts a template value into an array if there's an environment variable inside it

Elastic Stack Beats
1

Hi everyone,

I'm currently trying to implement a httpjson filebeat input for Duo Cisco. It needs Basic Auth to be added to header.Authorization, but the key has to be generated dynamically.

So this is what I did:

filebeat.inputs:
    - type: httpjson
      ...
      request.transforms:
        - set:
            target: header.Authorization
            value: 'Basic [[ base64Encode (sprintf "%s:%s" "<REDACTED_INTEGRATION_KEY>" (hmac "sha1" "<REDACTED_SECRET_KEY>" (formatDate (now) "Mon, 02 Jan 2006 15:04:05 -0700") "\nGET\n" .url.Host "\n/admin/v2/logs/authentication\n" .url.RawQuery)) ]]'

And this works.

But as soon as I replaced the hardcoded INTEGRATION_KEY to environment variables ${DUO_INTEGRATION_KEY}, filebeat throws the following error:

Exiting: Failed to start crawler: starting input failed: error while initializing input: fail to unpack the set configuration: type mismatch accessing ‘filebeat.inputs.0.request.transforms.5.set.value’ (source:‘filebeat.yml’) accessing ‘filebeat.inputs.0.request’ (source:‘filebeat.yml’)

I checked the debug logs and managed to spot the difference between the two scenarios. Basically the ${} environment variables gets replaced correctly, but the resulting value becomes wrapped in an array.

Here's a comparison of the debug logs (it's really long so here's just the difference)

image
image1617×135 29.2 KB

Is it not possible to use environment variables within templates or is this a bug? If not, what's the proper way to do it? I couldn't find any similar threads or issues, and I've been stuck for a while here, so any help is appreciated :pray:

Thanks!