Add environment variables on filebeat start


i am using filebeat 6.0.0 which without add_host_metadata processor; and my os is Windows.

now i hope to add an IP field to the filebeat result of all modules, but i don't want to set an Environment Variable globally. Do I have any other way to do that?

i am trying start filebeat with filebeat.exe -E "IP=", and modules config files like

type: log
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
  ip: "${IP}"

Then the filebeat starts failed. Can I set new environment variables with -E argument ?
PS. I have many servers to run filebeat, so i prefer to set the same configuration files on different servers.

(Steffen Siering) #2

Can you update filebeat to 6.4.2 with add_host_metadata?

What is the error message you get?

Do you want the IP for some special modules/inputs only? Or do you want it with every event?


I met the same problem as Filebeat Windows | Time sync using filebeat 6.4.2, so i downgrade to 6.0.0 .

the error is

2018-10-19T13:28:54+08:00 CRIT Exiting: missing field accessing 'fields.ip'

I want IP for some modules,however adding IP for every event is ok.

(Steffen Siering) #4

This looks like modules do not pick up env variables up correctly. Can you try to add the setting globally in your filebeat.yml?


Yes, When the below config is setted in filebeat.yml, it works to every event. but when it is in module config file, it failed.

fields.ip: "${IP}"

I have tried using -M "*.*.prospector.fields.ip=$ip" to start filebeat. this way is worked only if I set modules in filebeat.yml, just like:

 - module: customize
     enabled: true

When I use external config file, like:

 path: ${path.config}/modules.d/*.yml

-M setting dose not add a new field to the event.

(Steffen Siering) #6

This clearly looks like a bug. No idea if this is resolved in 6.4. Can you check with 6.4.2 and open an bug report if you can reproduce your findings with 6.4?

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.