Add environment variables on filebeat start

Elastic Stack Beats
1

i am using filebeat 6.0.0 which without add_host_metadata processor; and my os is Windows.

now i hope to add an IP field to the filebeat result of all modules, but i don't want to set an Environment Variable globally. Do I have any other way to do that?

i am trying start filebeat with filebeat.exe -E "IP=192.0.0.100", and modules config files like

type: log
paths:
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
fields:
  ip: "${IP}"

Then the filebeat starts failed. Can I set new environment variables with -E argument ?
PS. I have many servers to run filebeat, so i prefer to set the same configuration files on different servers.

2

Can you update filebeat to 6.4.2 with add_host_metadata?

What is the error message you get?

Do you want the IP for some special modules/inputs only? Or do you want it with every event?

3

I met the same problem as Filebeat Windows | Time sync using filebeat 6.4.2, so i downgrade to 6.0.0 .

the error is

2018-10-19T13:28:54+08:00 CRIT Exiting: missing field accessing 'fields.ip'

I want IP for some modules,however adding IP for every event is ok.

4

This looks like modules do not pick up env variables up correctly. Can you try to add the setting globally in your filebeat.yml?

5

Yes, When the below config is setted in filebeat.yml, it works to every event. but when it is in module config file, it failed.

fields.ip: "${IP}"

I have tried using -M "*.*.prospector.fields.ip=$ip" to start filebeat. this way is worked only if I set modules in filebeat.yml, just like:

filebeat.modules:
 - module: customize
   adv-iis-access:
     enabled: true

When I use external config file, like:

filebeat.config.modules:
 path: ${path.config}/modules.d/*.yml

-M setting dose not add a new field to the event.

6

This clearly looks like a bug. No idea if this is resolved in 6.4. Can you check with 6.4.2 and open an bug report if you can reproduce your findings with 6.4?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.