# Auditbeat configuration pass dynamic shell environment variable **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [October 17, 2022, 9:03am UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752 "2022-10-17T09:03:35Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![satendra1987](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@satendra1987](https://discuss.elastic.co/u/satendra1987)\ **Post date:** [October 17, 2022, 9:03am UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752/1 "2022-10-17T09:03:35Z")
Hi, we need to get a custom field in auditbeat kibana logs and this field value has to come from a shell environment variable. this shell environment variable value can be different on each shell opened. Thanks Satendra ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [October 17, 2022, 9:55am UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752/2 "2022-10-17T09:55:14Z")
To confirm, you want to access an environment variable on the host where you have auditbeat running? Having a quick look at the docs, you could try using the add\_field processor while using the value of the environment variable: > **[Add fields | Auditbeat Reference \[8.4\] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/current/add-fields.html)** > **[Use environment variables in the configuration | Auditbeat Reference \[8.4\] |...](https://www.elastic.co/guide/en/beats/auditbeat/current/using-environ-vars.html)** ---
**Author:** ![satendra1987](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@satendra1987](https://discuss.elastic.co/u/satendra1987)\ **Post date:** [October 17, 2022, 10:29am UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752/3 "2022-10-17T10:29:41Z")
Hi Carly, Thanks for your quick response. in my case the environment variable is dynamic i.e. its value is user specific. therefore the variable value may change on different shells. Thanks Satendra ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [October 17, 2022, 11:47am UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752/4 "2022-10-17T11:47:24Z")
So to confirm, is your variable name differing across shells? The second link shows how to extract the value of a known variable name. ---
**Author:** ![satendra1987](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@satendra1987](https://discuss.elastic.co/u/satendra1987)\ **Post date:** [October 18, 2022, 4:00am UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752/5 "2022-10-18T04:00:15Z")
Hi Carly, No the variable name remains same but the variable value changes across shells. The problem here is- that the variable value is fetched from the shell when auditbeat daemon is started and remains constant after that. Thanks Satendra ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [October 18, 2022, 2:00pm UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752/6 "2022-10-18T14:00:48Z")
Ok, apologies I'm not too sure on this one. Can you share your configuration, which auditbeat modules you're using and perhaps the variable you're trying to capture? Someone else might have an idea based on your current configuration. ---
**Author:** ![satendra1987](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@satendra1987](https://discuss.elastic.co/u/satendra1987)\ **Post date:** [October 21, 2022, 6:01am UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752/7 "2022-10-21T06:01:15Z")
Hi Carly, i am using system module of auditbeat. i am trying to capture a username environment variable which is a customized one different from "user.name" field captured in auditbeat log. This environment variable is set whenever a user login to a host and opens a shell, In our requirement we want to pass this customized variable name and value with the activity happening on the logged terminal. Thanks Satendra ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 18, 2022, 8:01am UTC](https://discuss.elastic.co/t/auditbeat-configuration-pass-dynamic-shell-environment-variable/316752/8 "2022-11-18T08:01:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.