Define custom field on launch

Elastic Stack Beats
3

:slight_smile: Seems what failed was the env.var expansion:

${metadata.id1?You need to set the metadata.id1 environment variable}

This works as expected:

  - add_fields:
      target: host
      fields:
        metadata.id1: ${metadata.id1:def.value1}
        metadata.id2: ${metadata.id2:def.value2}

giving me:

host.metadata.id1: env.var.value1
host.metadata.id2: env.var.value2