Environment Variable

Elastic Stack Beats
1

Hi All,

I am trying to make the configuration automate through environment variable described below
https://www.elastic.co/guide/en/beats/libbeat/6.0/config-file-format-env-vars.html

but same is not working .
please let know the issue ,

2

The most common issue people have with environment variables is that they aren't set for the process. How are you setting the environment variables and how are you running the Filebeat process?

If your OS uses systemd have a look at this post.

3

Hi

PFB the details,

i am setting the env variables by exporting them in .bashrc file .
and running filebeat with below command ,
sudo ./filebeat -e -c filebeat.yml -d "publish"

let know for more details .

4

sudo clears the environment for security purposes. [This is covered in the other post I linked.] Using sudo -E will preserve the environment. See man sudo.

Are you planning on using systemd to run Filebeat as a service? What OS are you using?

5

shall i try running without sudo also -E is CLI option for passing arguments .

i am not running filebeat as service as of now but if required i would .

the whole ELK setup is done without systemd .

OS :- CentOS Linux release 7.4.1708 (Core) .

Let know how to proceed .

6

I was specifically talking about sudo -E. In Filebeat -E is for passing additional config via the CLI.

To demonstrate the difference to yourself try setting the environment variable then printing it.

export MY_ENV_VAR=hello
env | grep MY_ENV_VAR
sudo -E env | grep MY_ENV_VAR
sudo env | grep MY_ENV_VAR # Without -E the MY_ENV_VAR variable is dropped from the environment.
7

Yes , You are right .

Without -E , it is dropping ENV variables .
Now where i should mention -E is filebeat start CMD .

I am using below command to start filebeat ,

sudo ./filebeat -e -c Filebeat.yml -d "publish" ,

do i need to pass ENV variables , which are used to start the filebeat with -E oprtions .

please suggest the same .

8

If you are using the environment variables in your configuration files then you don't need to pass anything in on command line. In you config file you might have something like

name: ${CUSTOM_NAME}

Then on the CLI you would run:

sudo -E ./filebeat -e -d "publish"

I recommend testing your config with:

sudo -E ./filebeat -e -d "config" test config

This will log the file configuration that is used after evaluating the environment variables.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.