What's the recommended approach to extracting a specific set of environment variables from an event?
Failing to find a syntax to reference the fields within process.env, I did find that using a script/javascript processor the values can be extracted and assigned to fields.
This feels a bit sloppy, it would be nice to be able to apply the normal copy/move/rename operators. Perhaps also a filter for the sub-fields to extract in add_process_metadata.
Side note: the script processor is missing from the auditbeat docs.
Example config:
- add_process_metadata:
include_fields: [ "process.env"]
restricted_fields: true
ignore_missing: true
fail_on_error: false
- script:
lang: javascript
tag: extract_env_vars
source: >
function process(event) {
var env;
var v;
if(env = event.Get("process.env")) {
if(v = env['JOB_NAME]) event.Put("job_name", v);
if(v = env['JOB_ID]) event.Put("job_id", v);
}
}