# Extracting process environment variables

**URL:** <https://discuss.elastic.co/t/extracting-process-environment-variables/375955>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [March 14, 2025, 8:48pm UTC](https://discuss.elastic.co/t/extracting-process-environment-variables/375955 "2025-03-14T20:48:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rafirs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafirs/32/141966_2.png) [@rafirs](https://discuss.elastic.co/u/rafirs)\
**Post date:** [March 14, 2025, 8:48pm UTC](https://discuss.elastic.co/t/extracting-process-environment-variables/375955/1 "2025-03-14T20:48:31Z")

</div>

What's the recommended approach to extracting a specific set of environment variables from an event?

Failing to find a syntax to reference the fields within process.env, I did find that using a script/javascript processor the values can be extracted and assigned to fields.

This feels a bit sloppy, it would be nice to be able to apply the normal copy/move/rename operators. Perhaps also a filter for the sub-fields to extract in add\_process\_metadata.

Side note: the script processor is missing from the auditbeat docs.

Example config:

```auto
  - add_process_metadata:
      include_fields: ["process.env"]
      restricted_fields: true
      ignore_missing: true
      fail_on_error: false
  - script:
      lang: javascript
      tag: extract_env_vars
      source: >
        function process(event) {
          var env;
          var v;
          if(env = event.Get("process.env")) {
            if(v = env['JOB_NAME]) event.Put("job_name", v);
            if(v = env['JOB_ID]) event.Put("job_id", v);
          }
        }

```