Error while initializing input: missing field accessing 'filebeat.inputs.0.fields.host_ip'

Hi @rockyu, welcome to the Elastic Community Forums!

Would you mind posting your complete filebeat.yml here please (with any sensitive information redacted)?



yes ,and thanks for your attention

Whe useing the cmd "systemctl start filebeat " at that time ,the error is report . but if I used cmd "./filebeat -e -c /etc/filebeat/filebeat.yml ", it's all right

Added , my realy config , the ip address is replaced by ${ServerIP}, if use it not error ,used ${ServerIP} had error

I just tested this the following minimal configuration:

$ cat filebeat.test.yml
- type: stdin
  enabled: true
    host_ip: ${ServerIP}

  enabled: true

And it worked as expected when I ran Filebeat as follows:

$ ServerIP=  ./filebeat -c filebeat.test.yml
this is my test message on stdin
{"@timestamp":"2020-03-25T10:16:44.802Z","@metadata":{"beat":"filebeat","type":"_doc","version":"8.0.0"},"message":"this is my test message on stdin","input":{"type":"stdin"},"fields":{"host_ip":""},"ecs":{"version":"1.5.0"},"host":{"name":"Shaunaks-MacBook-Pro-Work.local"},"agent":{"ephemeral_id":"a88c4689-b61c-4ff2-989f-415288766064","hostname":"Shaunaks-MacBook-Pro-Work.local","id":"23a5e144-b83b-4c2f-a99b-195419f4cc34","version":"8.0.0","type":"filebeat"},"log":{"offset":0,"file":{"path":""}}}

So that tells me that the ServerIP variable is not being set in the environment in which Filebeat is running.

you are right ,but I want to say that if used "systemctl start filebeat" the filebeat server was not up ,and use "./filebeat -c filebeat.yml " the filebeat server was up , it used same config

My filebeat server installed by rpm , version is 7.6.1 Can you speak or know Chinese

Perhaps will help?

Sorry, I don't know Chinese. Perhaps @liuxg can help if needed.

./filebeat keystore create
上面的命令创建一个 filebeat 的 keystore,让后,你使用如下的命令:
./filebeat keystore add ServerIP

  1. 我使用的时rpm包安装filebeat,自动生成了/etc/init.d/filebeat 文件,使用systemctl start filebeat时调用该文件 2. 然后我在/etc/profile中设置了环境变量 ServerIP= ServerIP 3. 在/etc/filebeat/filebeat.yml中添加fields: host_ip: ${ServerIP} ,格式没问题,前面确认过 4. 使用 ./filebeat -c /etc/filebeat/filebeat.yml命令启动正常 5. 使用systemctl start filebeat启动失败

Thanks for your patience ,I have see the link , when I add Environment to /etc/systemd/system/

I can use systemctl start filebeat ,but ${ServerIP} is not :sweat_smile:

Looking at your screenshot it looks like you have a # at the start of the Environment line. Is this intentional? I'm not very familiar with systemd unit file syntax but my reading tells me this is the comment character, which would comment out the rest of the line.


Yeah , because the Environmentis not take effect ,so l add the #, And before that I had tryd remove # ,I'm so sorry above my English , It's very poor ,I hope you can understand what l said . Nice to meet you ,thanks for your help , Can l add your wechat or MSN or you are useing instant messaging :grinning:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.