Fields

Elastic Stack Beats
,
1

Error while initializing input: missing field accessing 'filebeat.inputs.0.fields.host_ip'

2

Hi @rockyu, welcome to the Elastic Community Forums!

Would you mind posting your complete filebeat.yml here please (with any sensitive information redacted)?

Thanks,

Shaunak

3

yes ,and thanks for your attention

414372fbddc7519ec87eaba02a2f5e6
414372fbddc7519ec87eaba02a2f5e61090×1257 45.6 KB

4

Whe useing the cmd "systemctl start filebeat " at that time ,the error is report . but if I used cmd "./filebeat -e -c /etc/filebeat/filebeat.yml ", it's all right

5

Added , my realy config , the ip address 192.168.52.128 is replaced by ${ServerIP}, if use 192.168.52.128 it not error ,used ${ServerIP} had error

6

I just tested this the following minimal configuration:

$ cat filebeat.test.yml
filebeat.inputs:
- type: stdin
  enabled: true
  fields:
    host_ip: ${ServerIP}

output.console:
  enabled: true

And it worked as expected when I ran Filebeat as follows:

$ ServerIP=192.168.52.128  ./filebeat -c filebeat.test.yml
this is my test message on stdin
{"@timestamp":"2020-03-25T10:16:44.802Z","@metadata":{"beat":"filebeat","type":"_doc","version":"8.0.0"},"message":"this is my test message on stdin","input":{"type":"stdin"},"fields":{"host_ip":"192.168.52.128"},"ecs":{"version":"1.5.0"},"host":{"name":"Shaunaks-MacBook-Pro-Work.local"},"agent":{"ephemeral_id":"a88c4689-b61c-4ff2-989f-415288766064","hostname":"Shaunaks-MacBook-Pro-Work.local","id":"23a5e144-b83b-4c2f-a99b-195419f4cc34","version":"8.0.0","type":"filebeat"},"log":{"offset":0,"file":{"path":""}}}

So that tells me that the ServerIP variable is not being set in the environment in which Filebeat is running.

7

you are right ,but I want to say that if used "systemctl start filebeat" the filebeat server was not up ,and use "./filebeat -c filebeat.yml " the filebeat server was up , it used same config

99e56dd11f983ee0395f6b37fc9e3b3
99e56dd11f983ee0395f6b37fc9e3b32593×1520 322 KB

8

My filebeat server installed by rpm , version is 7.6.1 Can you speak or know Chinese

9

Perhaps Filebeat and systemd | Filebeat Reference [master] | Elastic will help?

Sorry, I don't know Chinese. Perhaps @liuxg can help if needed.

10

请问一下你的问题是什么呢？我刚才看了一下，你需要使用：
./filebeat keystore create
上面的命令创建一个 filebeat 的 keystore，让后，你使用如下的命令：
./filebeat keystore add ServerIP
把自己的IP地址192.168.52.128粘贴进去，经过上面的设置过后，你就可以在filebeat.yml里直接使用
${ServerIP}了

11
  1. 我使用的时rpm包安装filebeat,自动生成了/etc/init.d/filebeat 文件，使用systemctl start filebeat时调用该文件 2. 然后我在/etc/profile中设置了环境变量 ServerIP=192.168.52.128， export ServerIP 3. 在/etc/filebeat/filebeat.yml中添加fields: host_ip: ${ServerIP} ,格式没问题，前面确认过 4. 使用 ./filebeat -c /etc/filebeat/filebeat.yml命令启动正常 5. 使用systemctl start filebeat启动失败
12

Thanks for your patience ,I have see the link , when I add Environment to /etc/systemd/system/multi-user.target.wants/filebeat.service

图片
图片1899×387 15.3 KB
I can use systemctl start filebeat ,but ${ServerIP} is not 192.168.52.128 :sweat_smile:

13

Looking at your screenshot it looks like you have a # at the start of the Environment line. Is this intentional? I'm not very familiar with systemd unit file syntax but my reading tells me this is the comment character, which would comment out the rest of the line.

Shaunak

14

Yeah , because the Environmentis not take effect ,so l add the #, And before that I had tryd remove # ,I'm so sorry above my English , It's very poor ,I hope you can understand what l said . Nice to meet you ,thanks for your help , Can l add your wechat or MSN or you are useing instant messaging :grinning:

15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.