Fields

[rockyu]

Error while initializing input: missing field accessing 'filebeat.inputs.0.fields.host_ip'

[shaunak (Shaunak Kashyap)]

Hi @rockyu, welcome to the Elastic Community Forums!

Would you mind posting your complete filebeat.yml here please (with any sensitive information redacted)?

Thanks,

Shaunak

[rockyu]

yes ,and thanks for your attention

[rockyu]

Whe useing the cmd "systemctl start filebeat " at that time ,the error is report . but if I used cmd "./filebeat -e -c /etc/filebeat/filebeat.yml ", it's all right

[rockyu]

Added , my realy config , the ip address 192.168.52.128 is replaced by ${ServerIP}, if use 192.168.52.128 it not error ,used ${ServerIP} had error

[shaunak (Shaunak Kashyap)]

I just tested this the following minimal configuration:

$ cat filebeat.test.yml
filebeat.inputs:
- type: stdin
  enabled: true
  fields:
    host_ip: ${ServerIP}

output.console:
  enabled: true

And it worked as expected when I ran Filebeat as follows:

$ ServerIP=192.168.52.128  ./filebeat -c filebeat.test.yml
this is my test message on stdin
{"@timestamp":"2020-03-25T10:16:44.802Z","@metadata":{"beat":"filebeat","type":"_doc","version":"8.0.0"},"message":"this is my test message on stdin","input":{"type":"stdin"},"fields":{"host_ip":"192.168.52.128"},"ecs":{"version":"1.5.0"},"host":{"name":"Shaunaks-MacBook-Pro-Work.local"},"agent":{"ephemeral_id":"a88c4689-b61c-4ff2-989f-415288766064","hostname":"Shaunaks-MacBook-Pro-Work.local","id":"23a5e144-b83b-4c2f-a99b-195419f4cc34","version":"8.0.0","type":"filebeat"},"log":{"offset":0,"file":{"path":""}}}

So that tells me that the ServerIP variable is not being set in the environment in which Filebeat is running.

[rockyu]

you are right ,but I want to say that if used "systemctl start filebeat" the filebeat server was not up ,and use "./filebeat -c filebeat.yml " the filebeat server was up , it used same config

[rockyu]

My filebeat server installed by rpm , version is 7.6.1 Can you speak or know Chinese

[shaunak (Shaunak Kashyap)]

Perhaps Filebeat and systemd | Filebeat Reference [master] | Elastic will help?

@rockyu

Can you speak or know Chinese

Sorry, I don't know Chinese. Perhaps @liuxg can help if needed.

[liuxg (XiaoGuo Liu)]

请问一下你的问题是什么呢？我刚才看了一下，你需要使用：
./filebeat keystore create
上面的命令创建一个 filebeat 的 keystore，让后，你使用如下的命令：
./filebeat keystore add ServerIP
把自己的IP地址192.168.52.128粘贴进去，经过上面的设置过后，你就可以在filebeat.yml里直接使用
${ServerIP}了

[rockyu]

1. 我使用的时rpm包安装filebeat,自动生成了/etc/init.d/filebeat 文件，使用systemctl start filebeat时调用该文件 2. 然后我在/etc/profile中设置了环境变量 ServerIP=192.168.52.128， export ServerIP 3. 在/etc/filebeat/filebeat.yml中添加fields: host_ip: ${ServerIP} ,格式没问题，前面确认过 4. 使用 ./filebeat -c /etc/filebeat/filebeat.yml命令启动正常 5. 使用systemctl start filebeat启动失败

[rockyu]

Thanks for your patience ,I have see the link , when I add Environment to /etc/systemd/system/multi-user.target.wants/filebeat.service

I can use systemctl start filebeat ,but ${ServerIP} is not 192.168.52.128

[shaunak (Shaunak Kashyap)]

Looking at your screenshot it looks like you have a # at the start of the Environment line. Is this intentional? I'm not very familiar with systemd unit file syntax but my reading tells me this is the comment character, which would comment out the rest of the line.

Shaunak

[rockyu]

Yeah , because the Environmentis not take effect ,so l add the #, And before that I had tryd remove # ,I'm so sorry above my English , It's very poor ,I hope you can understand what l said . Nice to meet you ,thanks for your help , Can l add your wechat or MSN or you are useing instant messaging