# Fields
**URL:** https://discuss.elastic.co/t/fields/224799
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [March 24, 2020, 10:06am UTC](https://discuss.elastic.co/t/fields/224799 "2020-03-24T10:06:20Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@rockyu](https://discuss.elastic.co/u/rockyu)
#### Post date: [March 24, 2020, 10:06am UTC](https://discuss.elastic.co/t/fields/224799/1 "2020-03-24T10:06:21Z")
Error while initializing input: missing field accessing 'filebeat.inputs.0.fields.host\_ip'
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [March 24, 2020, 4:23pm UTC](https://discuss.elastic.co/t/fields/224799/2 "2020-03-24T16:23:58Z")
Hi @rockyu, welcome to the Elastic Community Forums!
Would you mind posting your complete `filebeat.yml` here please (with any sensitive information redacted)?
Thanks,
Shaunak
---
### Author:  [@rockyu](https://discuss.elastic.co/u/rockyu)
#### Post date: [March 25, 2020, 1:32am UTC](https://discuss.elastic.co/t/fields/224799/3 "2020-03-25T01:32:53Z")
yes ,and thanks for your attention
---
### Author:  [@rockyu](https://discuss.elastic.co/u/rockyu)
#### Post date: [March 25, 2020, 1:38am UTC](https://discuss.elastic.co/t/fields/224799/4 "2020-03-25T01:38:55Z")
Whe useing the cmd "systemctl start filebeat " at that time ,the error is report . but if I used cmd "./filebeat -e -c /etc/filebeat/filebeat.yml ", it's all right
---
### Author:  [@rockyu](https://discuss.elastic.co/u/rockyu)
#### Post date: [March 25, 2020, 2:17am UTC](https://discuss.elastic.co/t/fields/224799/5 "2020-03-25T02:17:27Z")
Added , my realy config , the ip address 192.168.52.128 is replaced by `${ServerIP}`, if use 192.168.52.128 it not error ,used `${ServerIP}` had error
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [March 25, 2020, 10:17am UTC](https://discuss.elastic.co/t/fields/224799/6 "2020-03-25T10:17:40Z")
I just tested this the following minimal configuration:
```auto
$ cat filebeat.test.yml
filebeat.inputs:
- type: stdin
enabled: true
fields:
host_ip: ${ServerIP}
output.console:
enabled: true
```
And it worked as expected when I ran Filebeat as follows:
```auto
$ ServerIP=192.168.52.128 ./filebeat -c filebeat.test.yml
this is my test message on stdin
{"@timestamp":"2020-03-25T10:16:44.802Z","@metadata":{"beat":"filebeat","type":"_doc","version":"8.0.0"},"message":"this is my test message on stdin","input":{"type":"stdin"},"fields":{"host_ip":"192.168.52.128"},"ecs":{"version":"1.5.0"},"host":{"name":"Shaunaks-MacBook-Pro-Work.local"},"agent":{"ephemeral_id":"a88c4689-b61c-4ff2-989f-415288766064","hostname":"Shaunaks-MacBook-Pro-Work.local","id":"23a5e144-b83b-4c2f-a99b-195419f4cc34","version":"8.0.0","type":"filebeat"},"log":{"offset":0,"file":{"path":""}}}
```
So that tells me that the `ServerIP` variable is not being set in the environment in which Filebeat is running.
---
### Author:  [@rockyu](https://discuss.elastic.co/u/rockyu)
#### Post date: [March 26, 2020, 2:36am UTC](https://discuss.elastic.co/t/fields/224799/7 "2020-03-26T02:36:02Z")
you are right ,but I want to say that if used "systemctl start filebeat" the filebeat server was not up ,and use "./filebeat -c filebeat.yml " the filebeat server was up , it used same config
---
### Author:  [@rockyu](https://discuss.elastic.co/u/rockyu)
#### Post date: [March 26, 2020, 2:40am UTC](https://discuss.elastic.co/t/fields/224799/8 "2020-03-26T02:40:18Z")
My filebeat server installed by rpm , version is 7.6.1 Can you speak or know Chinese
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [March 26, 2020, 3:04am UTC](https://discuss.elastic.co/t/fields/224799/9 "2020-03-26T03:04:00Z")
Perhaps [Filebeat and systemd | Filebeat Reference [master] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/master/running-with-systemd.html#_customize_systemd_unit_for_filebeat) will help?
> [@rockyu](#):
>
> Can you speak or know Chinese
Sorry, I don't know Chinese. Perhaps @liuxg can help if needed.
---
### Author:  [@liuxg](https://discuss.elastic.co/u/liuxg)
#### Post date: [March 26, 2020, 3:05am UTC](https://discuss.elastic.co/t/fields/224799/10 "2020-03-26T03:05:44Z")
请问一下你的问题是什么呢？我刚才看了一下，你需要使用：
./filebeat keystore create
上面的命令创建一个 filebeat 的 keystore，让后，你使用如下的命令：
./filebeat keystore add ServerIP
把自己的IP地址192.168.52.128粘贴进去，经过上面的设置过后，你就可以在filebeat.yml里直接使用
${ServerIP}了
---
### Author:  [@rockyu](https://discuss.elastic.co/u/rockyu)
#### Post date: [March 26, 2020, 6:12am UTC](https://discuss.elastic.co/t/fields/224799/11 "2020-03-26T06:12:56Z")
1. 我使用的时rpm包安装filebeat,自动生成了`/etc/init.d/filebeat `文件，使用`systemctl start filebeat`时调用该文件 2. 然后我在`/etc/profile`中设置了环境变量 `ServerIP=192.168.52.128`， `export ServerIP` 3. 在`/etc/filebeat/filebeat.yml`中添加`fields: host_ip: ${ServerIP} ` ,格式没问题，前面确认过 4. 使用 `./filebeat -c /etc/filebeat/filebeat.yml`命令启动正常 5. 使用`systemctl start filebeat`启动失败
---
### Author:  [@rockyu](https://discuss.elastic.co/u/rockyu)
#### Post date: [March 26, 2020, 6:37am UTC](https://discuss.elastic.co/t/fields/224799/12 "2020-03-26T06:37:09Z")
Thanks for your patience ,I have see the link , when I add Environment to `/etc/systemd/system/multi-user.target.wants/filebeat.service`
 I can use `systemctl start filebeat` ,but `${ServerIP}` is not `192.168.52.128` 😅
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [March 27, 2020, 1:05am UTC](https://discuss.elastic.co/t/fields/224799/13 "2020-03-27T01:05:41Z")
Looking at your screenshot it looks like you have a `#` at the start of the `Environment` line. Is this intentional? I'm not very familiar with systemd unit file syntax but my reading tells me this is the comment character, which would comment out the rest of the line.
Shaunak
---
### Author:  [@rockyu](https://discuss.elastic.co/u/rockyu)
#### Post date: [March 27, 2020, 2:27am UTC](https://discuss.elastic.co/t/fields/224799/14 "2020-03-27T02:27:29Z")
Yeah , because the `Environment`is not take effect ,so l add the `#`, And before that I had tryd remove `#` ,I'm so sorry above my English , It's very poor ,I hope you can understand what l said . Nice to meet you ,thanks for your help , Can l add your wechat or MSN or you are useing instant messaging 😀
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 24, 2020, 2:27am UTC](https://discuss.elastic.co/t/fields/224799/15 "2020-04-24T02:27:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.