With FileBeat 6.4.0 on Windows (running as a stand-alone app from command line, not a service) we are trying to use various environment variable string values as custom field values per reference document content at https://www.elastic.co/guide/en/beats/filebeat/current/using-environ-vars.html
with windows SET command we can definitely see env var values are valid (note: sudo-type concerns do not apply)
but in config file (which works perfectly for everything except these custom field values) we do as follows (assuming FIELD_1 and FIELD_2 have valid environment variable values from SET):
fields:
field_1: $(FIELD_1)
field_2: $(FIELD_2)
In the output, all we get is the literal "$(FIELD_1)" string embedded in the field values - eg. in JSON "field_1":"$(FIELD_1)"
env variable value substition does not appear to be working