FileBeat 6.4.0 on Windows as non-service app and environment variables

Elastic Stack Beats
1

With FileBeat 6.4.0 on Windows (running as a stand-alone app from command line, not a service) we are trying to use various environment variable string values as custom field values per reference document content at https://www.elastic.co/guide/en/beats/filebeat/current/using-environ-vars.html

with windows SET command we can definitely see env var values are valid (note: sudo-type concerns do not apply)

but in config file (which works perfectly for everything except these custom field values) we do as follows (assuming FIELD_1 and FIELD_2 have valid environment variable values from SET):

fields:
field_1: $(FIELD_1)
field_2: $(FIELD_2)

In the output, all we get is the literal "$(FIELD_1)" string embedded in the field values - eg. in JSON "field_1":"$(FIELD_1)"

env variable value substition does not appear to be working

2

The syntax for environment variables is ${FIELD_1}. Do not use parens, but braces.

3

Many thanks, works perfectly on Windows 7

4

Hey priwillmot did you managed to figure out the way to solve?

With Regards,
Kegno Motre https://dltutuapp.com/tutuapp-download/
https://showbox.run/
https://kodi.software/

5

Hi

The proposed solution from Steffen to use { insead of ( worked perfectly for my windows scenario

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.