Filebeat configuration file cannot retrieve local environment variables

Elastic Stack Beats
1

Filebeat version: 8.12.0
The configuration of filebeat.yml is as follows

filebeat.config.inputs:
  enabled: true
  path: /etc/filebeat/conf.d/*.yml

processors:
  - add_fields:
      fields:
        environment: prod
        from: $(IP)
  - drop_fields:
      fields: ["agent.ephemeral_id","agent.name","log.offset", "host.os.codename", "_id", "host.name", "host.id", "agent.version", "ecs.version", "agent.id", "@version", "version", "fields.index", "input.type", "_type", "agent.type","beats_input_codec_plain_applied","type.keyword"]

output.logstash:
  hosts: ["10.1.100.64:5045"]

logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat/
  name: filebeat
  keepfiles: 7
  permissions: 0644

In the environment variable configuration file, add the following statement:

export IP=$(hostname -I|awk '{print $1}')

And load the application using source/etc/profile
The local IP address can be obtained normally through echo $IP, but there is an error when starting the Filebeat service. The following are the logs related to the service startup error

{"log.level":"error","@timestamp":"2025-03-19T10:50:47.700+0800","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1312},"message":"Exiting: error initializing processors: fail to unpack the add_fields configuration: missing field accessing 'processors.0.add_fields.fields.from' (source:'/etc/filebeat/filebeat.yml')","service.name":"filebeat","ecs.version":"1.6.0"}

How to write a configuration file and add the field "from" to obtain the local IP address

2

This seems wrong, according to the documentation it should be something like this:

from: '${IP}'

How are you starting filebeat? As a service?

3

Thanks for your reply
Using the above method and attempting to start the Filebeat service, the error message that appears is consistent with the one above

Exiting: error initializing processors: fail to unpack the add_fields configuration: missing field accessing 'processors.0.add_fields.fields.from' (source:'/etc/filebeat/filebeat.yml')
4

I am unclear here.

You added export IP=$(hostname -I|awk '{print $1}') to /etc/profile ?

and then you executed

source /etc/profile

in some shell and restarted filebeat service?