# Filebeat converts a template value into an array if there's an environment variable inside it

**URL:** <https://discuss.elastic.co/t/filebeat-converts-a-template-value-into-an-array-if-theres-an-environment-variable-inside-it/361426>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 13, 2024, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-converts-a-template-value-into-an-array-if-theres-an-environment-variable-inside-it/361426 "2024-06-13T13:56:25Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rinaldy](https://avatars.discourse-cdn.com/v4/letter/r/3ab097/32.png) [@rinaldy](https://discuss.elastic.co/u/rinaldy)\
**Post date:** [June 13, 2024, 1:56pm UTC](https://discuss.elastic.co/t/filebeat-converts-a-template-value-into-an-array-if-theres-an-environment-variable-inside-it/361426/1 "2024-06-13T13:56:25Z")

</div>

Hi everyone,

I'm currently trying to implement a httpjson filebeat input for Duo Cisco. It needs Basic Auth to be added to `header.Authorization`, but the key has to be generated dynamically.

So this is what I did:

```auto
filebeat.inputs:
    - type: httpjson
      ...
      request.transforms:
        - set:
            target: header.Authorization
            value: 'Basic [[base64Encode (sprintf "%s:%s" "<REDACTED_INTEGRATION_KEY>" (hmac "sha1" "<REDACTED_SECRET_KEY>" (formatDate (now) "Mon, 02 Jan 2006 15:04:05 -0700") "\nGET\n" .url.Host "\n/admin/v2/logs/authentication\n" .url.RawQuery))]]'

```

And this works.

But as soon as I replaced the hardcoded INTEGRATION\_KEY to environment variables `${DUO_INTEGRATION_KEY}`, filebeat throws the following error:

```auto
Exiting: Failed to start crawler: starting input failed: error while initializing input: fail to unpack the set configuration: type mismatch accessing ‘filebeat.inputs.0.request.transforms.5.set.value’ (source:‘filebeat.yml’) accessing ‘filebeat.inputs.0.request’ (source:‘filebeat.yml’)

```

I checked the debug logs and managed to spot the difference between the two scenarios. Basically the ${} environment variables gets replaced correctly, but the resulting value becomes wrapped in an array.

Here's a comparison of the debug logs (it's really long so here's just the difference)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8d488a36e52847f96c1bebf6c8885b3fedf4a3bc.png)

Is it not possible to use environment variables within templates or is this a bug? If not, what's the proper way to do it? I couldn't find any similar threads or issues, and I've been stuck for a while here, so any help is appreciated 🙏

Thanks!