# Getting external values into logstash; environment filter does not seen to work

**URL:** <https://discuss.elastic.co/t/getting-external-values-into-logstash-environment-filter-does-not-seen-to-work/868>\
**Category:** Logstash\
**Created:** [May 18, 2015, 9:40pm UTC](https://discuss.elastic.co/t/getting-external-values-into-logstash-environment-filter-does-not-seen-to-work/868 "2015-05-18T21:40:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ptrei](https://avatars.discourse-cdn.com/v4/letter/p/e480ec/32.png) [@ptrei](https://discuss.elastic.co/u/ptrei)\
**Post date:** [May 18, 2015, 9:40pm UTC](https://discuss.elastic.co/t/getting-external-values-into-logstash-environment-filter-does-not-seen-to-work/868/1 "2015-05-18T21:40:46Z")

</div>

I have a compressed log files, and am piping them into LS using stdin:  
bzip2 -k -d --stdout logfile.bz2 | logstash -f myconfig.conf

This works, but I'd really like to record in each parsed record in Elasticsearch the file name which originated it. There seems to be no way to do that using command-line arguments to LS - no -D"fieldname=fieldvalue" or similar.

There is a contributed 'Enviroment' filter which supposedly let me set fields from Unix environment variables, but I can't seem to get it to work: It's not picking up the envar. LS complains about it not having a version number, and not  
being supported. An examination of the source code suggests its unfinished.

The only working solution I have right now is write a template version of my conf file, and used sed to write a mutated version for each input file, but this is a _very_ ugly solution.

Anyone have better suggestions?  
thanks!  
Peter

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 19, 2015, 5:39am UTC](https://discuss.elastic.co/t/getting-external-values-into-logstash-environment-filter-does-not-seen-to-work/868/2 "2015-05-19T05:39:05Z")

</div>

You can specify the Logstash configuration both through a file with `-f` and on the command line with `-e` (untested):

```
bzip2 -k -d --stdout logfile.bz2 | \
  logstash \
    -e "filter { mutate { add_field { 'path' => '$(pwd)/logfile.bz2' } } }' \
    -f myconfig.conf

```

Perhaps not beautiful but you won't can at least use the same configuration file for all input files.

The `-e` option is applied first and the configuration files are read afterwards, which is significant since you may want to have your manually added field available to other filters:

> <https://github.com/elastic/logstash/blob/v1.5.0/lib/logstash/agent.rb#L93-L96>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:39am UTC](https://discuss.elastic.co/t/getting-external-values-into-logstash-environment-filter-does-not-seen-to-work/868/3 "2017-07-06T05:39:43Z")

</div>