How to pass variables to filebeat through the Elastic-Agent?

Elastic Stack Elastic Agent
2

Hi @Bryan_Hamilton,
Thanks for your post which help me to start solving your question.
I managed to pass environment variables to filebeat run by an elastic-agent centrally managed.
My test:

  • Stack 8.9.0 with 3 nodes on Linux Mint + one elastic-agent on Windows server.
  • On one of the 3 nodes, Logstash+fleet server
  • Elastic-agent deployed on the all servers with a "Custom Logs Integration" in the policy and tags=test to quickly find the result.
  • Inside the filbeat policy I have setup the following code:
- add_fields:
    fields:
      test: "${env.MYVAR}"  # or sometime "${env.MYVAR}."
  • For Linux, environment variable is recorded inside a local file: /etc/sysconfig/elastic-agent which is referenced when you do:
    sudo systemctl edit elastic-agent.service
  • In the file I have setup the variable:
    MYVAR=This is a good test
  • Restart elastic-agent to take the variable in account
  • For Windows, add the variable in the system environment global variable property and restart elastic-agent service after
  • After triggering the filebeat custom log check, I found in my .log datastream record the value:
    "fields": {
      "test": "This is a good test"
    }

Warning, it seems that sometime I need to put a character like '.' or space after the ${env.MYVAR} otherwise the agent will become Unhealthy (see example above).

I need to make more test but it seems working and I hope I will be able to use it inside an MSSQL integration to target ${host.name} and ${mssqlinst} which will be setup in the environment variable by my DBA.

Hope it will help.

Regards Antoine
(from France).