Is it possible to evaluate a field in runtime?


I'm preparing configuration files for my servers.
Currently there is a hostname sent by filebeats. But I'd like to add another field - with IP.

I thought the easiest would be to set the env. variable and evaluate it during the startup of filebeat, but I don't think filebeat supports it.
So is it possible to do it somehow, or I just need to modify the config file on every server by hand and set a proper IP value as a custom field?

We have implemented environment variable replacement in config files but it hasn't been released yet.

It looks like someone requested the ability to have the Logstash lumberjack input add the client IP address to the event in and even submitted a PR that never merged. logstash-input-lumberjack was the predecessor of logstash-input-beats.

logstash-input-beats seems like the right place to have this feature since it will have the client IP address. If a server was multi-homed it might be hard from Filebeat to determine what the correct IP address is to add to the event. You could open a ticket for this feature in logstash-input-beats if you like. And a PR probably wouldn't be too hard either since someone already did the work for logstash-input-lumberjack.