Is it possible to evaluate a field in runtime?

Elastic Stack Beats
1

Hello,

I'm preparing configuration files for my servers.
Currently there is a hostname sent by filebeats. But I'd like to add another field - with IP.

I thought the easiest would be to set the env. variable and evaluate it during the startup of filebeat, but I don't think filebeat supports it.
So is it possible to do it somehow, or I just need to modify the config file on every server by hand and set a proper IP value as a custom field?

2

We have implemented environment variable replacement in config files but it hasn't been released yet. https://github.com/elastic/beats/pull/715

It looks like someone requested the ability to have the Logstash lumberjack input add the client IP address to the event in https://github.com/logstash-plugins/logstash-input-lumberjack/pull/3 and even submitted a PR that never merged. logstash-input-lumberjack was the predecessor of logstash-input-beats.

logstash-input-beats seems like the right place to have this feature since it will have the client IP address. If a server was multi-homed it might be hard from Filebeat to determine what the correct IP address is to add to the event. You could open a ticket for this feature in logstash-input-beats if you like. And a PR probably wouldn't be too hard either since someone already did the work for logstash-input-lumberjack.