Journalbeat: Environment variable in config crashes service

[alpi-ua (Oleksii Pylypchuk)]

Hello.
Please, help with the issue.
Following this reference, I've added following to my config:

fields_under_root: true
fields:
   hwkey: ${HWKEY}

And after restarting the service, constantly receiving:
systemctl restart jounalbeat && systemctl status journalbeat

ExecStart=/usr/share/journalbeat/bin/journalbeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=1/FAILURE)
Main PID: 5032 (code=exited, status=1/FAILURE)

If i run jb manually from command prompt,

journalbeat --environment systemd -c /etc/journalbeat/journalbeat.yml --path.home /usr/share/journalbeat --path.config /etc/journalbeat --path.data /var/lib/journalbeat --path.logs /var/log/journalbeat

everything works like a charm, and my variable is expanding like expected.

config passes the test:
journalbeat -c /etc/journalbeat/journalbeat.yml test config

Config OK

I'm running Journalbeat 7.9, and getting the samo on Suse 42.2 x64 (4.4.27-2-default) and Ubuntu 18.04 x64 (4.15.0-64-generic)

Any ideas ?

[Alex_Kristiansen]

@alpi-ua,

Are there any logs from journalbeat in the system log?

[alpi-ua (Oleksii Pylypchuk)]

It was this

Exiting: error unpacking config data: missing field accessing 'fields.hwkey' (source:'/etc/journalbeat/journalbeat.yml')

I put variable to the /etc/systemd/system/journalbeat.service.d/override.conf and it seems to work fine now.