Passing shell script arguments to exectbeat not working

Elastic Stack Beats
1

Hi,

I have an execbeat to call a shellscript, and it works fine. In the shell script, I have modifies it to accept arguments like $1, $2 etc. So, inorder to execute my script, we need to run it in bash like;

sh myscript.sh arg1 arg2

But, when I used it with execbeat, I am getting an error like;

{
  "@timestamp": "2017-02-20T08:38:34.000Z",
  "beat": {
    "hostname": "mypc",
    "name": "mybeat",
    "version": "2.1.1"
  },
  "exec": {
    "command": "sh",
    "stderr": "sh: /shellscripts/myscript.sh arga argb: No such file or directory\n",
    "stdout": ""
  },
  "fields": {
    "beatname": "beat1",
    "host": "192.168.0.1"
  },
  "type": "execbeat"
}

below is my configuration

execbeat:
  execs:
    -
      cron: "@every 5s"
      command: sh
      args: "/shellscripts/myscript.sh arga argb"
      document_type: execbeat
      fields:
        host: 192.168.0.1
        beatname: "beat1"
output.console:
  enabled: true
  pretty: true

Inside the directory shellscripts, I am able to execute sh myscript.sh arga argb and it works fine. Why is this happening and how can I fix this?

Thanks in advance.

2

The problem is with the execbeat code. It treats the arguments as a single string on line 75

cmd.Stdout = &stdout

This would work if your script doesn't require parsing.

For example:

If you have

echo $1

in /shellscripts/myscript.sh then this will output the incorrect result as the string in args needs to be parsed to only print $1.

From my testing with a script file, it looks like this beat is still work in progress. If the command is "ls" and the args is "-l -tr" it will run, however the stdout doesn't match the output when you run the command directly on the console. When you run the command "df" and the args "-m -h" in a script it will error out - from the console it works. I would advise you to bring these points up with the owner of the execbeat github project.