Specifying complex objects in environment variable doesn't work with Logstash output

[Alsheh]

Hi, I tried to follow the example provided in the filebeat docs to specify complex objects in environment variables (array of LS hosts in my case) for logstash output but filebeat exits with the following error message:

Exiting: error initializing publisher: missing field accessing 'output.logstash.hosts' (source:'filebeat.yml')

Env variable is defined in docker-compose.yml:

LS_HOSTS="logstash:5044,logstash2:5044"

filebeat.yml:

...
output.logstash:
  hosts: '${LS_HOSTS}'

Is this feature exclusive for Elasticsearch output, a bug, or am I doing something wrong here?

Thanks!

[kvch (Noémi Ványi)]

Your config seems correct. Do you get the same error when running filebeat on the host without any containerization?

[Alsheh]

I get the same error without containerization:

Defining env variable:

export LS_HOSTS="logstash:5044,logstash2:5044"

filebeat.yml

...
output.logstash:
  hosts: '${LS_HOSTS}'
  loadbalance: true
  index: filebeat

Logs after running Filebeat

➜  filebeat-6.3.2-linux-x86_64 ✗ sudo ./filebeat -e -c filebeat.yml -d "publish"
...
2018-08-03T16:57:56.794Z	INFO	instance/beat.go:225	Setup Beat: filebeat; Version: 6.3.2
2018-08-03T16:57:56.795Z	INFO	instance/beat.go:275	filebeat stopped.
2018-08-03T16:57:56.795Z	ERROR	instance/beat.go:691	Exiting: error initializing publisher: missing field accessing 'output.logstash.hosts' (source:'filebeat.yml')
Exiting: error initializing publisher: missing field accessing 'output.logstash.hosts' (source:'filebeat.yml')

[kvch (Noémi Ványi)]

Could you please share the full configuration file? It's possible that there is a whitespace error which messes up the parsing.

[Alsheh]

@kvch, here is a simplified version of the config file that produces the same error:

filebeat.inputs:
- type: log
  paths:
    - /var/log/*.log

output.logstash:
  hosts: '${LS_HOSTS}'

env variable:

export LS_HOSTS="10.45.3.2:9220,10.45.3.1:9230"

➜  filebeat-6.3.2 sudo ./filebeat -e -c filebeat.yml -d "publish"
...
2018-08-06T11:35:54.023-0700	INFO	instance/beat.go:225	Setup Beat: filebeat; Version: 6.3.2
2018-08-06T11:35:54.024-0700	INFO	instance/beat.go:275	filebeat stopped.
2018-08-06T11:35:54.024-0700	ERROR	instance/beat.go:691	Exiting: error initializing publisher: missing field accessing 'output.logstash.hosts' (source:'filebeat.yml')
Exiting: error initializing publisher: missing field accessing 'output.logstash.hosts' (source:'filebeat.yml')

Filebeat doesn't seems to be able to read env variable because I get the same error message when I simply put an empty string in the host field but works as expected when I hardcode the host in the config file! Also, I am doing the testing without any containerization and I run Filebeat in the same terminal session where I defined the the env variable.

[Alsheh]

Problem solved!

I used sudo when I ran filebeat which does not preserve env variables for security purposes. This post helped.