Using Environment variable in ES index name

Elastic Stack Beats
1

I was hopping to use an env variable as part of the index name:

...
output.elasticsearch:
...
  index: 'auditbeat-${ENVIRONMENT_NAME}-%{[host][name]}-%{+yyyy.MM.dd}'
...

But when setting up the Kibana dashboard manually I get:

Exiting: missing field accessing 'output.elasticsearch.index' (source:'auditbeat.yml')

What worked for me is adding the env variable as a field and then use it in the index name:

...
  fields:
    environment_name: ${ENVIRONMENT_NAME}
...
output.elasticsearch:
...
  index: 'auditbeat-%{[fields][environment_name]}-%{[host][name]}-%{+yyyy.MM.dd}'
...

But I'm not interested to store the [fields][environment_name] field in ES, is there a work around to achieve this perhaps with storing a temp variable in @metadata field?

2

Hmmm, that should've worked.

Can you post the complete command you ran to setup the Kibana dashboards manually? Was ENVIRONMENT_VARIABLE set when you ran the command?

3

You're right, it worked. The ENVIRONMENT_VARIABLE was set in the Filebeat process but not set in the shell process where I attempted to setup the Kibana dashboards manually which is why it failed initially.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.