# Using variables in fields output

**URL:** https://discuss.elastic.co/t/using-variables-in-fields-output/69559
**Category:** Beats
**Tags:** filebeat
**Created:** [December 20, 2016, 11:09am UTC](https://discuss.elastic.co/t/using-variables-in-fields-output/69559 "2016-12-20T11:09:48Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Sai\_Theodore](https://avatars.discourse-cdn.com/v4/letter/s/e79b87/32.png) [@Sai\_Theodore](https://discuss.elastic.co/u/Sai_Theodore)
#### Post date: [December 20, 2016, 11:09am UTC](https://discuss.elastic.co/t/using-variables-in-fields-output/69559/1 "2016-12-20T11:09:48Z")

</div>

I need to pass a field from filebeat to kafka viz. host which is nothing but the host name of the machine from the logs are read. Though Filebeat sends the hostname in the beat properties, I need this in a separate field so that it conforms to the kafka topic's expected schema. Right now, I have created a field as

fields:  
host: ${COMPUTERNAME}  
fields\_under\_root: true

Though this works, I would like to know if there is a better way of achieving this such as using any variable in beat itself. Any help will be appreciated.

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [December 20, 2016, 3:01pm UTC](https://discuss.elastic.co/t/using-variables-in-fields-output/69559/2 "2016-12-20T15:01:38Z")

</div>

What do you mean by "any variable in beat itself"?

[Environment variables](https://www.elastic.co/guide/en/beats/libbeat/current/config-file-format.html) or command line flag ( `-E computername=xyz`) are the only things I can think of other than using some outside tool to manage the configuration file.

---

<div class="post-metadata">

### Author: ![Sai\_Theodore](https://avatars.discourse-cdn.com/v4/letter/s/e79b87/32.png) [@Sai\_Theodore](https://discuss.elastic.co/u/Sai_Theodore)
#### Post date: [December 21, 2016, 7:35am UTC](https://discuss.elastic.co/t/using-variables-in-fields-output/69559/3 "2016-12-21T07:35:56Z")

</div>

Hi Andrew, thanks for the quick reply. What I meant by beat variable is that I can see by default beat sends the host name inside beat.hostname. So, is there a way to reuse that in a custom field rather than using an environment variable?

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [December 21, 2016, 1:05pm UTC](https://discuss.elastic.co/t/using-variables-in-fields-output/69559/4 "2016-12-21T13:05:19Z")

</div>

No, it's not possible to reference other field values. You could use Logstash to rename fields or copy data.

---

<div class="post-metadata">

### Author: ![Sai\_Theodore](https://avatars.discourse-cdn.com/v4/letter/s/e79b87/32.png) [@Sai\_Theodore](https://discuss.elastic.co/u/Sai_Theodore)
#### Post date: [December 22, 2016, 4:14am UTC](https://discuss.elastic.co/t/using-variables-in-fields-output/69559/5 "2016-12-22T04:14:18Z")

</div>

Thanks Andrew. Will think of using Logstash as an alternative. Appreciate the help...

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 19, 2017, 4:14am UTC](https://discuss.elastic.co/t/using-variables-in-fields-output/69559/6 "2017-01-19T04:14:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
