Best practice for enriching logs with environment names

Elastic Observability
4

Hello and welcome,

In each agent policy you can add a custom field, in this custom field you can configure it to get the value from an environment variable as you can check on the answer of this similar post.

image
image1242×179 12.9 KB

So you could combine an environment variable and the custom field, if you want to add multiple tags, you can also combina an ingest pipeline as well.

For example, assume that you add multiple information, you can do something like this:

Create a environment varaible on the host

HOST_ENV="env1|env2|env3|envN"

Add this a custom field in your policy, so you will have a field with this value.

{
    "custom_field": "env1|env2|env3|envN"
}

You can then use the split processor on an ingest pipeline to split the multiple values into an array and end up with something like this:

{
    "custom_field": ["env1","env2","env3","envN"]
}

Then you are able to filter based on each one of the values in the array.

3 Likes