Elastic agent - identification integration in the index

[hofrichterovak (Cate)]

Hello,

I would like to ask how I can identify a specific integration in a data stream created by Elastic Agent.

I would like to have a system in the data. In which field in the data stream index is the information stored, from which integration the data comes.

In the picture I have the integrations:
system-1
elastic_agent-1

I would like to identify, by which field I can recognize that the data comes from system-1.logs, system.1.winlog, system.1.metrics, elastic_agent-1 (origin name of the integration)?

For example, I viewed the documents in the data stream and looked for the key field "Metrics", but I couldn't find it anywhere.

From the history is everywhere namespace "default". All data streams ends with -default.

Thank you.

[stephenb (Stephen Brown)]

Hi @hofrichterovak

The name of the integration per se is not stored in the document

I am not exactly clear what you are trying to accomplish but here are a few thoughts..

data_stream.dataset will tell where the data is coming from.

example system.cpu is the system integration and the cpu metricset

You can also add tags at the integration subsections for most integrations..

Or you can add fields to the policy level...

[hofrichterovak (Cate)]

Thank you for this respond. It helped me!