# Elastic agent - identification integration in the index

**URL:** <https://discuss.elastic.co/t/elastic-agent-identification-integration-in-the-index/371736>\
**Category:** Elastic Agent\
**Created:** [December 10, 2024, 7:13am UTC](https://discuss.elastic.co/t/elastic-agent-identification-integration-in-the-index/371736 "2024-12-10T07:13:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hofrichterovak](https://avatars.discourse-cdn.com/v4/letter/h/ba9def/32.png) [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\
**Post date:** [December 10, 2024, 7:13am UTC](https://discuss.elastic.co/t/elastic-agent-identification-integration-in-the-index/371736/1 "2024-12-10T07:13:43Z")

</div>

Hello,

I would like to ask how I can identify a specific integration in a data stream created by Elastic Agent.

I would like to have a system in the data. In which field in the data stream index is the information stored, from which integration the data comes.

In the picture I have the integrations:  
system-1  
elastic\_agent-1

 ![image](https://cdck-file-uploads-us1.s3.dualstack.us-west-2.amazonaws.com/elastic/original/3X/b/b/bbc19fe753fbb993efa3af0fe0597cffbdc89c86.png)

I would like to identify, by which field I can recognize that the data comes from system-1.logs, system.1.winlog, system.1.metrics, elastic\_agent-1 (origin name of the integration)?

For example, I viewed the documents in the data stream and looked for the key field "Metrics", but I couldn't find it anywhere.

From the history is everywhere namespace "default". All data streams ends with -default.

Thank you.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 10, 2024, 4:33pm UTC](https://discuss.elastic.co/t/elastic-agent-identification-integration-in-the-index/371736/2 "2024-12-10T16:33:25Z")

</div>

Hi @hofrichterovak

The name of the integration per se is not stored in the document

I am not exactly clear what you are trying to accomplish but here are a few thoughts..

`data_stream.dataset` will tell where the data is coming from.

example `system.cpu` is the system integration and the cpu metricset

You can also add tags at the integration subsections for most integrations..

 ![Screenshot 2024-12-10 at 8.31.01 AM](https://us1.discourse-cdn.com/elastic/original/3X/9/4/946af291faa3d0f68d4701fa0b5cc56eb95b02df.png)

Or you can add fields to the policy level...

 ![Screenshot 2024-12-10 at 8.31.48 AM](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4ed2f57bdc1c2d4e1bbc123365d79408bd6b8750.png)

---

<div class="post-metadata">

**Author:** ![hofrichterovak](https://avatars.discourse-cdn.com/v4/letter/h/ba9def/32.png) [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\
**Post date:** [December 11, 2024, 12:35pm UTC](https://discuss.elastic.co/t/elastic-agent-identification-integration-in-the-index/371736/3 "2024-12-11T12:35:44Z")

</div>

Thank you for this respond. It helped me! 🙂