How do you replicate tagging in metricbeat/filebeat with the agent?

Elastic Stack Elastic Agent
1

I am in the process of migrating ~450 windows servers from using beats to the agent. All of these servers have metricbeat only and about 120 of those also have filebeat (doing some custom parsing that will be replicated with an ingest pipeline and for basic stuff like IIS logs i plan to use an integration).

In the json config files for metricbeat, we utilize tags that are leveraged in discover for filtering. Example:

"tags": {
        "hypervisor":false,
        "jira":false,
        "elk":true,
        "dev":false,
        "prod":true,
        "qa":false
    }
}

In Fleet, i know there is a tagging feature for the agents but it seems that data lives in the .fleet-agents index only. If i tag all the agents, how can i leverage those fields in the logs-* and metrics-* indices?
I’ve considered adding processors at the agent level to add this data, but that doesn’t scale since most of the servers have different tags.
I’ve also considered creating an “enrichment index” that could store this data, but that would be a bit more custom and would require adding a new record any time a new server is built.
We heavily rely on this tagging feature for filtering and we are eager to move to the agent, but this could prevent us from doing that if there isn’t a “clean” way to accomplish this.

2

Hello, I think I have an idea, I also been struggling with this. As you mentioned, In Fleet per policy, there is an ability to add tags:

image
image1293×439 31.8 KB

As the description mentions, any data collected from this agent will be added to this tag.
I tested it out by adding role.name, and it seems to work:

image
image729×551 26.2 KB

I am assuming it might not work for all use cases and will require more granular fleet policies.

3

(post deleted by author)

4

That’s helpful, thanks. My issue is I will probably end up having to create hundreds of policies because of how many tags there are. I can group some servers together that share the same tags in one policy, but there will be a lot of servers that end up having their own policy.