# How do you replicate tagging in metricbeat/filebeat with the agent?

**URL:** <https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937>\
**Category:** Elastic Agent\
**Created:** [December 9, 2025, 5:31pm UTC](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937 "2025-12-09T17:31:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rex656](https://avatars.discourse-cdn.com/v4/letter/r/e480ec/32.png) [@rex656](https://discuss.elastic.co/u/rex656)\
**Post date:** [December 9, 2025, 5:31pm UTC](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937/1 "2025-12-09T17:31:38Z")

</div>

I am in the process of migrating ~450 windows servers from using beats to the agent. All of these servers have metricbeat only and about 120 of those also have filebeat (doing some custom parsing that will be replicated with an ingest pipeline and for basic stuff like IIS logs i plan to use an integration).

In the json config files for metricbeat, we utilize tags that are leveraged in discover for filtering. Example:

```auto
"tags": {
        "hypervisor":false,
        "jira":false,
        "elk":true,
        "dev":false,
        "prod":true,
        "qa":false
    }
}

```

In Fleet, i know there is a tagging feature for the agents but it seems that data lives in the .fleet-agents index only. If i tag all the agents, how can i leverage those fields in the logs-\* and metrics-\* indices?  
I’ve considered adding processors at the agent level to add this data, but that doesn’t scale since most of the servers have different tags.  
I’ve also considered creating an “enrichment index” that could store this data, but that would be a bit more custom and would require adding a new record any time a new server is built.  
We heavily rely on this tagging feature for filtering and we are eager to move to the agent, but this could prevent us from doing that if there isn’t a “clean” way to accomplish this.

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [December 9, 2025, 6:07pm UTC](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937/2 "2025-12-09T18:07:26Z")

</div>

> [@rex656](#):
>
> 50 windows servers from using beats to the agent. All of these servers have metricbeat only and about 120 of those also have filebeat (doing some custom parsing that will be replicated with an ingest pipeline and for basic stuff like IIS logs i plan to use an integration).
> 
> In the json config files for metricbeat, we utilize tags that are leveraged in discover for

Hello, I think I have an idea, I also been struggling with this. As you mentioned, In Fleet per policy, there is an ability to add tags:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/2/92012a2e833a12170707c4c65461b6e8f9bf199a.png)

As the description mentions, any data collected from this agent will be added to this tag.  
I tested it out by adding **role.name** , and it seems to work:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/4/64f757a01bcf7a8282187405618545453ba99a97.png)

I am assuming it might not work for all use cases and will require more granular fleet policies.

---

<div class="post-metadata">

**Author:** ![rex656](https://avatars.discourse-cdn.com/v4/letter/r/e480ec/32.png) [@rex656](https://discuss.elastic.co/u/rex656)\
**Post date:** [December 12, 2025, 2:35pm UTC](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937/4 "2025-12-12T14:35:40Z")

</div>

That’s helpful, thanks. My issue is I will probably end up having to create hundreds of policies because of how many tags there are. I can group some servers together that share the same tags in one policy, but there will be a lot of servers that end up having their own policy.