# How to filter my hosts?

**URL:** <https://discuss.elastic.co/t/how-to-filter-my-hosts/312491>\
**Category:** Elastic Security\
**Created:** [August 19, 2022, 6:00pm UTC](https://discuss.elastic.co/t/how-to-filter-my-hosts/312491 "2022-08-19T18:00:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yyie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yyie/32/109890_2.png) [@yyie](https://discuss.elastic.co/u/yyie)\
**Post date:** [August 19, 2022, 6:00pm UTC](https://discuss.elastic.co/t/how-to-filter-my-hosts/312491/1 "2022-08-19T18:00:51Z")

</div>

Hi, i'm new in ELK and I'm planning to add several hosts to my SIEM. I have several hosts distributed in several company locations and I want to be able to analyze each location separately.

I tried to add tags to the agent but it doesn't allow me to filter the hosts or the events.

Somebody can give me some pointers to add tags to the hosts and their events to help me to analiza each location?

Or there are another way (no tags) to group my hosts?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [August 19, 2022, 7:31pm UTC](https://discuss.elastic.co/t/how-to-filter-my-hosts/312491/2 "2022-08-19T19:31:26Z")

</div>

If you're using beats, you can add fields:

```auto
  fields:
    location: not-kansas

```

---

<div class="post-metadata">

**Author:** ![yyie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yyie/32/109890_2.png) [@yyie](https://discuss.elastic.co/u/yyie)\
**Post date:** [August 19, 2022, 7:36pm UTC](https://discuss.elastic.co/t/how-to-filter-my-hosts/312491/3 "2022-08-19T19:36:19Z")

</div>

Thanks for your answer! I'm using the elastic Agent. I going to try to add labels.

Thank you!

---

<div class="post-metadata">

**Author:** ![yyie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yyie/32/109890_2.png) [@yyie](https://discuss.elastic.co/u/yyie)\
**Post date:** [August 19, 2022, 9:53pm UTC](https://discuss.elastic.co/t/how-to-filter-my-hosts/312491/4 "2022-08-19T21:53:31Z")

</div>

It looks that the Elastic Agent don't support label configuration. Only tags. However I don't see how to attach the tags to the events generated for the agent.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2022, 9:53pm UTC](https://discuss.elastic.co/t/how-to-filter-my-hosts/312491/5 "2022-09-16T21:53:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.