Hello Leandro!
Thanks for the quick response!
I'll update you.
In the meantime I've tried other things and... I've found the solution that works for me.
In Fleet > Agent Policy "Agent Windows" > Settings, I set the custom field like this:
and it works.
Each document of each integration adds the "organization.name" field by reading from the environment variable. Obviously the environment variable must be set on the computer.
Log retention will then be the same for all companies.
Based on your experience, is it correct to create a multi-tenant structure that uses indexes to collect documents from ALL companies, and then split them based on a field?
Thanks again. I hope this can help other people!