Tag data for querying

The instructions to deploy the host-agent displayed in Add Data show a default configuration that allows ingesting data into an Elastic Cloud deployment. The only config setting you may want to change is project-id (default value is 1).

The -project-id flag, or the project-id key in the host-agent configuration file, splits profiling data into logical groups that you control.

You can assign any non-zero, unsigned integer ⇐ 4095 to a host-agent deployment you control. In Kibana, the KQL field profiling.project.id is mapped to project-id and you can use it to split or filter data.

You may want to set a per-environment project ID (for example, dev=3, staging=2, production=1), a per-datacenter project ID (for example, DC1=1, DC2=2), or even a per-k8s-cluster project ID (for example, us-west2-production=100, eu-west1-production=101).

You can also use the -tags flag to associate an arbitrary string with a specific host-agent instance. Each tag must match ^[a-zA-Z0-9-:._]+$ regex and use ; as a separator. Invalid tags are dropped and warnings issued on startup.

In Kibana, you can use the KQL field tags for filtering. For example, when running the host-agent with the following:

sudo pf-host-agent/pf-host-agent -project-id=1 -tags='cloud_region:us-central1;env:staging'

You can then filter profiling data from the host-agent in Kibana with the following tag:

tags : "cloud_region:us-central1"