topic Re: DQL for AWS CloudWatch Tags in DQL

DQL for AWS CloudWatch Tags

sebastiaan_holl — Mon, 01 Jul 2024 07:56:13 GMT

Hello

It is possible to gather tags with DQL for registered entities. Our challenge is getting AWS tags for items that are shown in the AWS Classic and Clouds (new) dashboards. So for items on which there is no OneAgent, for which we receive AWS metrics based on the integration with AWS CloudWatch.

For a host a simple approach is this:

fetch dt.entity.host
| fieldsAdd tags

But how can we do the same for AWS CloudWatch metrics, using DQL? There does not seem to be an option to gather the tags for these AWS Cloudwatch metrics.

We are able to gather all AWS Tags by using the API, but we would like to use the AWS tags for other purposes.

Anyone suggestions?

Thank you for your response and support.

Regards,

Sebastiaan

Re: DQL for AWS CloudWatch Tags

AurelienGravier — Tue, 09 Jul 2024 07:11:40 GMT

Hello @sebastiaan_holl

An example for you based on EC2 service with AWS tags :

fetch dt.entity.ec2_instance
| fieldsAdd ToString(tags), alias:listOfTags

| parse listOfTags, "LD '[AWS]Name:' DATA:aws_name '\"'"
| parse listOfTags, "LD '[AWS]environment:' DATA:aws_env '\"'"

| fieldsRemove listOfTags
| summarize count=count(), by: {aws_env}

If you want to use an other cloud service, you just need to change the entity (examples : fetch dt.entity.aws_network_load_balancer or fetch dt.entity.auto_scaling_group ...)

Thank you

Regards

Re: DQL for AWS CloudWatch Tags

sebastiaan_holl — Tue, 09 Jul 2024 07:24:20 GMT

@AurelienGravier Thank you for your support!

Regards Sebastiaan Hollander