How to filter by tags in DQL?
This gives many hosts but I'd like to filter by the different tags I see.
fetch dt.entity.host
| fieldsAdd entity.type, lifetime, tags, softwareTechnologies, osType, hypervisorType, state, kubernetesLabels,
cpuCores, memoryTotal, boshName, gcpZone, awsNameTag, oneAgentCustomHostName, azureResourceGroupName, dnsNames,
ipAddress, osVersion, installerVersion, osArchitecture, bitness, gceInstanceId, boshAvailabilityZone, gceProjectId,
boshInstanceId, boshInstanceName, gceInstanceName, gceHostName, boshStemcellVersion, zosSystemName, zosLparName,
osServices, paasVendorType, cloudType, networkZone, gceNumericProjectId, azureEnvironment, azureComputeModeName,
zosVirtualization, azureSiteNames, zosCPUSerialNumber, cloudPlatformVendorVersion, azureHostNames, gceMachineType,
azureVmSizeLabel, monitoringMode, standalone, autoInjection, azureVmScaleSetName, installerSupportAlert,
zosCPUModelNumber, azureZone, boshDeploymentId, installerPotentialProblem, logicalCpus, physicalMemory,
customHostMetadata, standaloneSpecialAgentsOnly, additionalSystemInfo, logicalCpuCores, zosTotalPhysicalMemory,
zosTotalGeneralPurposeProcessors, virtualCpus, gcePublicIpAddresses, isMonitoringCandidate, zosTotalZiipProcessors,
installerTrackedDownload, macAddresses, simultaneousMultithreading, paasMemoryLimit, azureSku
"records": [{
"id": "HOST-123456789",
"entity.name": "xxxxxx",
"entity.type": "HOST",
"lifetime": {
"start": "2022-07-21T12:45:55.198Z",
"end": "2023-05-11T18:21:20.728Z"
},
"tags": [
"TG.ProcessGroup.DetectedName:Oracle Listeners",
"TG.App.Env:testing"
]
}, ...
]
fetch dt.entity.host
| fieldsAdd entity.type, lifetime, tags
| filter contains(tags,"abc") - this fails
