DQL for AWS CloudWatch Tags

[sebastiaan_holl]

Hello

It is possible to gather tags with DQL for registered entities. Our challenge is getting AWS tags for items that are shown in the AWS Classic and Clouds (new) dashboards. So for items on which there is no OneAgent, for which we receive AWS metrics based on the integration with AWS CloudWatch. 

For a host a simple approach is this:

fetch dt.entity.host
| fieldsAdd tags

But how can we do the same for AWS CloudWatch metrics, using DQL? There does not seem to be an option to gather the tags for these AWS Cloudwatch metrics. 

We are able to gather all AWS Tags by using the API, but we would like to use the AWS tags for other purposes.

Anyone suggestions?

Thank you for your response and support.

Regards,

Sebastiaan

[AurelienGravier · Accepted solution]

Hello @sebastiaan_holl 

An example for you based on EC2 service with AWS tags :

fetch dt.entity.ec2_instance
| fieldsAdd ToString(tags), alias:listOfTags

| parse listOfTags, "LD '[AWS]Name:' DATA:aws_name '\"'"
| parse listOfTags, "LD '[AWS]environment:' DATA:aws_env '\"'"

| fieldsRemove listOfTags
| summarize count=count(), by: {aws_env}

If you want to use an other cloud service, you just need to change the entity (examples : fetch dt.entity.aws_network_load_balancer or fetch dt.entity.auto_scaling_group ...)

Thank you

Regards

[sebastiaan_holl]

@AurelienGravier Thank you for your support!

Regards Sebastiaan Hollander