DQL filter by tag?

[Stephen1_Lee]

How to filter by tags in DQL?

This gives many hosts but I'd like to filter by the different tags I see.

fetch dt.entity.host
| fieldsAdd entity.type, lifetime, tags, softwareTechnologies, osType, hypervisorType, state, kubernetesLabels,
 cpuCores, memoryTotal, boshName, gcpZone, awsNameTag, oneAgentCustomHostName, azureResourceGroupName, dnsNames,
 ipAddress, osVersion, installerVersion, osArchitecture, bitness, gceInstanceId, boshAvailabilityZone, gceProjectId,
 boshInstanceId, boshInstanceName, gceInstanceName, gceHostName, boshStemcellVersion, zosSystemName, zosLparName,
 osServices, paasVendorType, cloudType, networkZone, gceNumericProjectId, azureEnvironment, azureComputeModeName,
 zosVirtualization, azureSiteNames, zosCPUSerialNumber, cloudPlatformVendorVersion, azureHostNames, gceMachineType,
 azureVmSizeLabel, monitoringMode, standalone, autoInjection, azureVmScaleSetName, installerSupportAlert,
 zosCPUModelNumber, azureZone, boshDeploymentId, installerPotentialProblem, logicalCpus, physicalMemory,
 customHostMetadata, standaloneSpecialAgentsOnly, additionalSystemInfo, logicalCpuCores, zosTotalPhysicalMemory,
 zosTotalGeneralPurposeProcessors, virtualCpus, gcePublicIpAddresses, isMonitoringCandidate, zosTotalZiipProcessors,
 installerTrackedDownload, macAddresses, simultaneousMultithreading, paasMemoryLimit, azureSku

"records": [{
  "id": "HOST-123456789",
  "entity.name": "xxxxxx",
  "entity.type": "HOST",
  "lifetime": {
    "start": "2022-07-21T12:45:55.198Z",
    "end": "2023-05-11T18:21:20.728Z"
  },
  "tags": [
  "TG.ProcessGroup.DetectedName:Oracle Listeners",
  "TG.App.Env:testing"
  ]
}, ...
]

fetch dt.entity.host
| fieldsAdd entity.type, lifetime, tags
| filter contains(tags,"abc") - this fails

[dannemca · Accepted solution]

Try this:

fetch dt.entity.host
| fieldsAdd entity.type, lifetime, tags
| filter matchesValue(tags,"abc")