Filter list of Agents by tagsedit

When you install or enroll Elastic Agent in Fleet, you can specify a comma-separated list of tags to apply to the agent, then use the tags to filter the Agents list shown in Fleet.

Tags are useful for capturing information that is specific to the installation environment, such machine type, location, operating system, environment, and so on. Tags can be any arbitrary information that will help you filter and perform operations on Elastic Agents with the same attributes.

To filter the Agents list by tag, in Kibana, go to Fleet > Agents and click Tags. Select the tags to filter on. The tags are also available in the KQL field for autocompletion.

Agents list filtered to show agents with the staging tag

If you haven’t applied tags to any Elastic Agents yet, the list will be empty.

Apply tags to Elastic Agentsedit

To apply tags, specify a comma-separated list of tags when you install or enroll Elastic Agent in Fleet. If the agent is already enrolled in Fleet, you must unenroll the agent, then re-enroll it to apply tags.

The following command applies the macOS and staging tags during installation:

sudo ./elastic-agent install \
  --url=<Fleet Server host URL> \
  --enrollment-token=<enrollment token> \
  --tag macOS,staging

For the full command synopsis, refer to elastic-agent install and elastic-agent enroll.

The following command applies the docker and dev tags to Elastic Agent running in a Docker container:

docker run \
  --env FLEET_ENROLL=1 \
  --env FLEET_URL=<Fleet Server host URL> \
  --env FLEET_ENROLLMENT_TOKEN=<enrollment token> \
  --env ELASTIC_AGENT_TAGS=docker,dev

For more information about running on containers, refer to the guides under Install Elastic Agents in a containerized environment.

Edit or remove tagsedit

Currently, there is no way to edit or remove existing tags. To change the tags, you must unenroll Elastic Agent, then re-enroll it using new tags.