Enrich primary Grail fields and tags using the least invasive method that meets your needs. These approaches are ordered from zero-configuration defaults to ingest-time derivation, so you only take on configuration effort when an earlier stage falls short.
Follow these approaches in order. Each one is a fallback. Start at the top and move to the next only if the previous approach doesn't meet your needs. For domain-specific guidance, see OneAgent and Kubernetes.
Many primary Grail fields are populated automatically: Kubernetes cluster and namespace, host group, and cloud account require no configuration. If these cover your filtering and access needs, no further setup is required.
Set tags at deployment time so every signal is enriched from the start, before it reaches the pipeline.
Promote existing cloud tags, Kubernetes labels, or host properties to primary Grail tags through central configuration, without modifying individual deployments.
Derive or assign primary Grail tags at ingest time using the OpenPipeline inline lookup processor. Use only when earlier-stage enrichment isn't possible.