Try it free

Enrich OneAgent telemetry with primary Grail fields and tags

  • Latest Dynatrace
  • How-to guide
  • 10-min read
  • Published Jun 05, 2026

This documentation describes the new tagging model for latest Dynatrace. Some capabilities are still rolling out. If you're currently using classic auto-tagging, see Classic vs. latest to understand how your existing setup maps to the new model.

OneAgent enriches telemetry at the source with primary Grail fields and tags before sending logs, metrics, spans, events, and entities to Dynatrace. This gives you consistent metadata across all signal types for segments, pipeline routing, bucket assignment, and cost allocation. Host-level enrichment automatically propagates to all Smartscape nodes (hosts, processes, containers, networks, disks) and their signals.

For general guidance on primary Grail fields and tags, see Primary tags. For general OneAgent documentation, see Dynatrace OneAgent.

Platform capabilityHow primary fields and tags help

Data routing

Route data to specific pipelines based on primary_tags.* or primary fields

Bucket assignment

Assign target retention bucket based on primary_tags.* or primary fields

Grail permissions

Derive security context for data access control

Cost allocation

Track costs per team or product with dt.cost.costcenter and dt.cost.product

Segments

Define segments based on primary fields and tags to filter data across Dynatrace apps

Alerting

Create targeted alerts and notifications based on primary fields and tags

Enrichment guidance

Follow this hierarchy. Start with step 1 and only continue if the previous step doesn't cover your needs.

Step 1: Out-of-the-box primary Grail fields

OneAgent automatically detects and enriches primary Grail fields like dt.host_group.id without any manual configuration. When OneAgent runs on Kubernetes (typically rolled out via the Dynatrace Operator), k8s.cluster.name and k8s.namespace.name are also populated automatically. If these built-in fields cover your filtering and access control needs, no additional setup is required.

Step 2: Enrich at source (recommended)

Define primary fields and tags directly on the host or process so data is enriched before it leaves the host. You can apply tags at two scopes:

  • Host-level. Tags apply to all signals from the host and its Smartscape nodes. Set them at install time with --set-host-tag, or at any later point on an existing installation with oneagentctl --set-host-tag.
  • Process-level. Tags apply only to a specific process via the DT_TAGS environment variable. Use this when different processes on the same host need different metadata, or for serverless and managed container platforms where you can't configure the host itself (AWS Lambda and Azure Functions). When the same key is set at both scopes, the process-level value wins for that process.
Host-level: installer (Linux)
Dynatrace-OneAgent-Linux.sh --set-host-tag="primary_tags.environment=production" --set-host-tag="dt.security_context=confidential"
Host-level: installer (Windows)
.\Dynatrace-OneAgent-Windows.exe --set-host-tag="primary_tags.environment=production" --set-host-tag="dt.security_context=confidential"
Host-level: oneagentctl on an existing installation
# Primary Grail fields
oneagentctl --set-host-tag="dt.cost.costcenter=12345"
oneagentctl --set-host-tag="dt.security_context=confidential"
# Primary Grail tags
oneagentctl --set-host-tag="primary_tags.environment=production"
oneagentctl --set-host-tag="primary_tags.team=bravo"
Process-level: DT_TAGS
DT_TAGS="primary_tags.environment=production primary_tags.team=bravo primary_tags.application=payment-processing" java -jar checkout-service.jar

On serverless platforms, OneAgent can't auto-detect certain primary fields. Provide them via DT_TAGS at deploy time:

  • AWS: aws.account.id, aws.region
  • Azure: azure.subscription, azure.resource.group, azure.location

Step 3: Central configuration

Coming soon

If you can't reach every host to configure it individually, use central configuration in Dynatrace to apply primary tags and primary fields to all telemetry coming from hosts and processes.

Through central configuration, all signals emitted by the targeted host or process are enriched with the configured primary tags and primary fields. Enriching all data from a host based on a process or service property is not supported.

Step 4: OpenPipeline inline lookup processor (last resort)

If none of these approaches work, use OpenPipeline and the inline lookup processor to derive or assign primary tags at ingest time. This should be a fallback for environments with constraints that prevent enrichment at an earlier stage.

Precedence

When the same key is set at multiple scopes, the more specific definition wins:

  1. Process-level (DT_TAGS).
  2. Host-level (installer or oneagentctl).
  3. Central configuration rule.

Host-level tags fill in any keys that the process didn't override.

Worked example
ResourceEnrichment levelDefined valuesEnrichment result

Host

oneagentctl or installer

primary_tags.business_unit=ecommerce, primary_tags.environment=dev

primary_tags.business_unit=ecommerce, primary_tags.environment=dev

.NET Process

DT_TAGS (process level)

primary_tags.business_unit=finance, primary_tags.team=alpha

primary_tags.business_unit=finance, primary_tags.team=alpha, primary_tags.environment=dev

Java Process

DT_TAGS (process level)

primary_tags.business_unit=payment, primary_tags.team=hearts, primary_tags.environment=hardening

primary_tags.business_unit=payment, primary_tags.team=hearts, primary_tags.environment=hardening

Any other process

—

—

primary_tags.business_unit=ecommerce, primary_tags.environment=dev

Coverage by environment

The following table shows which enrichment methods are available in each environment.

EnvironmentHost-level (installer, oneagentctl)Process-level (DT_TAGS)Central configuration

Linux or Windows hosts

Planned

OneAgent extensions

Planned

Kubernetes workloads 1

Planned

AWS Lambda 2

—

—

Azure Functions 2

—

—

Mainframe 3

—

—

1

Enrichment on Kubernetes requires OneAgent to be deployed via the Dynatrace Operator. Namespace labels and annotations can also be promoted through Kubernetes-side central configuration and reach OneAgent-emitted signals. For details, see Domain: Kubernetes.

2

Serverless workloads run only the OneAgent code module, so the installer, oneagentctl, and central configuration are not available. Central configuration would also introduce startup latency that's incompatible with these low-latency, volatile workloads. Enrich primary fields and tags through DT_TAGS when deploying the workload.

3

On mainframe, process-level enrichment is configured in the zremoteagentuserconfig.conf file, not via DT_TAGS.

Query enriched data in Grail

Primary Grail fields and tags appear as top-level fields and can be queried with DQL:

Filter spans by team and environment
fetch spans
| filter primary_tags.team == "bravo" AND primary_tags.environment == "production"
Cost allocation aggregation
fetch bizevents
| filter dt.cost.costcenter == "payments"
| summarize sum(value), by: {dt.cost.product}
Security context filtering
fetch logs
| filter dt.security_context == "confidential"
| filter primary_tags.application == "payment-processing"

Limitations

  • Primary Grail field and tag enrichment requires OneAgent version 1.333+.
  • Classic Dynatrace platform is not supported.
  • On mainframe, only process-level enrichment is available, configured in the zremoteagentuserconfig.conf file rather than DT_TAGS. Host-level enrichment and central configuration are not supported.
  • Enriching all data from a host based on a process or service property is not supported.
  • Up to 20 primary tags per host or process; excess tags are silently dropped without a warning.

Related topics

  • OneAgent configuration via command-line interface
  • Set up Grail permissions for OneAgent
  • Global field reference
  • Set up Cost Allocation for OneAgent deployments
  • Primary Grail fields and tags
Related tags
Application Observability