Slide 6 of 14

Attribute anti-patterns

What not to do

Anti-patternWhy it’s a problem
Too many attributesHard to manage, attribute limits per collector or API call
Frequently changing valuesUse remote attributes in UI instead
Sensitive informationAttributes are visible in the Fleet Management UI
Duplicating reserved attributescollector.os, collector.version, and collector.ID already exist
Inconsistent namingmyEnv vs my_env vs my-env causes confusion
Overly specific valueshostname=server-123 — use collector.ID instead

Tips for beginners

TipWhy it helps
Start simpleBegin with env and maybe one or two others
Be consistentPick a naming convention and stick to it
Document your schemaNote down what each attribute means
Think about targetingEvery attribute should help you target pipelines

Script

Knowing what NOT to do is just as important as knowing what to do. Here are the most common mistakes teams make with attributes.

First, don’t create too many attributes. There’s a hard limit of 22 local attributes per API request and 100 remote attributes. But the real issue is complexity. Too many attributes become hard to manage and remember.

Don’t use attributes for values that change frequently. If something does change often, use remote attributes in the Fleet Management UI rather than baking them into the local config.

Never put sensitive information in attributes—they’re visible in the Fleet Management interface to anyone with access.

Don’t duplicate reserved attributes. Fleet Management already provides collector.os, collector.version, and collector.ID automatically. Creating custom versions just adds confusion.

Be consistent with naming. Pick a convention (lowercase with hyphens, or snake_case) and stick with it across all collectors. Inconsistent naming leads to mistakes when creating pipeline matchers.

Finally, avoid overly specific values like individual hostnames. That’s what collector.ID is for. In most cases, attributes should describe groups, not individual instances.