diff --git a/hugo/content/en/events/explorer/attributes.md b/hugo/content/en/events/explorer/attributes.md index 80136da8c64..e76c2c637f1 100644 --- a/hugo/content/en/events/explorer/attributes.md +++ b/hugo/content/en/events/explorer/attributes.md @@ -28,6 +28,17 @@ This list describes automatically ingested reserved attributes with events. | `service` | The name of the application or service generating the events. | | `message` | By default, Datadog ingests the value of the `message` attribute as the body of the event entry. | +### Events with multiple service tags + +The reserved `service` attribute accepts one value. If an event has multiple `service` tags: + +- V1 selects the first `service` tag it processes. Because tags are not sorted, the result is not deterministic. +- V2 sorts the tags alphabetically and selects the first `service` tag. + +For example, consider an event with `env:prod`, `service:payments`, `team:store`, and `service:checkout`. V1 can assign either service value. V2 assigns `checkout`, because `service:checkout` comes before `service:payments` alphabetically. + +Send only one `service` tag per event and use another tag key for additional dimensions. A `service:` query matches the reserved attribute; use `tags:("service:")` to find any value in the raw tag list. + To search a tag that has the same key as a reserved attribute, use the `tags` search syntax. Example: `tags:("status:")`