From 32784a89d5ad8dd8d9492ab62ccb1c9bba60a8f2 Mon Sep 17 00:00:00 2001 From: wendy Date: Thu, 3 Sep 2026 14:50:04 -0400 Subject: [PATCH 1/3] Clarify reserved service attribute behavior --- hugo/content/en/events/explorer/attributes.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hugo/content/en/events/explorer/attributes.md b/hugo/content/en/events/explorer/attributes.md index 80136da8c64..c8729c738db 100644 --- a/hugo/content/en/events/explorer/attributes.md +++ b/hugo/content/en/events/explorer/attributes.md @@ -28,6 +28,12 @@ This list describes automatically ingested reserved attributes with events. | `service` | The name of the application or service generating the events. | | `message` | By default, Datadog ingests the value of the `message` attribute as the body of the event entry. | +### Events with multiple service tags + +The reserved `service` attribute has a single value. If an event contains multiple `service:` tags, Datadog uses one of them to populate the reserved attribute. Do not rely on which value is selected, because tag processing order can vary. + +Send only one `service` tag per event. Use a different tag key for additional dimensions, such as `application:`. Additional `service` tags remain in the raw tag list and can be found with a query such as `tags:("service:")`. A `service:` query matches only the value assigned to the reserved attribute. + To search a tag that has the same key as a reserved attribute, use the `tags` search syntax. Example: `tags:("status:")` From f4d5b2b3dceb3d0b3d153a8516a8389feed128e9 Mon Sep 17 00:00:00 2001 From: wendy Date: Thu, 3 Sep 2026 14:58:20 -0400 Subject: [PATCH 2/3] Distinguish V1 and V2 service tag selection --- hugo/content/en/events/explorer/attributes.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hugo/content/en/events/explorer/attributes.md b/hugo/content/en/events/explorer/attributes.md index c8729c738db..bd3466df107 100644 --- a/hugo/content/en/events/explorer/attributes.md +++ b/hugo/content/en/events/explorer/attributes.md @@ -30,7 +30,10 @@ This list describes automatically ingested reserved attributes with events. ### Events with multiple service tags -The reserved `service` attribute has a single value. If an event contains multiple `service:` tags, Datadog uses one of them to populate the reserved attribute. Do not rely on which value is selected, because tag processing order can vary. +The reserved `service` attribute has a single value. If an event contains multiple `service:` tags, the event processing version determines which tag populates the reserved attribute: + +- V1 uses the first `service` tag it encounters. Because V1 does not sort tags before processing them, the selected value is not deterministic. +- V2 sorts tags alphabetically and uses the first `service` tag. For example, if an event has `service:bcd` and `service:ace`, V2 assigns `service:ace` to the reserved attribute. Send only one `service` tag per event. Use a different tag key for additional dimensions, such as `application:`. Additional `service` tags remain in the raw tag list and can be found with a query such as `tags:("service:")`. A `service:` query matches only the value assigned to the reserved attribute. From 55c05836edc1d159183d5f1068a6119f1c65d9e4 Mon Sep 17 00:00:00 2001 From: wendy Date: Thu, 3 Sep 2026 15:05:09 -0400 Subject: [PATCH 3/3] Streamline service tag selection example --- hugo/content/en/events/explorer/attributes.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/hugo/content/en/events/explorer/attributes.md b/hugo/content/en/events/explorer/attributes.md index bd3466df107..e76c2c637f1 100644 --- a/hugo/content/en/events/explorer/attributes.md +++ b/hugo/content/en/events/explorer/attributes.md @@ -30,12 +30,14 @@ This list describes automatically ingested reserved attributes with events. ### Events with multiple service tags -The reserved `service` attribute has a single value. If an event contains multiple `service:` tags, the event processing version determines which tag populates the reserved attribute: +The reserved `service` attribute accepts one value. If an event has multiple `service` tags: -- V1 uses the first `service` tag it encounters. Because V1 does not sort tags before processing them, the selected value is not deterministic. -- V2 sorts tags alphabetically and uses the first `service` tag. For example, if an event has `service:bcd` and `service:ace`, V2 assigns `service:ace` to the reserved attribute. +- V1 selects the first `service` tag it processes. Because tags are not sorted, the result is not deterministic. +- V2 sorts the tags alphabetically and selects the first `service` tag. -Send only one `service` tag per event. Use a different tag key for additional dimensions, such as `application:`. Additional `service` tags remain in the raw tag list and can be found with a query such as `tags:("service:")`. A `service:` query matches only the value assigned to the reserved attribute. +For example, consider an event with `env:prod`, `service:payments`, `team:store`, and `service:checkout`. V1 can assign either service value. V2 assigns `checkout`, because `service:checkout` comes before `service:payments` alphabetically. + +Send only one `service` tag per event and use another tag key for additional dimensions. A `service:` query matches the reserved attribute; use `tags:("service:")` to find any value in the raw tag list. To search a tag that has the same key as a reserved attribute, use the `tags` search syntax. Example: `tags:("status:")`