Groupings

Overview

With Groupings, you can segment your infrastructure by any label. While Monitor offers some out-of-the-box groupings, the real value of Groupings comes from the ability to create your own.

Sysdig Monitor offers two types of Groupings:

• Agent-only Groupings
• All-sources Groupings

Define Groupings

Scope

When creating a grouping, you can specify a scope to restrict which entities will be considered when populating the Hierarchy.

For example, defining a grouping that only displays Cronjobs. In the scenario given below, kube_workload_type is cronjob is added as a Scope filter.

The filter then ensures that the only workloads displayed in the Hierarchy are Cronjobs.

Sources

You can use two sources when defining a grouping.

Agent Only

Agent Only Groupings are the oldest type of Groupings in Sysdig Monitor. They use any extended label emitted by any Sysdig Agent to build the infrastructure tree. These groupings accurately reflect the state of your infrastructure as the time navigation is shifted back in time. The most commonly used agent-only grouping is All Workloads, which organizes the infrastructure entities by the following labels: kube_cluster_name, kube_namespace_name, kube_workload_name, and kube_pod_name.

All Sources

All Sources Groupings allow you to use any label to build the infrastructure tree, regardless of the source. This makes them more flexible than the agent-only groupings. An example of an all-sources groupings is Azure Resources, which organizes the entities by the following labels: subscription_name, cloud_provider_region_name, resource_group, and cloud_provider_resource_name.

All Sources Groupings use real-time data only, that is, last 10-40 minutes.

Use Groupings

Create a Grouping