Groupings provides a hierarchical view of an infrastructure entities and is available in Explore.


With Groupings, you can segment your infrastructure by any label. While Monitor offers some out-of-the-box groupings, the real value of Groupings comes from the ability to create your own.

Sysdig Monitor offers two types of Groupings:

Define Groupings


When creating a grouping, you can specify a scope to restrict which entities will be considered when populating the Hierarchy.

For example, defining a grouping that only displays Cronjobs. In the scenario given below, kube_workload_type is cronjob is added as a Scope filter.

The filter then ensures that the only workloads displayed in the Hierarchy are Cronjobs.


You can use two sources when defining a grouping.

GroupingsLabel sourceData used
Agent OnlyAny label from Extended Label Set (also known as Service Vision), emitted by any Sysdig Agent.Historical data in accordance to the time window selected.
All SourcesAny label, regardless of source.Real-time only (last 10-40 mins).

Agent Only

Agent Only Groupings are the oldest type of Groupings in Sysdig Monitor. They use any extended label emitted by any Sysdig Agent to build the infrastructure tree. These groupings accurately reflect the state of your infrastructure as the time navigation is shifted back in time. The most commonly used agent-only grouping is All Workloads, which organizes the infrastructure entities by the following labels: kube_cluster_name, kube_namespace_name, kube_workload_name, and kube_pod_name.

All Sources

All Sources Groupings allow you to use any label to build the infrastructure tree, regardless of the source. This makes them more flexible than the agent-only groupings. An example of an all-sources groupings is Azure Resources, which organizes the entities by the following labels: subscription_name, cloud_provider_region_name, resource_group, and cloud_provider_resource_name.

All Sources Groupings use real-time data only, that is, last 10-40 minutes.

Use Groupings

Create a Grouping

In the Explore tab, click the Groupings drop-down.

Click +.

In the new modal, click Add.

Specify your Grouping Name, sharing settings, Scope, Source, and grouping Hierarchy. Click Save & Apply.