user_agent

The user_agent processor parses any user agent (UA) string in an event and then adds the parsing results to the event’s write data.

Usage

In this example, the user_agent processor calls the source that contains the UA string, the ua field, and indicates the key to which the parsed string will write, user_agent, as shown in the following example:

  1.   processor:
  2.     - user_agent:
  3.         source: "ua"
  4.         target: "user_agent"

The following example event contains the ua field with a string that provides information about a user:

  1. {
  2.   "ua":  "Mozilla/5.0 (iPhone; CPU iPhone OS 13_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1"
  3. }

The user_agent processor parses the string into a format compatible with Elastic Common Schema (ECS) and then adds the result to the specified target, as shown in the following example:

  1. {
  2.   "user_agent": {
  3.     "original": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1",
  4.     "os": {
  5.         "version": "13.5.1",
  6.         "full": "iOS 13.5.1",
  7.         "name": "iOS"
  8.     },
  9.     "name": "Mobile Safari",
  10.     "version": "13.1.1",
  11.     "device": {
  12.         "name": "iPhone"
  13.     }
  14.   },
  15.   "ua":  "Mozilla/5.0 (iPhone; CPU iPhone OS 13_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1"
  16. }

Configuration options

You can use the following configuration options with the user_agent processor.

OptionRequiredDescription
sourceYesThe field in the event that will be parsed.
targetNoThe field to which the parsed event will write. Default is user_agent.
exclude_originalNoDetermines whether to exclude the original UA string from the parsing result. Defaults to false.
cache_sizeNoThe cache size of the parser in megabytes. Defaults to 1000.
tags_on_parse_failureNoThe tag to add to an event if the user_agent processor fails to parse the UA string.