Skip to content

user-agent.md

Latest commit

 

History

History
65 lines (53 loc) · 3.02 KB

user-agent.md

File metadata and controls

65 lines (53 loc) · 3.02 KB
Raw
applies_to
serverless stack
ga
ga 9.5+
products
id
observability
id
elasticsearch
id
kibana
id
cloud-serverless
id
cloud-hosted
id
cloud-enterprise
id
cloud-kubernetes
id
elastic-stack
description Extract browser, OS, and device details from a user agent string with the Streams user agent processor in Streamlang.

User agent processor [streams-user-agent-processor]

The User agent processor extracts browser, operating system, and device details from a user agent string.

To extract user agent details:

  1. Select Create → Create processor.
  2. Select User agent from the Processor menu.
  3. Set the Source Field to the field containing the user agent string.
  4. (Optional) Set Target field to the field that will contain the extracted details. Defaults to user_agent.
  5. (Optional) Expand the accordion to configure:
    • Regex file: A custom regex file name containing the regular expressions used to parse the user agent string.
    • Properties: The specific properties to extract. Defaults to all: name, os, device, original, version.
    • Extract device type: Extracts the device type from the user agent string. This functionality is in beta and is subject to change.

This functionality uses the {{es}} User agent processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

YAML reference [streams-user-agent-yaml-reference]

In YAML mode, configure the user agent processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter Type Required Description
from string Yes Field containing the user agent string.
to string No Field that will contain the extracted user agent details. Defaults to user_agent.
regex_file string No Custom regex file name containing the regular expressions for parsing the user agent string.
properties string[] No Properties to extract: name, os, device, original, version. Defaults to all.
extract_device_type boolean No When true, extracts the device type from the user agent string.
ignore_missing boolean No When true, skip this processor if the source field is missing. 
- action: user_agent
  from: attributes.user_agent.original
  to: attributes.user_agent

Given a document with:

{
  "attributes": {
    "user_agent": {
      "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0"
    }
  }
}

The processor adds attributes.user_agent.name: "Chrome" and attributes.user_agent.os.name: "Mac OS X", alongside the other extracted properties.