class LogStash::Filters::UserAgent
Parse user agent strings into structured data based on BrowserScope data
UserAgent
filter, adds information about user agent like family, operating system, version, and device
Logstash releases ship with the regexes.yaml database made available from ua-parser with an Apache 2.0 license. For more details on ua-parser, see <github.com/tobie/ua-parser/>.
Public Instance Methods
filter(event)
click to toggle source
# File lib/logstash/filters/useragent.rb, line 66 def filter(event) return unless filter?(event) ua_data = nil useragent = event[@source] useragent = useragent.first if useragent.is_a? Array begin ua_data = @parser.parse(useragent) rescue Exception => e @logger.error("Uknown error while parsing user agent data", :exception => e, :field => @source, :event => event) end if !ua_data.nil? if @target.nil? # default write to the root of the event target = event else target = event[@target] ||= {} end target[@prefix + "name"] = ua_data.name #OSX, Andriod and maybe iOS parse correctly, ua-agent parsing for Windows does not provide this level of detail unless ua_data.os.nil? target[@prefix + "os"] = ua_data.os.to_s target[@prefix + "os_name"] = ua_data.os.name.to_s target[@prefix + "os_major"] = ua_data.os.version.major.to_s unless ua_data.os.version.nil? target[@prefix + "os_minor"] = ua_data.os.version.minor.to_s unless ua_data.os.version.nil? end target[@prefix + "device"] = ua_data.device.to_s if not ua_data.device.nil? if not ua_data.version.nil? ua_version = ua_data.version target[@prefix + "major"] = ua_version.major target[@prefix + "minor"] = ua_version.minor target[@prefix + "patch"] = ua_version.patch if ua_version.patch target[@prefix + "build"] = ua_version.patch_minor if ua_version.patch_minor end filter_matched(event) end end
register()
click to toggle source
# File lib/logstash/filters/useragent.rb, line 40 def register require 'user_agent_parser' if @regexes.nil? begin @parser = UserAgentParser::Parser.new() rescue Exception => e begin if __FILE__ =~ /file:\/.*\.jar!/ # Running from a flatjar which has a different layout regexes_file = [__FILE__.split("!").first, "/vendor/ua-parser/regexes.yaml"].join("!") @parser = UserAgentParser::Parser.new(:patterns_path => regexes_file) else # assume operating from the git checkout @parser = UserAgentParser::Parser.new(:patterns_path => "vendor/ua-parser/regexes.yaml") end rescue => ex raise "Failed to cache, due to: #{ex}\n" end end else @logger.info("Using user agent regexes", :regexes => @regexes) @parser = UserAgentParser::Parser.new(:patterns_path => @regexes) end end