class LogStash::Filters::UserAgent

Parse user agent strings into structured data based on BrowserScope data

UserAgent filter, adds information about user agent like family, operating system, version, and device

Logstash releases ship with the regexes.yaml database made available from ua-parser with an Apache 2.0 license. For more details on ua-parser, see <github.com/tobie/ua-parser/>.

Public Instance Methods

filter(event) click to toggle source
# File lib/logstash/filters/useragent.rb, line 66
def filter(event)
  return unless filter?(event)
  ua_data = nil

  useragent = event[@source]
  useragent = useragent.first if useragent.is_a? Array

  begin
    ua_data = @parser.parse(useragent)
  rescue Exception => e
    @logger.error("Uknown error while parsing user agent data", :exception => e, :field => @source, :event => event)
  end

  if !ua_data.nil?
    if @target.nil?
      # default write to the root of the event
      target = event
    else
      target = event[@target] ||= {}
    end

    target[@prefix + "name"] = ua_data.name

    #OSX, Andriod and maybe iOS parse correctly, ua-agent parsing for Windows does not provide this level of detail
    unless ua_data.os.nil?
      target[@prefix + "os"] = ua_data.os.to_s
      target[@prefix + "os_name"] = ua_data.os.name.to_s
      target[@prefix + "os_major"] = ua_data.os.version.major.to_s unless ua_data.os.version.nil?
      target[@prefix + "os_minor"] = ua_data.os.version.minor.to_s unless ua_data.os.version.nil?
    end

    target[@prefix + "device"] = ua_data.device.to_s if not ua_data.device.nil?

    if not ua_data.version.nil?
      ua_version = ua_data.version
      target[@prefix + "major"] = ua_version.major
      target[@prefix + "minor"] = ua_version.minor
      target[@prefix + "patch"] = ua_version.patch if ua_version.patch
      target[@prefix + "build"] = ua_version.patch_minor if ua_version.patch_minor 
    end

    filter_matched(event)
  end

end
register() click to toggle source
# File lib/logstash/filters/useragent.rb, line 40
def register
  require 'user_agent_parser'
  if @regexes.nil?
    begin
      @parser = UserAgentParser::Parser.new()
    rescue Exception => e
      begin
        if __FILE__ =~ /file:\/.*\.jar!/
          # Running from a flatjar which has a different layout
          regexes_file = [__FILE__.split("!").first, "/vendor/ua-parser/regexes.yaml"].join("!")
          @parser = UserAgentParser::Parser.new(:patterns_path => regexes_file)
        else
          # assume operating from the git checkout
          @parser = UserAgentParser::Parser.new(:patterns_path => "vendor/ua-parser/regexes.yaml")
        end
      rescue => ex
        raise "Failed to cache, due to: #{ex}\n"
      end
    end
  else
    @logger.info("Using user agent regexes", :regexes => @regexes)
    @parser = UserAgentParser::Parser.new(:patterns_path => @regexes)
  end
end