Skip to main content
Version: 1.5.0

User Agent

Parse Elastic Compatible

Synopsis​

Parses user agent strings to extract information about the browser, operating system, and device.

Schema​

- user_agent:
    field: <ident>
    description: <text>
    extract_device_type: <boolean>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    properties: <enum>
    tag: <string>
    target_field: <ident>

Configuration​

The following fields are used to define the processor:

FieldRequiredDefaultDescription
fieldY-Field containing the user agent string
descriptionN-Explanatory note
extract_device_typeNfalseExtract device type information
ifN-Condition to run
ignore_failureNfalseSee Handling Failures
ignore_missingNfalseIf true, quietly exit if field doesn't exist
on_failureN-See Handling Failures
on_successN-See Handling Success
propertiesNallProperties to include in output
tagN-Identifier
target_fieldNuser_agentField to store the parsed details

Details​

The processor extracts key information including browser name and version, operating system details, and device platform. It handles a wide range of user agent formats and can store the parsed information in a structured format.

warning

Some user agents may be spoofed or contain incorrect information. The information is provided as reported without validating its accuracy.

Examples​

Full User Agent​

Parsing a detailed Chrome user agent...

{
  "agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
}
- user_agent:
    field: agent
    target_field: user_agent

extracts all the available information:

{
  "user_agent": {
    "name": "Chrome",
    "version": "51.0.2704.103",
    "os": {
      "name": "Intel Mac OS X 10_10_5"
    },
    "device": {
      "name": "Macintosh"
    },
    "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"
  }
}

Invalid User Agents​

Processing an invalid or unknown user agent...

{
  "agent": "InvalidUserAgent"
}
- user_agent:
    field: agent
    ignore_failure: true

preserves the original string:

{
  "user_agent": {
    "original": "InvalidUserAgent"
  }
}

Keep Original​

Storing the parsed details in a specific field...

{
  "browser": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1"
}
- user_agent:
    field: browser
    target_field: browser_details
    extract_device_type: true

includes the device information:

{
  "browser_details": {
    "name": "Safari",
    "version": "14.0",
    "os": {
      "name": "iOS 14.0"
    },
    "device": {
      "name": "iPhone"
    },
    "original": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1"
  }
}