Add iis.access.user_agent.original to be searchable / displayable?


(Brett Larson) #1

Hello,
Is it possible to make the index filed for Apache or IIS or Nginx for the .access.user_agent.original string show up as searchable and aggregatable?

I'd like to have this show up as sometimes all of the user agent fields show "other" which doesn't help me much.


(Noémi Ványi) #2

Do you mind opening a new enhancement request on Github? https://github.com/elastic/beats/issues/new?template=feature-request.md


(Brett Larson) #3

Done - https://github.com/elastic/beats/issues/9291
Thank you!


(Philip Nunn) #4

In the interim, if they do decide to add the feature, you could always create a new filebeat template (setting the order number higher than the built-in templates which I believe for the latest version of filebeat are set to 1. Using this template should do the trick (change the index pattern if you need to):

PUT _template/filebeat-custom
{
  "order" : 2,
  "index_patterns" : [
    "filebeat-6.5.1-*"
  ],
  "mappings" : {
    "doc" : {
      "properties" : {
        "apache2" : {
          "properties" : {
            "access" : {
              "properties" : {
                "user_agent" : {
                  "properties" : {
                    "original" : {
                      "type" : "keyword",
                      "ignore_above" : 1024
                    }
                  }
                }
              }
            }
          }
        },
        "iis" : {
          "properties" : {
            "access" : {
              "properties" : {
                "user_agent" : {
                  "properties" : {
                    "original" : {
                      "type" : "keyword",
                      "ignore_above" : 1024
                    }
                  }
                }
              }
            }
          }
        },
        "nginx" : {
          "properties" : {
            "access" : {
              "properties" : {
                "user_agent" : {
                  "properties" : {
                    "original" : {
                      "type" : "keyword",
                      "ignore_above" : 1024
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "aliases" : { }
}