# Add iis.access.user\_agent.original to be searchable / displayable?

**URL:** <https://discuss.elastic.co/t/add-iis-access-user-agent-original-to-be-searchable-displayable/158647>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 28, 2018, 8:19pm UTC](https://discuss.elastic.co/t/add-iis-access-user-agent-original-to-be-searchable-displayable/158647 "2018-11-28T20:19:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brett\_Larson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brett_larson/32/37700_2.png) [@Brett\_Larson](https://discuss.elastic.co/u/Brett_Larson)\
**Post date:** [November 28, 2018, 8:19pm UTC](https://discuss.elastic.co/t/add-iis-access-user-agent-original-to-be-searchable-displayable/158647/1 "2018-11-28T20:19:37Z")

</div>

Hello,  
Is it possible to make the index filed for Apache or IIS or Nginx for the .access.user\_agent.original string show up as searchable and aggregatable?

I'd like to have this show up as sometimes all of the user agent fields show "other" which doesn't help me much.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [November 28, 2018, 8:50pm UTC](https://discuss.elastic.co/t/add-iis-access-user-agent-original-to-be-searchable-displayable/158647/2 "2018-11-28T20:50:21Z")

</div>

Do you mind opening a new enhancement request on Github? [https://github.com/elastic/beats/issues/new?template=feature-request.md](https://github.com/elastic/beats/issues/new?template=feature-request.md)

---

<div class="post-metadata">

**Author:** ![Brett\_Larson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brett_larson/32/37700_2.png) [@Brett\_Larson](https://discuss.elastic.co/u/Brett_Larson)\
**Post date:** [November 29, 2018, 4:58pm UTC](https://discuss.elastic.co/t/add-iis-access-user-agent-original-to-be-searchable-displayable/158647/3 "2018-11-29T16:58:57Z")

</div>

Done - [https://github.com/elastic/beats/issues/9291](https://github.com/elastic/beats/issues/9291)  
Thank you!

---

<div class="post-metadata">

**Author:** ![bigphil](https://avatars.discourse-cdn.com/v4/letter/b/65b543/32.png) [@bigphil](https://discuss.elastic.co/u/bigphil)\
**Post date:** [November 29, 2018, 8:48pm UTC](https://discuss.elastic.co/t/add-iis-access-user-agent-original-to-be-searchable-displayable/158647/4 "2018-11-29T20:48:43Z")

</div>

In the interim, if they do decide to add the feature, you could always create a new filebeat template (setting the order number higher than the built-in templates which I believe for the latest version of filebeat are set to 1. Using this template should do the trick (change the index pattern if you need to):

```
PUT _template/filebeat-custom
{
  "order" : 2,
  "index_patterns" : [
    "filebeat-6.5.1-*"
  ],
  "mappings" : {
    "doc" : {
      "properties" : {
        "apache2" : {
          "properties" : {
            "access" : {
              "properties" : {
                "user_agent" : {
                  "properties" : {
                    "original" : {
                      "type" : "keyword",
                      "ignore_above" : 1024
                    }
                  }
                }
              }
            }
          }
        },
        "iis" : {
          "properties" : {
            "access" : {
              "properties" : {
                "user_agent" : {
                  "properties" : {
                    "original" : {
                      "type" : "keyword",
                      "ignore_above" : 1024
                    }
                  }
                }
              }
            }
          }
        },
        "nginx" : {
          "properties" : {
            "access" : {
              "properties" : {
                "user_agent" : {
                  "properties" : {
                    "original" : {
                      "type" : "keyword",
                      "ignore_above" : 1024
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "aliases" : { }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2018, 8:48pm UTC](https://discuss.elastic.co/t/add-iis-access-user-agent-original-to-be-searchable-displayable/158647/5 "2018-12-27T20:48:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.