Hello, Is it possible to make the index filed for Apache or IIS or Nginx for the .access.user_agent.original string show up as searchable and aggregatable? I'd like to have this show up as sometimes all of the user agent fields show "other" which doesn't help me much.

Brett_Larson (Brett Larson) November 29, 2018, 4:58pm 3

Done - https://github.com/elastic/beats/issues/9291
Thank you!

Topic		Replies	Views
Storing and analyzing user agent strings, general approach Elasticsearch	4	4518	July 6, 2017
Nginx module and keyword fields Beats filebeat	3	1005	November 30, 2017
Customizing user agent ingestion Beats filebeat	3	761	June 13, 2017
[Resolve] Field from logstash not indexed Elasticsearch	4	2073	July 5, 2017
User Agent Raw Mapping Logstash	5	919	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Add iis.access.user_agent.original to be searchable / displayable?

Related topics