Combine IIS userAgent values

[hburnswell]

Hi,

I am trying to create a simple pie chart of IIS userAgent data in Kibana and I'm curious if there is a way to combine 'like' values. For example, I receive:

Microsoft+Office/14.0
Microsoft+Office/16.0

Apple-Iphone8C1
Apple-Iphone7C2
Apple-Iphone9C1
Apple-Iphone9C3

These are all listed as separate counts. Can I combine these into less specific counts as:

Microsoft+Office*
Apple-Iphone*

Would this be done by creating a custom field on the Logstash side?

Any guidance is appreciated.

Thanks,

HB

[hburnswell]

Sorry, I should have added that I am using Metricbeat, Logstash, and Kibana versions 5.5.2.

Thanks,

HB

[kmsasidhar (SasidharReddy)]

I am assuming you are able to parse and store user_agent in Elasticsearch.
You can use filters in Kibana.

1. Visualize -> Add New -> Pie
2. Split Slices -> Filters (aggregation) -> Filter 1 -> user_agent:Microsoft*
3. Add Filter -> Filter 2 -> user_agent:Apple*

(assuming your field name is user_agent)

[hburnswell]

Thank you @kmsasidhar. That is exactly what I needed, I appreciate the help..

HB

[kmsasidhar (SasidharReddy)]

Welcome. I got help from this forum many times!