Combine IIS userAgent values

Elastic Stack Kibana
1

Hi,

I am trying to create a simple pie chart of IIS userAgent data in Kibana and I'm curious if there is a way to combine 'like' values. For example, I receive:

Microsoft+Office/14.0
Microsoft+Office/16.0

Apple-Iphone8C1
Apple-Iphone7C2
Apple-Iphone9C1
Apple-Iphone9C3

These are all listed as separate counts. Can I combine these into less specific counts as:

Microsoft+Office*
Apple-Iphone*

Would this be done by creating a custom field on the Logstash side?

Any guidance is appreciated.

Thanks,

HB

1 Like
2

Sorry, I should have added that I am using Metricbeat, Logstash, and Kibana versions 5.5.2.

Thanks,

HB

3

I am assuming you are able to parse and store user_agent in Elasticsearch.
You can use filters in Kibana.

  1. Visualize -> Add New -> Pie
  2. Split Slices -> Filters (aggregation) -> Filter 1 -> user_agent:Microsoft*
  3. Add Filter -> Filter 2 -> user_agent:Apple*

(assuming your field name is user_agent)

4

Thank you @kmsasidhar. That is exactly what I needed, I appreciate the help..

HB

1 Like
5

Welcome. I got help from this forum many times! :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.