# Combine IIS userAgent values

**URL:** <https://discuss.elastic.co/t/combine-iis-useragent-values/99491>\
**Category:** Kibana\
**Created:** [September 5, 2017, 9:44pm UTC](https://discuss.elastic.co/t/combine-iis-useragent-values/99491 "2017-09-05T21:44:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hburnswell](https://avatars.discourse-cdn.com/v4/letter/h/9e8a1a/32.png) [@hburnswell](https://discuss.elastic.co/u/hburnswell)\
**Post date:** [September 5, 2017, 9:44pm UTC](https://discuss.elastic.co/t/combine-iis-useragent-values/99491/1 "2017-09-05T21:44:46Z")

</div>

Hi,

I am trying to create a simple pie chart of IIS userAgent data in Kibana and I'm curious if there is a way to combine 'like' values. For example, I receive:

> Microsoft+Office/14.0  
> Microsoft+Office/16.0
> 
> Apple-Iphone8C1  
> Apple-Iphone7C2  
> Apple-Iphone9C1  
> Apple-Iphone9C3

These are all listed as separate counts. Can I combine these into less specific counts as:

> Microsoft+Office\*  
> Apple-Iphone\*

Would this be done by creating a custom field on the Logstash side?

Any guidance is appreciated.

Thanks,

HB

---

<div class="post-metadata">

**Author:** ![hburnswell](https://avatars.discourse-cdn.com/v4/letter/h/9e8a1a/32.png) [@hburnswell](https://discuss.elastic.co/u/hburnswell)\
**Post date:** [September 5, 2017, 9:46pm UTC](https://discuss.elastic.co/t/combine-iis-useragent-values/99491/2 "2017-09-05T21:46:13Z")

</div>

Sorry, I should have added that I am using Metricbeat, Logstash, and Kibana versions 5.5.2.

Thanks,

HB

---

<div class="post-metadata">

**Author:** ![kmsasidhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmsasidhar/32/21838_2.png) [@kmsasidhar](https://discuss.elastic.co/u/kmsasidhar)\
**Post date:** [September 6, 2017, 12:38am UTC](https://discuss.elastic.co/t/combine-iis-useragent-values/99491/3 "2017-09-06T00:38:06Z")

</div>

I am assuming you are able to parse and store user\_agent in Elasticsearch.  
You can use filters in Kibana.

1. Visualize -\> Add New -\> Pie
2. Split Slices -\> Filters (aggregation) -\> Filter 1 -\> user\_agent:Microsoft\*
3. Add Filter -\> Filter 2 -\> user\_agent:Apple\*

(assuming your field name is user\_agent)

---

<div class="post-metadata">

**Author:** ![hburnswell](https://avatars.discourse-cdn.com/v4/letter/h/9e8a1a/32.png) [@hburnswell](https://discuss.elastic.co/u/hburnswell)\
**Post date:** [September 7, 2017, 1:09pm UTC](https://discuss.elastic.co/t/combine-iis-useragent-values/99491/4 "2017-09-07T13:09:55Z")

</div>

Thank you @kmsasidhar. That is exactly what I needed, I appreciate the help..

HB

---

<div class="post-metadata">

**Author:** ![kmsasidhar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmsasidhar/32/21838_2.png) [@kmsasidhar](https://discuss.elastic.co/u/kmsasidhar)\
**Post date:** [September 7, 2017, 5:24pm UTC](https://discuss.elastic.co/t/combine-iis-useragent-values/99491/5 "2017-09-07T17:24:25Z")

</div>

Welcome. I got help from this forum many times! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2017, 5:24pm UTC](https://discuss.elastic.co/t/combine-iis-useragent-values/99491/6 "2017-10-05T17:24:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.