Customizing user agent ingestion

(cubicme) #1

is there a way to use a custom regex for nginx user-agent plugin? I tried this with a different pipeline and it works, but when i do this in filebeat json file:
"user_agent": {
"field": "nginx.access.agent",
"target_field": "nginx.access.user_agent",
"regex_file": "regexes-custom.yaml"
it has no effect.

(Tudor Golubenco) #2

Just to make sure, you are using the Filebeat nginx module, right? Did you edit the module/nginx/access/ingest/default.json from the Filebeat distribution?

Note that you might have to delete the old pipeline. In the Kibana Console you can do something like: DELETE _ingest/pipeline/filebeat-*-nginx*

(cubicme) #3

well it's a modified one, i copied nginx module from the repository and
changed it.
yeah i tried clearing pipelines, and my config is there. Elastic will even
complain if my regex file isn't there but it's still not using the new
patterns from the file

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.