# Does the useragent filter produce two apparently identical os fields?

**URL:** <https://discuss.elastic.co/t/does-the-useragent-filter-produce-two-apparently-identical-os-fields/27270>\
**Category:** Logstash\
**Created:** [August 12, 2015, 3:23pm UTC](https://discuss.elastic.co/t/does-the-useragent-filter-produce-two-apparently-identical-os-fields/27270 "2015-08-12T15:23:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![LansK](https://avatars.discourse-cdn.com/v4/letter/l/dc4da7/32.png) [@LansK](https://discuss.elastic.co/u/LansK)\
**Post date:** [August 12, 2015, 3:23pm UTC](https://discuss.elastic.co/t/does-the-useragent-filter-produce-two-apparently-identical-os-fields/27270/1 "2015-08-12T15:23:30Z")

</div>

The useragent filter ([https://www.elastic.co/guide/en/logstash/current/plugins-filters-useragent.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-useragent.html)), when applied to the user agent that is produced by apache access logs (through the built in COMBINEDAPACHELOG pattern) appears to produce two fields that hold the exact same content: “os” and “os\_name”. I am just testing in a development environment, but do these two fields ever differ? I tried accessing a site from various OS’s (Windows/Linux) and both fields always contained the same information. I thought this may be a bug unless I am overlooking something that could cause these two fields to hold different information.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 13, 2015, 6:06am UTC](https://discuss.elastic.co/t/does-the-useragent-filter-produce-two-apparently-identical-os-fields/27270/2 "2015-08-13T06:06:58Z")

</div>

Yes, they occasionally differ. The most common case I've seen is for Mac OS X.

The `os` field contains the name and version of the operating system while `os.name` contains the name only. In practice, the parser rarely extracts the version of the operating system in which case `os` falls back to `os.name`. Of course, in the Windows case the version number/name is included in `os.name` (Windows Vista, Windows 7, Windows8, ...).

I've filed an issue for improving the documentation of this.

> <https://github.com/logstash-plugins/logstash-filter-useragent/issues/10>

---

<div class="post-metadata">

**Author:** ![LansK](https://avatars.discourse-cdn.com/v4/letter/l/dc4da7/32.png) [@LansK](https://discuss.elastic.co/u/LansK)\
**Post date:** [August 14, 2015, 1:19pm UTC](https://discuss.elastic.co/t/does-the-useragent-filter-produce-two-apparently-identical-os-fields/27270/3 "2015-08-14T13:19:56Z")

</div>

Thank you for clarifying. I'll look forward to the updated docs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/does-the-useragent-filter-produce-two-apparently-identical-os-fields/27270/4 "2017-07-06T05:31:57Z")

</div>

Closed on July 6, 2017, 5:31am UTC