We use Kibana to analyse the HTTP logs of on our CDN.
One important field is the user agent. From the user agent I can see which device was requesting an HTTP request from the CDN.
I would like to gather statistics on how much each device type uses our services. Therefore, in a visualization, I create filters with this format: c_user_agent: <first n characters of the user agent>*
This does not require nor accept the user agent string to be in quotes, but it fails because the user agents of our own devices actually have spaces in them. Their format is something like this: <device type family>/<version> <device type><more stuff>
Notice the space between the version and the device type.
It doesn't appear to be possible to escape this space in Lycene or KQL, at least not with a backslash.
KQL should still be able to search on a field where values contain spaces, as long as it is using a text multifield (not keyword). Searches containing spaces must be quoted.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.