We use Kibana to analyse the HTTP logs of on our CDN.
One important field is the user agent. From the user agent I can see which device was requesting an HTTP request from the CDN.
I would like to gather statistics on how much each device type uses our services. Therefore, in a visualization, I create filters with this format:
c_user_agent: <first n characters of the user agent>*
This does not require nor accept the user agent string to be in quotes, but it fails because the user agents of our own devices actually have spaces in them. Their format is something like this:
<device type family>/<version> <device type><more stuff>
Notice the space between the version and the device type.
It doesn't appear to be possible to escape this space in Lycene or KQL, at least not with a backslash.
Is there any other way to do this?