# Install ingest-user-agent on ELK

**URL:** <https://discuss.elastic.co/t/install-ingest-user-agent-on-elk/154429>\
**Category:** Logstash\
**Created:** [October 29, 2018, 10:59am UTC](https://discuss.elastic.co/t/install-ingest-user-agent-on-elk/154429 "2018-10-29T10:59:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rodrigue](https://avatars.discourse-cdn.com/v4/letter/r/f04885/32.png) [@rodrigue](https://discuss.elastic.co/u/rodrigue)\
**Post date:** [October 29, 2018, 10:59am UTC](https://discuss.elastic.co/t/install-ingest-user-agent-on-elk/154429/1 "2018-10-29T10:59:09Z")

</div>

Hello,  
I would like, in my elk stack, to be able to know which browser my users are using. I've added the user-agent header in my logs and I send it to elastic via filebeat and logstash. Everything works fine.  
Now I have my new field in my index :  
"userAgent": {  
"type": "text",  
"fields": {  
"keyword": {  
"type": "keyword",  
"ignore\_above": 256  
}  
}  
}  
And it has the right value (ex : Mozilla/5.0\_(Windows\_NT\_6.1)_AppleWebKit/537.36_(KHTML\_\_like\_Gecko)\_Chrome/65.0.3325.181\_Safari/537.36)

Now, I would like to use a plugin to be able to analyse the user-agent field and transform it into the browser name and version (Ex : Firefox V21). I search on the internet and found that plugin : ingest-user-agent. I found how to install it (with some kind of pipeline command)  
Could you please tell what I have to do to make it work? I've already installed the plugin, all I need to know is what I should change in my index to make the userAgent field transofm inot a userAgentDetail field containg the agent details given by the plugin?  
I found no documentation about how to use it with elk.  
Thanks for you help.

---

<div class="post-metadata">

**Author:** ![rodrigue](https://avatars.discourse-cdn.com/v4/letter/r/f04885/32.png) [@rodrigue](https://discuss.elastic.co/u/rodrigue)\
**Post date:** [October 29, 2018, 11:17am UTC](https://discuss.elastic.co/t/install-ingest-user-agent-on-elk/154429/2 "2018-10-29T11:17:46Z")

</div>

Just one more detail. I already use the geoip plugin. Is it the same for user-agent ? In order to make the geoip plugin work, I call the following line in my logstash filter (ip1 contains the ip, and geoip1 contains the ip details) :  
geoip {  
source =\> "ip1"  
target =\> "geoip1"  
}  
Could you tell me if there is an equivalent call for the user-agent?

---

<div class="post-metadata">

**Author:** ![rodrigue](https://avatars.discourse-cdn.com/v4/letter/r/f04885/32.png) [@rodrigue](https://discuss.elastic.co/u/rodrigue)\
**Post date:** [October 29, 2018, 11:45am UTC](https://discuss.elastic.co/t/install-ingest-user-agent-on-elk/154429/3 "2018-10-29T11:45:15Z")

</div>

Sorry for asking the question. I finally found the answer myself. I managed to make it work by adding the following lines in my logstash filter... (Once I remembered about the geoip plugin, I found the answered)  
useragent {  
source =\> "userAgent"  
target =\> "userAgentDetails"  
}  
So, you can close this ticket... Maybe it will help someone else to make it work... (Finally my problem was that I didn't find any doc on the internet because I wasn't using the right search phrase)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2018, 11:45am UTC](https://discuss.elastic.co/t/install-ingest-user-agent-on-elk/154429/4 "2018-11-26T11:45:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.