# Logstash user-agent filter can't parse the user agent os with version

**URL:** <https://discuss.elastic.co/t/logstash-user-agent-filter-cant-parse-the-user-agent-os-with-version/240937>\
**Category:** Logstash\
**Created:** [July 13, 2020, 9:49am UTC](https://discuss.elastic.co/t/logstash-user-agent-filter-cant-parse-the-user-agent-os-with-version/240937 "2020-07-13T09:49:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![chairxiao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chairxiao/32/72318_2.png) [@chairxiao](https://discuss.elastic.co/u/chairxiao)\
**Post date:** [July 13, 2020, 9:49am UTC](https://discuss.elastic.co/t/logstash-user-agent-filter-cant-parse-the-user-agent-os-with-version/240937/1 "2020-07-13T09:49:05Z")

</div>

Hello,

My logstash's version is 7.7.1

I use the logstash user agent to parse the url,but i can't get the user agent os with version

I got the parse info as blow:

```auto
              "name" => "Firefox",
           "os_name" => "Windows",
          "original" => "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2) Gecko/20100115 Firefox/3.6",
             "minor" => "6",
                "os" => "Windows",
             "major" => "3",

```

I use the elasticsearch urldecode processor to parse the url

```auto

PUT _ingest/pipeline/user_agent
{
  "description" : "Add user agent information",
  "processors" : [
    {
      "user_agent" : {
        "field" : "agent"
      }
    }
  ]
}

PUT my_index/_doc/my_id?pipeline=user_agent
{
  "agent": "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2) Gecko/20100115 Firefox/3.6"
}

GET my_index/_doc/my_id

```

the result is

```auto
{
  "_index" : "my_index",
  "_type" : "_doc",
  "_id" : "my_id",
  "_version" : 1,
  "_seq_no" : 8,
  "_primary_term" : 1,
  "found" : true,
  "_source" : {
    "agent" : "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2) Gecko/20100115 Firefox/3.6",
    "user_agent" : {
      "original" : "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2) Gecko/20100115 Firefox/3.6",
      "os" : {
        "name" : "Windows",
        "version" : "XP",
        "full" : "Windows XP"
      },
      "name" : "Firefox",
      "device" : {
        "name" : "Other"
      },
      "version" : "3.6."
    }
  }
}

```

i check the elasticsearch file,it use the same regexes.yaml to parse the url with logstash.Why the result is defferent?

for the right parse is that:

```auto
"os" => "Windows XP"

```

---

<div class="post-metadata">

**Author:** ![chairxiao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chairxiao/32/72318_2.png) [@chairxiao](https://discuss.elastic.co/u/chairxiao)\
**Post date:** [July 16, 2020, 10:08am UTC](https://discuss.elastic.co/t/logstash-user-agent-filter-cant-parse-the-user-agent-os-with-version/240937/2 "2020-07-16T10:08:29Z")

</div>

Nobody help 😹 I can't go on 🙏

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2020, 10:18am UTC](https://discuss.elastic.co/t/logstash-user-agent-filter-cant-parse-the-user-agent-os-with-version/240937/3 "2020-08-13T10:18:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.