Unnesting user_agent fields using ingest processor

Elastic Stack Elasticsearch
1

After using user_agent processor, I am getting the results somewhat like this:
"user_agent" : {
"patch" : "1",
"major" : "5",
"minor" : "1",
"os" : "Android 5.1.1",
"os_minor" : "1",
"os_major" : "5",
"name" : "Android",
"os_name" : "Android",
"device" : "AFTT"
}

I want the fields inside user_agent to be split and parsed so that the JSON document looks like this
"user_agent" : {
"patch" : "1",
"major" : "5",
"minor" : "1",
"os" : "Android 5.1.1",
"os_minor" : "1",
"os_major" : "5",
"name" : "Android",
"os_name" : "Android",
"device" : "AFTT"
},
"patch" : "1",
"major" : "5",
"minor" : "1",
"os" : "Android 5.1.1",
"os_minor" : "1",
"os_major" : "5",
"name" : "Android",
"os_name" : "Android",
"device" : "AFTT"

2

You can use the set processor to copy every single field you want to another destination. See https://www.elastic.co/guide/en/elasticsearch/reference/6.6/set-processor.html

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.