# User-agent filter does not handle "+" as space in ua-strings from IIS **URL:** \ **Category:** Logstash\ **Created:** [May 30, 2016, 4:34am UTC](https://discuss.elastic.co/t/user-agent-filter-does-not-handle-as-space-in-ua-strings-from-iis/51263 "2016-05-30T04:34:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bradley.bristowstagg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradley.bristowstagg/32/9954_2.png) [@bradley.bristowstagg](https://discuss.elastic.co/u/bradley.bristowstagg)\ **Post date:** [May 30, 2016, 4:34am UTC](https://discuss.elastic.co/t/user-agent-filter-does-not-handle-as-space-in-ua-strings-from-iis/51263/1 "2016-05-30T04:34:42Z")
Hey all, I'm using logstash 2.3 to pull in IIS logs into our little ES cluster running on site. Things are going well (albeit slowly) and now I can start to troll through some of our data I'm seeing a LOT of results from the user-agent filter return as either Other or Generic Smartphone (iPhone and iPad are in the lead). Looking deeper, the first issue was that the regexes.yml file supplied with logstash is WAAAAY out of date. Replaced that and have (along with others) requested pull's on the github page [https://github.com/logstash-plugins/logstash-filter-useragent/pull/15](https://github.com/logstash-plugins/logstash-filter-useragent/pull/15) Second issue is that a lot of the log entries are like this: 2015-12-30 00:00:04 10.131.23.197 POST /handheld/resource/jobsheet/index.cfm - 443 - 1.129.96.46 Mozilla/5.0+(iPhone;+CPU+iPhone+OS+8\_1\_2+like+Mac+OS+X)+AppleWebKit/600.1.4+(KHTML,+like+Gecko)+Version/8.0+Mobile/12B440+Safari/600.1.4 200 0 0 36419 237 The user-agent string is (for whatever reason) replacing the standard spaces with "+" and it's this (I believe) that's causing the inaccurate matches. How can we get the logstash-filter-useragent updated for both; latest regexes file AND support "+" as space? ---
**Author:** ![bhatch](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@bhatch](https://discuss.elastic.co/u/bhatch)\ **Post date:** [May 31, 2016, 6:02pm UTC](https://discuss.elastic.co/t/user-agent-filter-does-not-handle-as-space-in-ua-strings-from-iis/51263/2 "2016-05-31T18:02:01Z")
We had a similar issue. We ended up just manually modifying the regexes.yaml file. So - regex: '(Windows NT 6.1)' os\_replacement: 'Windows 7' became: - regex: '(Windows+NT+6.1)' os\_replacement: 'Windows 7' It is recommended that you put these into a new file and not edit the default file. Otherwise it might get overwritten when upgrading plugins. We also kept the original value too as the user agent from Apache uses a space. If someone has a better solution I would love to hear it. This means we can't automatically upgrade to a newer version of the file when new OS's come out. ---
**Author:** ![imperatives](https://avatars.discourse-cdn.com/v4/letter/i/54ee81/32.png) [@imperatives](https://discuss.elastic.co/u/imperatives)\ **Post date:** [June 7, 2016, 6:27pm UTC](https://discuss.elastic.co/t/user-agent-filter-does-not-handle-as-space-in-ua-strings-from-iis/51263/3 "2016-06-07T18:27:49Z")
I came across this issue and used the following in my filter to remove the "+" and add a space. If you improve on this or have other suggestions for IIS logs please share. mutate { gsub =\> [ # replace + with a space " " "useragent", "[+]", " " ] } ---
**Author:** ![bradley.bristowstagg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradley.bristowstagg/32/9954_2.png) [@bradley.bristowstagg](https://discuss.elastic.co/u/bradley.bristowstagg)\ **Post date:** [June 7, 2016, 11:10pm UTC](https://discuss.elastic.co/t/user-agent-filter-does-not-handle-as-space-in-ua-strings-from-iis/51263/4 "2016-06-07T23:10:55Z")
Yea, that's what I ended up doing. Still getting a lot of unknowns so guessing there's more issues. Looking at somehow integrating calls to this service: [http://www.handsetdetection.com/features](http://www.handsetdetection.com/features) though that in itself may add too much overhead and delay. ---
**Author:** ![bradley.bristowstagg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bradley.bristowstagg/32/9954_2.png) [@bradley.bristowstagg](https://discuss.elastic.co/u/bradley.bristowstagg)\ **Post date:** [February 28, 2017, 2:07am UTC](https://discuss.elastic.co/t/user-agent-filter-does-not-handle-as-space-in-ua-strings-from-iis/51263/5 "2017-02-28T02:07:10Z")
Sorry for the necro, but they've finally released a decent logstash plugin for detailed handset data: > **[HandsetDetection/logstash-filter-handsetdetection](https://github.com/HandsetDetection/logstash-filter-handsetdetection)** > > logstash-filter-handsetdetection - A logstash filter for Handset Detection API v4. Enrich your logs with all sorts of device information. :-) We're using it on all of our IIS logs and now we can split the data out by device type manufacturer, etc, etc. very very rich logs!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/user-agent-filter-does-not-handle-as-space-in-ua-strings-from-iis/51263/6 "2017-07-06T04:28:14Z")
Closed on July 6, 2017, 4:28am UTC