User Agent Filter Not Working

Elastic Stack Logstash
1

I'm not sure what happend but in my migration from 7.0 to 7.2, the user agent filter has stopped identifying properly. For example, given the following user agent mozilla/5.0 (windows nt 10.0; win64; x64; rv:69.0) gecko/20100101 firefox/69.0 and the following pipeline config:

    useragent {
      source => "clientrequestuseragent"
      target => "[client][user_agent]"
    }

I get the following values:

image

I've even tried grabbing the raw regexes.yaml file and specifying it in my useragent config but it makes no difference.

Any ideas?

2

Case sensitivity.

"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/69.0"

gets parsed as

    "user_agent" => {
          "build" => "",
             "os" => "Windows",
         "device" => "Other",
           "name" => "Firefox",
          "minor" => "0",
          "major" => "69",
        "os_name" => "Windows"
    }

Folding it to lowercase results in everything being Other.

3

Well crap. If I lowercase the regexes file, will that resolve the issue or is there something else in the plugin that prevents that from working?

4

If the regexps only use \d, \s, -, . then it could work. Obviously if any of them \W or another uppercase pattern then folding the regexp would change its meaning.

1 Like
5

Aww crap....I totally forgot about all that...I opened the file in Notepad++, selected everything, and hit lowercase. It's working now...but there may be some that are not working right.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.