# Useragent information
**URL:** https://discuss.elastic.co/t/useragent-information/277786
**Category:** Beats
**Tags:** filebeat
**Created:** [July 5, 2021, 8:08am UTC](https://discuss.elastic.co/t/useragent-information/277786 "2021-07-05T08:08:47Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@111401](https://discuss.elastic.co/u/111401)
#### Post date: [July 5, 2021, 8:08am UTC](https://discuss.elastic.co/t/useragent-information/277786/1 "2021-07-05T08:08:48Z")
Hi,
i had parsed netflow via filebeat 7.7.0 and send it to logstash 7.6.2 then elasticsearch 7.6.2, but i see the agent field is only about filebeat, not the client device information.
```auto
"agent" => {
"id" => "d5cd54a7-e74d-43b9-af3a-efd1c89a98a9",
"version" => "7.7.0",
"type" => "filebeat",
"ephemeral_id" => "761b46cc-fad1-4e14-a703-772afa9246be",
"hostname" => "localhost.localdomain"
}
```
how can i get the client device information like os, version, etc.
Thanks.
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [July 5, 2021, 8:28am UTC](https://discuss.elastic.co/t/useragent-information/277786/2 "2021-07-05T08:28:13Z")
This "agent" isn't related to user agent at all. It's related to the Beat process: [Beat fields | Filebeat Reference [7.13] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-beat-common.html)
Speaking of netflow - could you please share your configuration?
---
### Author:  [@111401](https://discuss.elastic.co/u/111401)
#### Post date: [July 5, 2021, 8:51am UTC](https://discuss.elastic.co/t/useragent-information/277786/3 "2021-07-05T08:51:47Z")
Thanks for your reply, you mean the filebeat configuration or logstash?
---
### Author:  [@111401](https://discuss.elastic.co/u/111401)
#### Post date: [July 15, 2021, 10:05am UTC](https://discuss.elastic.co/t/useragent-information/277786/4 "2021-07-15T10:05:53Z")
Hi,
I use the netflow module in filebeat and here is my configuration.
```
#============================= Filebeat modules ===============================v
- module: netflow
log:
enabled: true
var:
netflow_host: 192.168.0.45
netflow_port: 2055
protocols: [v9]
```
---
### Author:  [@rcowart](https://discuss.elastic.co/u/rcowart)
#### Post date: [July 15, 2021, 9:37pm UTC](https://discuss.elastic.co/t/useragent-information/277786/5 "2021-07-15T21:37:26Z")
You will only see a given Netflow-related field if it is contained in the record sent by the device. `netflow.http_user_agent` is populated from the [IPFIX standard field](https://www.iana.org/assignments/ipfix/ipfix.xhtml) 468: httpUserAgent.
We have data from 100s of different devices, and we have never seen this field sent by any of them. Almost all vendors send such information via proprietary fields, most of which are unsupported by Filebeat.
---
### Author:  [@111401](https://discuss.elastic.co/u/111401)
#### Post date: [July 19, 2021, 3:51am UTC](https://discuss.elastic.co/t/useragent-information/277786/6 "2021-07-19T03:51:07Z")
Thank you for your reply, so it is mean the reason that I can't parsing `netflow.http_user_agent` field is my Cisco device did not provide, am I right?
---
### Author:  [@rcowart](https://discuss.elastic.co/u/rcowart)
#### Post date: [July 19, 2021, 8:56am UTC](https://discuss.elastic.co/t/useragent-information/277786/7 "2021-07-19T08:56:04Z")
Yes. That is probably the case. You can always do a PCAP of the incoming records and confirm.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 16, 2021, 10:56am UTC](https://discuss.elastic.co/t/useragent-information/277786/8 "2021-08-16T10:56:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.