Useragent plugin - android 9 and 10

Elastic Stack Logstash
1

The parse of an Android 9 or 10 useragent is partial. For example, the fields user_agentos_major, user_agentos_minor do not exist.

Example useragent:

Mozilla/5.0 (Linux; Android 9; Redmi Note 7 Build/PKQ1.180904.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.106 Mobile Safari/537.36

Mozilla/5.0 (Linux; Android 10; moto g(7) play Build/QPY30.52-22; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/80.0.3987.149 Mobile Safari/537.36

Plugin version: logstash-filter-useragent (3.2.4)

2

That feels like a bug to me. The regex (here) has two capture groups, which set the os name and os_major_version. However, the filter appears to only set the os_major_version if it also has os_minor_version!

if os.minor && os.major
    event.set(@prefixed_os_major, os.major.dup.force_encoding(Encoding::UTF_8)) if os.major
    event.set(@prefixed_os_minor, os.minor.dup.force_encoding(Encoding::UTF_8)) if os.minor
end

makes no sense to me. Both event.set calls are conditional on things that have just been tested and proven true. Perhaps

if os.minor || os.major

was intended. Or maybe

if os.major
    event.set(@prefixed_os_major, os.major.dup.force_encoding(Encoding::UTF_8))
    event.set(@prefixed_os_minor, os.minor.dup.force_encoding(Encoding::UTF_8)) if os.minor
end

It is anybody's guess.

1 Like
3

Any workaround?

4

I cannot think of one.

5

There is already an open issue about this problem.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.