Class: LogStash::Filters::UserAgent

Inherits:
Base show all
Defined in:
lib/logstash/filters/useragent.rb

Overview

Parse user agent strings into structured data based on BrowserScope data

UserAgent filter, adds information about user agent like family, operating system, version, and device

Logstash releases ship with the regexes.yaml database made available from ua-parser with an Apache 2.0 license. For more details on ua-parser, see <github.com/tobie/ua-parser/>.

Constant Summary

Constants inherited from Base

Base::RESERVED

Constants included from Config::Mixin

Config::Mixin::CONFIGSORT

Instance Attribute Summary

Attributes included from Config::Mixin

#config, #original_params

Attributes inherited from Plugin

#logger, #params

Instance Method Summary collapse

Methods inherited from Base

#execute, #initialize, #threadsafe?

Methods included from Config::Mixin

#config_init, included

Methods inherited from Plugin

#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s

Constructor Details

This class inherits a constructor from LogStash::Filters::Base

Instance Method Details

#filter(event) ⇒ Object 



66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
 
# File 'lib/logstash/filters/useragent.rb', line 66

def filter(event)
  return unless filter?(event)
  ua_data = nil

  useragent = event[@source]
  useragent = useragent.first if useragent.is_a? Array

  begin
    ua_data = @parser.parse(useragent)
  rescue Exception => e
    @logger.error("Uknown error while parsing user agent data", :exception => e, :field => @source, :event => event)
  end

  if !ua_data.nil?
    if @target.nil?
      # default write to the root of the event
      target = event
    else
      target = event[@target] ||= {}
    end

    target[@prefix + "name"] = ua_data.name

    #OSX, Andriod and maybe iOS parse correctly, ua-agent parsing for Windows does not provide this level of detail
    unless ua_data.os.nil?
      target[@prefix + "os"] = ua_data.os.to_s
      target[@prefix + "os_name"] = ua_data.os.name.to_s
      target[@prefix + "os_major"] = ua_data.os.version.major.to_s unless ua_data.os.version.nil?
      target[@prefix + "os_minor"] = ua_data.os.version.minor.to_s unless ua_data.os.version.nil?
    end

    target[@prefix + "device"] = ua_data.device.to_s if not ua_data.device.nil?

    if not ua_data.version.nil?
      ua_version = ua_data.version
      target[@prefix + "major"] = ua_version.major
      target[@prefix + "minor"] = ua_version.minor
      target[@prefix + "patch"] = ua_version.patch if ua_version.patch
      target[@prefix + "build"] = ua_version.patch_minor if ua_version.patch_minor 
    end

    filter_matched(event)
  end

end

#register ⇒ Object 



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/logstash/filters/useragent.rb', line 40

def register
  require 'user_agent_parser'
  if @regexes.nil?
    begin
      @parser = UserAgentParser::Parser.new()
    rescue Exception => e
      begin
        if __FILE__ =~ /file:\/.*\.jar!/
          # Running from a flatjar which has a different layout
          regexes_file = [__FILE__.split("!").first, "/vendor/ua-parser/regexes.yaml"].join("!")
          @parser = UserAgentParser::Parser.new(:patterns_path => regexes_file)
        else
          # assume operating from the git checkout
          @parser = UserAgentParser::Parser.new(:patterns_path => "vendor/ua-parser/regexes.yaml")
        end
      rescue => ex
        raise "Failed to cache, due to: #{ex}\n"
      end
    end
  else
    @logger.info("Using user agent regexes", :regexes => @regexes)
    @parser = UserAgentParser::Parser.new(:patterns_path => @regexes)
  end
end