UAParser - HTTP User Agent parser

HTTP user-agent parser as described by RFC7231.

Usage

http_user_agent=* | lookup uaparser_lookup http_user_agent | spath input=http_user_agent_parts

Or with the macro:

http_user_agent=* | `uaparser(http_user_agent)`

Example

http_user_agent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50"

Output Fields:

ua.string: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50
ua.products: 2
ua.product1.name: Mozilla
ua.product1.version: 4.0
ua.product1.comment: compatible; MSIE 6.0; Windows NT 5.1; en
ua.product2.name: Opera 8.50
ua.product2.version: null
ua.product2.comment: null

Note that the second product in the previous example return 'Opera 8.50' as the name of the second product. This is not a bug. The parser is correctly working as described by the RFC7231. The user-agent sent by the browser is simply malformed (so not compliant with the RFC).

Use Case

Then, you can for example create a contingency table to cross Mozilla product versions with the MSIE versions. By spotting the outliers you may find intereting stuff in your proxy logs ;)

Example of a query:

http_user_agent=*Mozilla*| fields http_user_agent | `uaparser(http_user_agent)` | eval product = 'ua.product1.name' . "/" . 'ua.product1.version'| eval msie=mvfilter(match('ua.product1.comment.chunks', "[Mm][Ss][Ii][Ee]")) | contingency usetotal=false product msie

HTTP User-Agent Parser

0