User agent processor

The User agent processor extracts browser, operating system, and device details from a user agent string.

To extract user agent details:

Select Create → Create processor.
Select User agent from the Processor menu.
Set the Source Field to the field containing the user agent string.
(Optional) Set Target field to the field that will contain the extracted details. Defaults to user_agent.
(Optional) Expand the accordion to configure:
- Regex file: A custom regex file name containing the regular expressions used to parse the user agent string.
- Properties: The specific properties to extract. Defaults to all: name, os, device, original, version.
- Extract device type: Extracts the device type from the user agent string. This functionality is in beta and is subject to change.

This functionality uses the Elasticsearch User agent processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

YAML reference

In YAML mode, configure the user agent processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter	Type	Required	Description
`from`	string	Yes	Field containing the user agent string.
`to`	string	No	Field that will contain the extracted user agent details. Defaults to `user_agent`.
`regex_file`	string	No	Custom regex file name containing the regular expressions for parsing the user agent string.
`properties`	string[]	No	Properties to extract: `name`, `os`, `device`, `original`, `version`. Defaults to all.
`extract_device_type`	boolean	No	When `true`, extracts the device type from the user agent string.
`ignore_missing`	boolean	No	When `true`, skip this processor if the source field is missing.

		- action: user_agent
  from: attributes.user_agent.original
  to: attributes.user_agent
		
	

Given a document with:

		{
  "attributes": {
    "user_agent": {
      "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0"
    }
  }
}
		
	

The processor adds attributes.user_agent.name: "Chrome" and attributes.user_agent.os.name: "Mac OS X", alongside the other extracted properties.