First try at useragent info parsing
@@ -110,6 +110,14 @@ filter {
match => { "[http][headers][all]" => [ "(?<[http][headers][useragent]>([^|]*))\|(?<[http][headers][host]>([^|]*))\|(?<[http][headers][x_forwarded_for]>([^|]*))\|(?<[http][headers][x_forwarded_proto]>([^|]*))\|(?<[http][headers][x_host]>([^|]*))\|(?<[http][headers][forwarded]>([^|]*))\|(?<[http][headers][via]>([^|]*))" ] }
}
+ # Add useragent data
+ if [http][headers][useragent] {
+ useragent {
+ source => "[http][headers][useragent]"
+ add_tag => ["useragentparsed"]
+ }
+ }
+
# split the values into an array
mutate {
split => { "[http][headers][all]" => "|" }
