filteruseragent

README

gogstash useragent filter module

This filter parses a useragent string in the log event message to a structured form.

Synopsis

filter:
  - type: useragent
    # message field to parse
    source: headers.user_agent
    # target field
    target: user_agent
    # (optional) YAML file of user agent regexes to match. Default: regexes from uaparser
    # You can find the latest version of this here:
    # <https://github.com/ua-parser/uap-core/blob/master/regexes.yaml>
    regexes: "./regex.yaml"
    # (optional) Number of entries to cache, to avoid re-parsing the same user agents repeatedly. Default: 100000
    cache_size: 1000

Example for useragent

Input string

{
    "headers": {
        "user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
    }
}

Config:

filter:
  - type: useragent
    source: headers.user_agent
    target: user_agent

Produces the following output:

{
    "headers": {
        "user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
    },
    "user_agent": {
        "device": "Other",
        "major": "59",
        "minor": "0",
        "name": "Chrome",
        "os": "Windows",
        "os_major": "7",
        "os_name": "Windows",
        "patch": "3071"
    }
}

Documentation

Index

• Constants
• func InitHandler(ctx context.Context, raw config.ConfigRaw, control config.Control) (config.TypeFilterConfig, error)
• type FilterConfig
  • func DefaultFilterConfig() FilterConfig
  • func (f *FilterConfig) Event(ctx context.Context, event logevent.LogEvent) (logevent.LogEvent, bool)

Constants

const ModuleName = "useragent"

ModuleName is the name used in config file

Functions

func InitHandler

func InitHandler(
	ctx context.Context,
	raw config.ConfigRaw,
	control config.Control,
) (config.TypeFilterConfig, error)

InitHandler initialize the filter plugin

Types

type FilterConfig

type FilterConfig struct {
	config.FilterConfig

	// The field containing the user agent string.
	Source string `json:"source"`

	// The name of the field to assign user agent data into.
	// If not specified user agent data will be stored in the root of the event.
	Target string `json:"target"`

	// `regexes.yaml` file to use
	//
	// You can find the latest version of this here:
	// <https://github.com/ua-parser/uap-core/blob/master/regexes.yaml>
	Regexes string `json:"regexes"`

	// UA parsing is surprisingly expensive.
	// We can optimize it by adding a cache
	CacheSize int `json:"cache_size"`
	// contains filtered or unexported fields
}

FilterConfig holds the configuration json fields and internal objects

func DefaultFilterConfig

func DefaultFilterConfig() FilterConfig

DefaultFilterConfig returns an FilterConfig struct with default values

func (*FilterConfig) Event

func (f *FilterConfig) Event(ctx context.Context, event logevent.LogEvent) (logevent.LogEvent, bool)

Event the main filter event