Overview
The User-Agent Parser takes a useragent attribute and extracts OS, browser, device, and other user data. When set up, the following attributes are produced:
Note: If your logs contain encoded user-agents (for example, IIS logs), configure this Processor to decode the URL before parsing it.
Use cases
The User-Agent Parser allows you to extract useful information, for example, browser, device, OS from apache logs.
Before and after state of logs
Before:
{
"client": {
"ip": "10.12.4.20",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36"
},
"http": {
"method": "GET",
"url": "/v1/orders",
"status_code": 200
},
"timestamp": 1696945536000
}
User-Agent Parser
Create a User-Agent Parser processor and configure it to parse the user_agent attribute.
After processing:
{
"client": {
"ip": "10.12.4.20",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36"
},
"http": {
"method": "GET",
"url": "/v1/orders",
"status_code": 200,
"useragent_details": {
"browser": {
"family": "Chrome",
"major": "118",
"minor": "0",
"patch": "5993",
"patch_minor": "90"
},
"device": {
"brand": "Apple",
"category": "Desktop",
"family": "Mac",
"model": "Mac"
},
"os": {
"family": "Mac OS X",
"major": "10",
"minor": "15",
"patch": "7"
}
}
},
"timestamp": 1696945536000
}
The User-Agent Parser automatically adds a new nested attribute (http.useragent_details) containing extracted components of the User Agent.
API
Use the Datadog Log Pipeline API endpoint with the following user-agent parser JSON payload:
{
"type": "user-agent-parser",
"name": "Parses <SOURCE_ATTRIBUTE> to extract all its User-Agent information",
"is_enabled": true,
"sources": ["http.useragent"],
"target": "http.useragent_details",
"is_encoded": false
}
| Parameter | Type | Required | Description |
|---|
type | String | Yes | Type of the processor. |
name | String | No | Name of the processor. |
is_enabled | Boolean | No | If the processor is enabled or not. Default: false. |
sources | Array of strings | No | Array of source attributes. Default: http.useragent. |
target | String | Yes | Name of the parent attribute that contains all the extracted details from the sources. Default: http.useragent_details. |
is_encoded | Boolean | No | Define if the source attribute is url encoded or not. Default: false. |
Further reading
Additional helpful documentation, links, and articles:
