Class: LogStash::Filters::UserAgent2

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/filters/useragent2.rb

Overview

Parse user agent strings into structured data based on the Java library: <github.com/HaraldWalker/user-agent-utils>

UserAgent filter, adds information about user agent like family, operating system, version, and device

Constant Summary collapse

LOOKUP_CACHE = 
LruRedux::ThreadSafeCache.new(1000)

Instance Method Summary collapse

Instance Method Details

#filter(event) ⇒ Object 



58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
 
# File 'lib/logstash/filters/useragent2.rb', line 58

def filter(event)
  useragent = event[@source]
  useragent = useragent.first if useragent.is_a?(Array)

  return if useragent.nil? || useragent.empty?

  begin
    ua_data = lookup_useragent(useragent)
  rescue StandardError => e
    @logger.error("Uknown error while parsing user agent data", :exception => e, :field => @source, :event => event)
    return
  end

  return unless ua_data

  event.remove(@source) if @target == @source
  set_fields(event, ua_data)

  filter_matched(event)
end

#lookup_useragent(useragent) ⇒ Object

should be private but need to stay public for specs TODO: (colin) the related specs should be refactored to not rely on private methods.



81
82
83
84
85
86
87
88
89
90
91
 
# File 'lib/logstash/filters/useragent2.rb', line 81

def lookup_useragent(useragent)
  return unless useragent

  cached = LOOKUP_CACHE[useragent]
  return cached if cached

  ua_data = parse_useragent(useragent)

  LOOKUP_CACHE[useragent] = ua_data
  ua_data
end

#register ⇒ Object 



49
50
51
52
53
54
55
56
 
# File 'lib/logstash/filters/useragent2.rb', line 49

def register

  LOOKUP_CACHE.max_size = @lru_cache_size

  # make @target in the format [field name] if defined, i.e. surrounded by brakets
  @normalized_target = (@target && @target !~ /^\[[^\[\]]+\]$/) ? "[#{@target}]" : ""

end