UserAgent

Learn about the UserAgent OTTL converter function.

  less than a minute  

The UserAgent converter parses common user agent strings.

Syntax: UserAgent(value)

  • value: the location of a field containing the user agent string.

In the following example, the body has been decoded and the user agent parts of the log isolated:

set(attributes["decoded_body"], Decode(body, "utf-8"))
set(attributes, ExtractPatterns(attributes["decoded_body"], "\"(?P<userAgent>Mozilla/5.0[^\"]+)\""))

Input

{
	"_type": "log",
	"timestamp": 1735883101061,
	"body": "10.244.1.5 - - [03/Jan/2025:05:27:54 +0000] \"GET /products/RoofBinoculars.jpg HTTP/1.1\" 200 128965 \"http://my-otel-demo-frontendproxy:8080/cart\" \"Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.28 Safari/537.36\"",
	"resource": {...},
	"attributes": {
		"userAgent": "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.28 Safari/537.36"
	}
}

Statement

set(attributes["parsed_user_agent"], UserAgent(attributes["userAgent"]))

Output

{
	"_type": "log",
	"timestamp": 1735883099613,
	"body": "10.244.1.5 - - [03/Jan/2025:05:27:54 +0000] \"GET /products/RoofBinoculars.jpg HTTP/1.1\" 200 128965 \"http://my-otel-demo-frontendproxy:8080/cart\" \"Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.28 Safari/537.36\"",
	"resource": {...},
	"attributes": {
		"parsed_user_agent": {
			"user_agent.name": "HeadlessChrome",
			"user_agent.original": "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.28 Safari/537.36",
			"user_agent.version": "120.0.6099"
		},
		"userAgent": "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.28 Safari/537.36"
	}
}

The user agent name and version are parsed out of the user agent attribute, along with the original user attribute. Be sure to remove duplicated fields.