From cef8ee4e81a60e0f53401740afedfa560d2f4607 Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Tue, 28 Jul 2015 10:33:15 +0100
Subject: [PATCH] Parse user agent details

---
 .../logstash/templates/default/logstash.conf.erb    | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/cookbooks/logstash/templates/default/logstash.conf.erb b/cookbooks/logstash/templates/default/logstash.conf.erb
index 0ddab7b2f..c036c1f7a 100644
--- a/cookbooks/logstash/templates/default/logstash.conf.erb
+++ b/cookbooks/logstash/templates/default/logstash.conf.erb
@@ -14,6 +14,19 @@ filter {
     date {
       match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
     }
+    if [agent] == "-" {
+      mutate {
+        remove_field => [ "agent" ]
+      }
+    } else {
+      useragent {
+        source => "agent"
+        target => "useragent"
+      }
+      mutate {
+        rename => { "agent" => "[useragent][raw]" }
+      }
+    }
   } else if [type] == "rails" {
     json {
       source => "message"
-- 
2.43.2