user_agent.yml

---
- name: user_agent
  title: User agent
  group: 2
  short: Fields to describe a browser user_agent string.
  description: >
    The user_agent fields normally come from a browser request.

    They often show up in web service logs coming from the parsed user agent string.
  type: group
  fields:

    - name: original
      level: extended
      type: keyword
      multi_fields:
      - type: text
        name: text
      description: >
        Unparsed user_agent string.
      example: "Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1"

    - name: name
      level: extended
      type: keyword
      example: Safari
      description: >
        Name of the user agent.

    - name: version
      level: extended
      type: keyword
      description: >
        Version of the user agent.
      example: 12.0

    - name: device.name
      level: extended
      type: keyword
      example: iPhone
      description: >
        Name of the device.