--- "Test user agent processor with custom regex file": - do: ingest.put_pipeline: id: "my_pipeline" body: > { "description": "_description", "processors": [ { "user_agent" : { "field": "field1", "ecs": true, "regex_file": "test-regexes.yml" } } ] } - match: { acknowledged: true } - do: index: index: test id: 1 pipeline: "my_pipeline" body: {field1: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.149 Safari/537.36"} - do: get: index: test id: 1 - match: { _source.field1: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.149 Safari/537.36" } - match: { _source.user_agent.name: "Test" } - match: { _source.user_agent.device: {"name": "Other" }} - is_false: _source.user_agent.os - is_false: _source.user_agent.version