---
title: User agent processor
description: Extract browser, OS, and device details from a user agent string with the Streams user agent processor in Streamlang.
url: https://www.elastic.co/elastic/docs-builder/docs/3717/solutions/observability/streams/processors/user-agent
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud Serverless
  - Elastic Cloud on Kubernetes
  - Elastic Observability
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Planned
---

# User agent processor
The **User agent** processor extracts browser, operating system, and device details from a user agent string.
To extract user agent details:
1. Select **Create** → **Create processor**.
2. Select **User agent** from the **Processor** menu.
3. Set the **Source Field** to the field containing the user agent string.
4. (Optional) Set **Target field** to the field that will contain the extracted details. Defaults to `user_agent`.
5. (Optional) Expand the accordion to configure:
   - **Regex file**: A custom regex file name containing the regular expressions used to parse the user agent string.
- **Properties**: The specific properties to extract. Defaults to all: `name`, `os`, `device`, `original`, `version`.
- **Extract device type**: Extracts the device type from the user agent string. This functionality is in beta and is subject to change.

This functionality uses the Elasticsearch [User agent processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3717/reference/ingest-processor/user-agent-processor) internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to [Processor limitations and inconsistencies](/elastic/docs-builder/docs/3717/solutions/observability/streams/streamlang#streams-processor-inconsistencies).

## YAML reference

In [YAML mode](/elastic/docs-builder/docs/3717/solutions/observability/streams/parse-and-process#streams-editing-yaml-mode), configure the user agent processor using the following parameters. For the complete Streamlang syntax, refer to the [Streamlang reference](https://www.elastic.co/elastic/docs-builder/docs/3717/solutions/observability/streams/streamlang).

| Parameter             | Type     | Required | Description                                                                                  |
|-----------------------|----------|----------|----------------------------------------------------------------------------------------------|
| `from`                | string   | Yes      | Field containing the user agent string.                                                      |
| `to`                  | string   | No       | Field that will contain the extracted user agent details. Defaults to `user_agent`.          |
| `regex_file`          | string   | No       | Custom regex file name containing the regular expressions for parsing the user agent string. |
| `properties`          | string[] | No       | Properties to extract: `name`, `os`, `device`, `original`, `version`. Defaults to all.       |
| `extract_device_type` | boolean  | No       | When `true`, extracts the device type from the user agent string.                            |
| `ignore_missing`      | boolean  | No       | When `true`, skip this processor if the source field is missing.                             |

```yaml
- action: user_agent
  from: attributes.user_agent.original
  to: attributes.user_agent
```

Given a document with:
```json
{
  "attributes": {
    "user_agent": {
      "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0"
    }
  }
}
```

The processor adds `attributes.user_agent.name: "Chrome"` and `attributes.user_agent.os.name: "Mac OS X"`, alongside the other extracted properties.