Skip to content

Instantly share code, notes, and snippets.

@smortex
Created September 30, 2023 21:51
Show Gist options
  • Save smortex/3a5c25e9bbea6dff803ebc2861d8ea59 to your computer and use it in GitHub Desktop.
Save smortex/3a5c25e9bbea6dff803ebc2861d8ea59 to your computer and use it in GitHub Desktop.
syslog-ng python parser to parse User Agent information from webserver logs
from user_agent_parser import UserAgentParser
from syslogng.message import LogMessage
import pytest
@pytest.fixture
def no_config():
return {
}
@pytest.fixture
def custom_config():
return {
'template': 'user_agent',
'prefix': 'data',
}
def test_message_is_enriched_without_config(no_config):
p = UserAgentParser()
p.init(no_config)
msg = LogMessage("Sample message")
msg["apache.agent"] = "Mozilla/5.0 (X11; FreeBSD amd64; rv:109.0) Gecko/20100101 Firefox/118.0"
p.parse(msg)
assert msg['apache.ua.device.family'] == b'Other'
assert msg['apache.ua.os.family'] == b'FreeBSD'
assert msg['apache.ua.user_agent.family'] == b'Firefox'
assert msg['apache.ua.user_agent.major'] == b'118'
assert msg['apache.ua.user_agent.minor'] == b'0'
def test_message_is_enriched_with_custom_config(custom_config):
p = UserAgentParser()
p.init(custom_config)
msg = LogMessage("Sample message")
msg["user_agent"] = "Mozilla/5.0 (X11; FreeBSD amd64; rv:109.0) Gecko/20100101 Firefox/118.0"
p.parse(msg)
assert msg['data.device.family'] == b'Other'
assert msg['data.os.family'] == b'FreeBSD'
assert msg['data.user_agent.family'] == b'Firefox'
assert msg['data.user_agent.major'] == b'118'
assert msg['data.user_agent.minor'] == b'0'
from syslogng import LogParser
from ua_parser import user_agent_parser
class UserAgentParser(LogParser):
def init(self, options):
self.__template = options.get("template", "apache.agent")
self.__prefix = options.get("prefix", "apache.ua")
return True
def parse(self, msg):
ua_data = user_agent_parser.Parse(msg[self.__template].decode())
self.enrich_msg(msg, self.__prefix, ua_data)
return True
def enrich_msg(self, msg, prefix, data):
for key in data:
if key == "string":
pass
elif data[key] == None:
pass
elif isinstance(data[key], dict):
self.enrich_msg(msg, prefix + "." + key, data[key])
else:
msg[prefix + "." + key] = data[key]
@smortex
Copy link
Author

smortex commented Sep 30, 2023

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment