parse_user_agent()parse_user_agent()

解释一个 user-agent 字符串,该字符串用于标识用户的浏览器,并向承载用户所访问网站的服务器提供特定的系统详细信息。Interprets a user-agent string, which identifies the user's browser and provides certain system details to servers hosting the websites the user visits. 结果以 dynamic 的形式返回。The result is returned as dynamic.

语法Syntax

parse_user_agent(user-agent-string, look-for)parse_user_agent(user-agent-string, look-for)

参数Arguments

  • user-agent-stringstring 类型的表达式,表示 user-agent 字符串。user-agent-string: An expression of type string, representing a user-agent string.

  • look-forstringdynamic 类型的表达式,表示该函数在 user-agent 字符串(分析目标)中应该查找的内容。look-for: An expression of type string or dynamic, representing what the function should be looking for in the user-agent string (parsing target). 可能的选项:“browser”、“os”、“device”。The possible options: "browser", "os", "device". 如果只需要一个分析目标,可将 string 参数传递给它。If only a single parsing target is required it can be passed a string parameter. 如果需要两个或三个,则可以将其作为 dynamic array 传递。If two or three are required they can be passed as a dynamic array.

返回Returns

dynamic 类型的对象,包含有关所请求的分析目标的信息。An object of type dynamic that contains the information about the requested parsing targets.

Browser:Family, MajorVersion, MinorVersion, PatchBrowser: Family, MajorVersion, MinorVersion, Patch

OperatingSystem:Family, MajorVersion, MinorVersion, Patch, PatchMinorOperatingSystem: Family, MajorVersion, MinorVersion, Patch, PatchMinor

设备:Family, Brand, ModelDevice: Family, Brand, Model

警告

该函数实现以输入字符串的正则表达式检查(针对海量预定义模式)为基础。The function implementation is built on regex checks of the input string against a huge number of predefined patterns. 因此,时间和 CPU 用量预计会很高。Therefore the expected time and CPU consumption is high. 在查询中使用该函数时,请确保它以分布式方式在多台计算机上运行。When the function is used in a query, make sure it runs in a distributed manner on multiple machines. 如果频繁使用带有此函数的查询,那么你可能想要通过更新策略预创建结果,但需考虑到,在更新策略中使用此函数将会增加引入延迟。If queries with this function are frequently used, you may want to pre-create the results via update policy, but you need to take into account that using this function inside the update policy will increase the ingestion latency.

示例Example

print useragent = "Mozilla/5.0 (Windows; U; en-US) AppleWebKit/531.9 (KHTML, like Gecko) AdobeAIR/2.5.1"
| extend x = parse_user_agent(useragent, "browser") 

预期结果是动态对象:Expected result is a dynamic object:

{ "Browser": { "Family":"AdobeAIR", "MajorVersion":"2", "MinorVersion":"5", "Patch":"1" } }{ "Browser": { "Family": "AdobeAIR", "MajorVersion": "2", "MinorVersion": "5", "Patch": "1" } }

print useragent = "Mozilla/5.0 (SymbianOS/9.2; U; Series60/3.1 NokiaN81-3/10.0.032 Profile/MIDP-2.0 Configuration/CLDC-1.1 ) AppleWebKit/413 (KHTML, like Gecko) Safari/4"
| extend x = parse_user_agent(useragent, dynamic(["browser","os","device"])) 

预期结果是动态对象:Expected result is a dynamic object:

{ "Browser": { "Family":"Nokia OSS Browser", "MajorVersion":"3", "MinorVersion":"1", "Patch": "" }, "OperatingSystem": { "Family":"Symbian OS", "MajorVersion":"9", "MinorVersion":"2", "Patch": "", "PatchMinor": "" }, "Device": { "Family":"Nokia N81", "Brand":"Nokia", "Model":"N81-3" } }{ "Browser": { "Family": "Nokia OSS Browser", "MajorVersion": "3", "MinorVersion": "1", "Patch": "" }, "OperatingSystem": { "Family": "Symbian OS", "MajorVersion": "9", "MinorVersion": "2", "Patch": "", "PatchMinor": "" }, "Device": { "Family": "Nokia N81", "Brand": "Nokia", "Model": "N81-3" } }