Transform or extraction to explicitly set value based on regexp match

[jcbrendsel]

I woudl like to categorize some useragent patterns into several discrete groups.

That is, there are a number of different patterns that can appear that signify an iphone client.

one way of accomplishing this is to define a series of tags.

But I would like to do this using a transform / extraction, if at all possible.

that is, i want to create a field (at search time) which distills the various useragent patterns using a regexp into several discrete values (iphone, ipad, mac, etc.)

Is there a preferred approach?

[Stephen_Sorkin · Accepted solution]

The preferred approach for "classifying" events is to use either lookup tables or eventtypes. Lookup tables work best when there is a mapping (not necessarily one-to-one) between source and destination field values. Eventtypes allow mapping between arbitrary search statements (e.g., booleans, negations, disjunctions on keywords and fields) and categories.

Field extractions aren't ideal for this since, for efficiency, they make the assumption that the field value itself can be found in the source data. You can configure this assumption away in fields.conf, at a performance penalty.