Kibana: [Telemetry] User agent name for Chromium-based Edge is reported as Chrome

[marius-dr]

Kibana version: 6.8.6, 7.5.1

Browser version: Chromium Edge, Beta and Nightly builds

Browser OS version: 75, 81

Original install method (e.g. download page, yum, from source, etc.): BC

Describe the bug:
Currently the user_agent.name field in telemetry picks the browsers out as Chrome, both for the Nightly and the Beta builds.

Expected behavior:
I would expect them to be filtered as Edge or "Chromium Edge", in order to be able to differentiate them in stats.

User agent string is collected properly, we just need to change the allocation for that user agent:
Chromium Edge user agent example:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.3993.0 Safari/537.36 Edg/81.0.368.0

Old Edge example:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/18.17763

And yes, that's not a typo, it's Edg for new one and Edge for old one.

[elasticmachine]

Pinging @elastic/pulse (Team:Pulse)

[Bamieh]

We use the elasticsearch user agent processor to parse the user agent string sent directly from a header attached to the request by the browser.

Maybe this should be raised to the elasticsearch team?

[Bamieh]

@afharo pointed out that this might be happening with the stack version we are using for our telemetry cluster. I have simulated this on version 7.5.2 and I am getting the same results mentioned in the issue as well:

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "user_agent": {
          "field": "agent",
          "ignore_missing": true
        }
      }
    ]
  },
  "docs": [{
    "_source": {
      "agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.3993.0 Safari/537.36 Edg/81.0.368.0"
    }
  }]
}

Result (It is showing Chrome):

{
  "docs" : [
    {
      "doc" : {
        "_index" : "_index",
        "_type" : "_doc",
        "_id" : "_id",
        "_source" : {
          "agent" : "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.3993.0 Safari/537.36 Edg/81.0.368.0",
          "user_agent" : {
            "name" : "Chrome",
            "original" : "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.3993.0 Safari/537.36 Edg/81.0.368.0",
            "os" : {
              "name" : "Windows 10"
            },
            "device" : {
              "name" : "Other"
            },
            "version" : "81.0.3993"
          }
        },
        "_ingest" : {
          "timestamp" : "2020-01-08T13:14:36.216638Z"
        }
      }
    }
  ]
}

[afharo]

Thank you for the tests, @Bamieh. It looks like it's an ES issue then :)

[afharo]

Oh! I just ran it with the latest snapshot for 8.0.0, and it did work:

{
  "docs" : [
    {
      "doc" : {
        "_index" : "_index",
        "_id" : "_id",
        "_source" : {
          "agent" : "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.3993.0 Safari/537.36 Edg/81.0.368.0",
          "user_agent" : {
            "name" : "Edge",
            "original" : "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.3993.0 Safari/537.36 Edg/81.0.368.0",
            "os" : {
              "name" : "Windows",
              "version" : "10",
              "full" : "Windows 10"
            },
            "device" : {
              "name" : "Other"
            },
            "version" : "81.0.368.0"
          }
        },
        "_ingest" : {
          "timestamp" : "2020-01-09T11:03:20.247485Z"
        }
      }
    }
  ]
}

[Bamieh]

@afharo Great! We need to check if this issue is fixed in 7.x then. We'd have to upgrade our cluster to that version whenever we start tackling upgrading the telemetry cluster with pulse. I assume this would take at least a few months from now to upgrade to 7.x unless we give it a higher priority (cc @epixa )

[afharo]

Yup!
7.5 branch doesn't have it.
But master and 7.x, both of them do.

[epixa]

I think 7.x is fine for this. It's only a beta browser today.

[marius-dr]

Doesn't seem to be in 7.6.0. Will retest in 7.7.0
Tried it with the released version of Edge on OS X:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71

It's still parsed as Chrome in user_agent.name.

[afharo]

@marius-dr Thank you for that test. We meant the user_agent processor is fixed for version 7.x. But we are currently running ES 6.8.4 in our Telemetry cluster. It doesn't matter which version of the stack the user is running.
We need to get our Telemetry cluster upgraded to 7.x to fix this issue.

[marius-dr]

Ah cool, then it means there's nothing else to do for testing this. The user agent is reported properly by telemetry it's only the processor that needs updating.

[afharo]

Exactly! And we've seen the processor is already working as expected in the most recent versions. It's only on us, the pulse team, to work on getting our stack where we are storing the data updated to the latest and greatest.
@epixa when do you think we can prioritise this?

[epixa]

This should be resolved when we switch over from the existing telemetry service to the pulse service, which will be running 7.x.

[afharo]

I think this can be closed now. @marius-dr can you confirm, please?

[epixa]

@afharo I think you may have pinged the wrong person there. Did you mean to ping @marius-dr?

[Bamieh]

@epixa i think so. This should be safe to close

[afharo]

@epixa yes! thank you for catching that up... I think the autocomplete got me 😅

[marius-dr]

agreed