What do you think? Have you seen something similar with other EventLogging schemas?

mmm... that session token is too short no? it should be 64 bits like: 80dr048q6b0buqrf4b44u2i11qvthbi4

We definitely have seen js-able bots in EL data and bots mostly crawl wikipedia which is what your schema is registering , now in this case your sessionToken looks wrong (if you have not abridged it).

@Nuria we're using mediaWiki.user.sessionId() to get the session_token. The documentation says that this is a 64-bit integer in hex format. So I converted the above session_token (from the task description) to a number in decimal and got 2129045178431482577, which looks correct to me.

@bmansurov you are totally right, 16 chars in length is correct , my apologies

Also, all crawled content by session: 1d8be34f432aaad1 is about cookies and cookie policy.

Will be closing ticket as this is lawful traffic if not human.

@Nuria anything we can do to mark such user agents as 'bot'?

@bmansurov nothing easy I can think of at this time server side. This schema suffers much more than others regarding issues with bot traffic given that per definition is translating into events much of the "crawlers" clicking around. I think any filtering is going to have happen at analysis time and UAs with more than, say, 6 events per minute (1 every 10 secs) should probably be discarded.

@Nuria thanks!

@Nuria do you expect this task to be addressed by the better bot detection approach you're implementing? If yes, I'd like to close it.

It will be initially deployed just for pageviews so not quite yet.

The heuristics would work however so we just need to think how would we plug it in this pipeline