As discussed in this issue elastic/logstash#1669, is there any chance that we will either rename ua.os_name to ua.os_family or add a new ua.os_family and modify the patterns to capture only OS family (e.g. Microsoft, MacOS)?
Right now both ua.os and ua.os_name contain the same full OS names like Windows 7, Windows 8.