Actually I think I was mistaken and the field is the user agent. I will
change the variable and see what happens. I did some experiments to
show the pattern match works.

On Tue, 20 Jun 2017 20:56:46 -0700
lists@lazygranch.com wrote:

> I want to block by referrer. I provided a more "normal" record so
> that the user agent and referrer location was obvious by context. 
>
> My problem is I'm not creating the match expression correctly. I've
> tried spaces, parens. I haven't tried quotes. ‎ 
>
>   Original Message  
> From: Robert Paprocki
> Sent: Tuesday, June 20, 2017 6:47 PM
> To: nginx@nginx.org
> Reply To: nginx@nginx.org
> Subject: Re: block google app
>
> Well what is your log format then? We can't possibly help you if we
> don't have the necessary info ;)
>
> Do you want to block based on http referer? Or user agent string? Or
> something else entirely? The config snippet you posted indicates you
> are trying to block by referer. If you want to block a request based
> on the user agent string, you need to use the variable I noted
> ($http_user_agent).
>
> Sent from my iPhone
>
> > On Jun 20, 2017, at 18:35, "lists@lazygranch.com"
> > <lists@lazygranch.com> wrote:
> >
> > I think the ipad is the useragent. I wiped out that access.log, but
> > here is a fresh one showing a browser (user agent) in the proper
> > field.
> >
> > 200 76.20.227.211 - - [21/Jun/2017:00:48:45 +0000]
> > "GET /images/photo.jpg HTTP/1.1" 91223
> > "http://www.mydomain.com/page.html" "Mozilla/5.0 (Linux; Android
> > 6.0.1; SM-T350 B uild/MMB29M) AppleWebKit/537.36 (KHTML, like
> > Gecko) Chrome/58.0.3029.83 Safari/537.36" "-"
> >
> > I sanitize these a bit because I don't like this stuff showing up in
> > google searches, but the basic format is the same. I use a custom
> > log file format.
> >
> >
> > On Tue, 20 Jun 2017 17:49:14 -0700
> > Robert Paprocki <rpaprocki@fearnothingproductions.net> wrote:
> >
> >> Do you mean $http_user_agent?
> >>
> >>> On Jun 20, 2017, at 17:36, "lists@lazygranch.com"
> >>> <lists@lazygranch.com> wrote:
> >>>
> >>> I would like to block the google app from directly downloading
> >>> images.
> >>>
> >>> access.log:
> >>>
> >>> 200 186.155.157.9 - - [20/Jun/2017:00:35:47 +0000]
> >>> "GET /images/photo.jpg HTTP/1.1" 334052 "-"
> >>> "com.google.GoogleMobile/28.0.0 iPad/9.3.5 hw/iPad2_5" "-"
> >>>
> >>>
> >>> My nginx code in the images location:
> >>>
> >>> if ($http_referer ~* (com.google.GoogleMobile)) {
> >>> return 403;
> >>> }
> >>>
> >>> So what I am doing wrong?
> >>> _______________________________________________
> >>> nginx mailing list
> >>> nginx@nginx.org
> >>> http://mailman.nginx.org/mailman/listinfo/nginx
> >> _______________________________________________
> >> nginx mailing list
> >> nginx@nginx.org
> >> http://mailman.nginx.org/mailman/listinfo/nginx
> >
> > _______________________________________________
> > nginx mailing list
> > nginx@nginx.org
> > http://mailman.nginx.org/mailman/listinfo/nginx
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx