Thought a few in here might be able to benefit from this. HAProxy can output custom logs. Using the following line in “defaults” in haproxy.cfg will allow HAProxy to output raw JSON to a raw UDP input in Graylog. With the use of a single JSON extractor all your field extraction is done for you. If you don’t want to or can’t use an agent like NXLOG or FileBeat to output GELF or JSON this might be your next best bet. If you need help just message me in this thread. Good luck.
log-format '{"bytes_read":"%B","hostname":"%H","status_code":"%ST","time_connect":"%Tc","time_duration":"%Td","time_conn_handshake":"%Th","time_session":"%Tt","time_waiting":"%Tw","bytes_uploaded":"%U","conn_active":"%ac","be_name":"%b","be_conns":"%bc","be_source_ip":"%bi","be_queue":"%bq","client_ip":"%ci","fe_name":"%f","fe_conns":"%fc","fe_accepting_ip":"%fi","fe_accepting_port":"%fp","fe_name_transport":"%ft","time_accept":"%ms","retries":"%rc","req_counter":"%rt","svr_name":"%s","svr_conns":"%sc","svr_ip":"%si","svr_port":"%sp","svr_queue":"%sq","termination_state":"%ts"}'
Of course you can add/remove/or manipulate the field names as you see fit for your logging requirements. These are mostly just the defaults