HAProxy JSON log shipping WITHOUT nxlog

Thought a few in here might be able to benefit from this. HAProxy can output custom logs. Using the following line in “defaults” in haproxy.cfg will allow HAProxy to output raw JSON to a raw UDP input in Graylog. With the use of a single JSON extractor all your field extraction is done for you. If you don’t want to or can’t use an agent like NXLOG or FileBeat to output GELF or JSON this might be your next best bet. If you need help just message me in this thread. Good luck.

log-format '{"bytes_read":"%B","hostname":"%H","status_code":"%ST","time_connect":"%Tc","time_duration":"%Td","time_conn_handshake":"%Th","time_session":"%Tt","time_waiting":"%Tw","bytes_uploaded":"%U","conn_active":"%ac","be_name":"%b","be_conns":"%bc","be_source_ip":"%bi","be_queue":"%bq","client_ip":"%ci","fe_name":"%f","fe_conns":"%fc","fe_accepting_ip":"%fi","fe_accepting_port":"%fp","fe_name_transport":"%ft","time_accept":"%ms","retries":"%rc","req_counter":"%rt","svr_name":"%s","svr_conns":"%sc","svr_ip":"%si","svr_port":"%sp","svr_queue":"%sq","termination_state":"%ts"}'

Of course you can add/remove/or manipulate the field names as you see fit for your logging requirements. These are mostly just the defaults

3 Likes

I forgot one thing. A “Pre-Extractor” may be needed to pull out the “Timestamp haproxy[XXXXX]” string from the beginning of the message so the JSON extractor has properly formatted syntax to work with.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.