Parse HA Proxy fields json

Graylog Central (peer support)
1

Hello Community,

So I want to parse to create fields with HA Proxy json logs, so this is our messag logs:

haproxy[26323]: ‘{“host”:“qahaproxy”,“ident”:“haproxy”,“pid”:26323,“time”:“19/Dec/2019:14:24:24 -0400”,“haproxy”:{“conn”:{“act”:0,“fe”:0,“be”:0,“srv”:0},“queue”:{“backend”:0,“srv”:0},“time”:{“tq”:55,“tw”:0,“tc”:0,“tr”:364,“tt”:432},“termination_state”:"----",“retries”:0,“network”:{“client_ip”:“192.168.0.111”,“client_port”:60873,“frontend_ip”:“192.168.0.20”,“frontend_port”:80},“ssl”:{“version”:"-",“ciphers”:"-"},“request”:{“method”:"",“uri”:"",“protocol”:"",“header”:{“host”:"",“xforwardfor”:"",“referer”:""}},“name”:{“backend”:“app01”,“frontend”:“app01front”,“server”:“server1”},“response”:{“status_code”:200,“header”:{“xrequestid”:""}},“bytes”:{“uploaded”:1091,“read”:28958}}}’

so if you see the string “haproxy[26323]:” can’t let parse json message, so how can parse that message? we need a pipeline?

regards,

2

yes - you might solve the problem with a processing pipeline.

First remove the leading non json part and after that parse json.

1 Like
3

Thanks, if you have any example to do it, I’d appreciate it.

4

why not check already created content packs on marketplace?

1 Like
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.