# Parse HA Proxy fields json

**URL:** <https://community.graylog.org/t/parse-ha-proxy-fields-json/13248>\
**Category:** Graylog Central (peer support)\
**Created:** [December 19, 2019, 6:31pm UTC](https://community.graylog.org/t/parse-ha-proxy-fields-json/13248 "2019-12-19T18:31:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![javig12](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/javig12/32/5524_2.png) [@javig12](https://community.graylog.org/u/javig12)\
**Post date:** [December 19, 2019, 6:31pm UTC](https://community.graylog.org/t/parse-ha-proxy-fields-json/13248/1 "2019-12-19T18:31:38Z")

</div>

Hello Community,

So I want to parse to create fields with HA Proxy json logs, so this is our messag logs:

haproxy[26323]: ‘{“host”:“qahaproxy”,“ident”:“haproxy”,“pid”:26323,“time”:“19/Dec/2019:14:24:24 -0400”,“haproxy”:{“conn”:{“act”:0,“fe”:0,“be”:0,“srv”:0},“queue”:{“backend”:0,“srv”:0},“time”:{“tq”:55,“tw”:0,“tc”:0,“tr”:364,“tt”:432},“termination\_state”:"----",“retries”:0,“network”:{“client\_ip”:“192.168.0.111”,“client\_port”:60873,“frontend\_ip”:“192.168.0.20”,“frontend\_port”:80},“ssl”:{“version”:"-",“ciphers”:"-"},“request”:{“method”:"",“uri”:"",“protocol”:"",“header”:{“host”:"",“xforwardfor”:"",“referer”:""}},“name”:{“backend”:“app01”,“frontend”:“app01front”,“server”:“server1”},“response”:{“status\_code”:200,“header”:{“xrequestid”:""}},“bytes”:{“uploaded”:1091,“read”:28958}}}’

so if you see the string “haproxy[26323]:” can’t let parse json message, so how can parse that message? we need a pipeline?

regards,

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [December 21, 2019, 4:35pm UTC](https://community.graylog.org/t/parse-ha-proxy-fields-json/13248/2 "2019-12-21T16:35:05Z")

</div>

yes - you might solve the problem with a processing pipeline.

First remove the leading non json part and after that parse json.

---

<div class="post-metadata">

**Author:** ![javig12](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/javig12/32/5524_2.png) [@javig12](https://community.graylog.org/u/javig12)\
**Post date:** [January 3, 2020, 1:15pm UTC](https://community.graylog.org/t/parse-ha-proxy-fields-json/13248/3 "2020-01-03T13:15:44Z")

</div>

Thanks, if you have any example to do it, I’d appreciate it.

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [January 7, 2020, 7:55am UTC](https://community.graylog.org/t/parse-ha-proxy-fields-json/13248/4 "2020-01-07T07:55:23Z")

</div>

why not check already created content packs on marketplace?

> **[Graylog](https://marketplace.graylog.org/addons?search=haproxy)**
>
> Graylog

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 21, 2020, 7:55am UTC](https://community.graylog.org/t/parse-ha-proxy-fields-json/13248/5 "2020-01-21T07:55:33Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.