Unable to extract JSON from log

Graylog Central (peer support)
1

I am having an issue extracting this JSON data:

{haproxy_clientIP:1.1.1.1,haproxy_clientPort:47178,haproxy_dateTime:02/Nov/2017:10:32:03.843,haproxy_frontendNameTransport:https-in~,haproxy_backend:backend.com_version03,haproxy_serverName:backend2,haproxy_Tw:0,haproxy_Tc:0,haproxy_Tt:7,haproxy_bytesRead:285,haproxy_terminationState:–,haproxy_actconn:1,haproxy_FrontendCurrentConn:1,haproxy_backendCurrentConn:0,haproxy_serverConcurrentConn:0,haproxy_retries:0,haproxy_srvQueue:0,haproxy_backendQueue:0,haproxy_backendSourceIP:10.3.2.30,haproxy_backendSourcePort:34006}

I have used the default settings as suggested in the Graylog documentation. When I click “Try” I am provided with a message that “nothing will be extracted”. I’m not sure what I am missing, it seems fairly simple. Would anyone be able to tell me if I am missing something simple here? I’ve provided the configuration below:
Flatten structure- YES
Line item seperator= ,
Key/Value separator= :

Thank you for your time.

2

I ran into the same problem parsing haproxy logs. Make sure your JSON is formatted correctly. Is that the entire message? mine had prepended something like this “<134>Nov 2 09:47:49 haproxy[593]:” before the JSON string. Causing the JSON extractor to fail being it wasn’t in spec. To remedy I had to extract that prepended piece out of the string and use the JSON extractor against the new field and all worked fine. Also running your JSON string through a validator I’m seeing it isn’t conforming to specifications. I’d look at that first. Once your JSON is within within spec it should work great.

3

Matt- Thanks a ton. I went through and added a space in the haproxy log-format and it resolved the issue! I really appreciate your quick response and I’ve posted below the proper haproxy log format below in case anyone else runs into this issue:

log-format ‘{“haproxy_clientIP” :"%ci",“haproxy_clientPort” :"%cp",“haproxy_dateTime” :"%t",“haproxy_frontendNameTransport” :"%ft",“haproxy_backend” :"%b",“haproxy_serverName” :"%s",“haproxy_Tw” :"%Tw",“haproxy_Tc” :"%Tc",“haproxy_Tt” :"%Tt",“haproxy_bytesRead” :"%B",“haproxy_terminationState” :"%ts",“haproxy_actconn” :%ac,“haproxy_FrontendCurrentConn” :%fc,“haproxy_backendCurrentConn” :%bc,“haproxy_serverConcurrentConn” :%sc,“haproxy_retries” :%rc,“haproxy_srvQueue” :%sq,“haproxy_backendQueue” :%bq,“haproxy_backendSourceIP” :"%bi",“haproxy_backendSourcePort” :"%bp"}’

4

No problem. If you want to check it out or haven’t seen the post yet I did make a post last week to help people out with just this situation with the log format I put together. If it helps further great. Here is the post link. HAProxy JSON log shipping WITHOUT nxlog

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.