3

I am new to ha-proxy and trying to push the logs to elastic search using filebeat. As filebeat only takes json format and I am not getting a way to configure ha-proxy to output the logs in json format, which includes both success and error cases.

I have tried the below log format in conf file - 

log-format '{"host":"%H","ident":"haproxy","pid":%pid,"time":"%Tl","haproxy":{"conn":{"act":%ac,"fe":%fc,"be":%bc,"srv":%sc},"queue":{"backend":%bq,"srv":%sq},"time":{"tq":%Tq,"tw":%Tw,"tc":%Tc,"tr":%Tr,"tt":%Tt},"termination_state":"%tsc","retries":%rc,"network":{"client_ip":"%ci","client_port":%cp,"frontend_ip":"%fi","frontend_port":%fp},"ssl":{"version":"%sslv","ciphers":"%sslc"},"request":{"method":"%HM","uri":"%[capture.req.uri,json(utf8s)]","protocol":"%HV","header":{"host":"%[capture.req.hdr(0),json(utf8s)]","xforwardfor":"%[capture.req.hdr(1),json(utf8s)]","referer":"%[capture.req.hdr(2),json(utf8s)]"}},"name":{"backend":"%b","frontend":"%ft","server":"%s"},"response":{"status_code":%ST,"header":{"xrequestid":"%[capture.res.hdr(0),json(utf8s)]"}},"bytes":{"uploaded":%U,"read":%B}}}'

And now the json logs are written along with regular logs in same old log file. But a pule json log file is needed for the filebeat and in separate file.

Any leads would be helpful.

Thanks.

Jet
  • 3,018
  • 4
  • 33
  • 48

1 Answers1

2

Filebeat is pretty fine with JSON logs or plain text logs. The opposite is even mainly the case for infrastructure logs like server or syslog messages.

I addition, filebeat provides you with a dedicated ha-proxy module, which will simplify your task a lot. Please see the docs, there should be anything you need to setup filebeat for HA-Proxy.

Have Fun!

ibexit
  • 3,465
  • 1
  • 11
  • 25
  • AFAICT filebeat ha-proxy module does not work with anything but the default log-format, as soon as a custom log-format is used it is useless. Is that right? – jrwren Nov 16 '22 at 21:50