# Additional string in existing logstash config file to index haproxy

**URL:** <https://discuss.elastic.co/t/additional-string-in-existing-logstash-config-file-to-index-haproxy/218690>\
**Category:** Logstash\
**Created:** [February 10, 2020, 11:40pm UTC](https://discuss.elastic.co/t/additional-string-in-existing-logstash-config-file-to-index-haproxy/218690 "2020-02-10T23:40:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![julian6709](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@julian6709](https://discuss.elastic.co/u/julian6709)\
**Post date:** [February 10, 2020, 11:40pm UTC](https://discuss.elastic.co/t/additional-string-in-existing-logstash-config-file-to-index-haproxy/218690/1 "2020-02-10T23:40:33Z")

</div>

Hi I am very new in logstash and ELK, can some one help me to create proper string in the logstash config file to index some fields?

Example:  
"\<134\>Jan 30 20:25:51 haproxy[8265]: 192.168.1.10:57176 [30/Jan/2020:20:25:50.490] minio~ dev4\_cluster/minioh1 83/0/0/534/617 200 360 - - ---- 5/5/3/4/0 0/0 "PUT /mybucket/12?partNumber=75&uploadId=b8c9037f-b0d3-4040-943a-f73af52b890a HTTP/1.1"\n",

The fields that'd probably be the most useful to me are:

%ci (client IP)  
%B (status code)  
%r (http request)

Below is the existing string in the conf file, can additional string be added to that and what that will be?

if [type] == "qumulo" {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:syslog\_timestamp} %{HOSTNAME:q\_server} %{WORD:q\_service} - - - %{IPV4:q\_client\_ip},"%{DATA:q\_client\_user}",%{WORD:q\_protocol},%{DATA:q\_fs\_operation},%{WORD:q\_status},(%{POSINT:q\_file\_id})?,"%{DATA:q\_file\_path}","%{DATA:q\_secondary\_file\_path}"" }

the default HAProxy http log format is being used:  
"%ci:%cp\ [%t]\ %ft\ %b/%s\ %Tq/%Tw/%Tc/%Tr/%Tt\ %ST\ %B\ %CC\ \ %CS\ %tsc\ %ac/%fc/%bc/%sc/%rc\ %sq/%bq\ %hr\ %hs\ %{+Q}r"

Thx  
Julian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2020, 11:40pm UTC](https://discuss.elastic.co/t/additional-string-in-existing-logstash-config-file-to-index-haproxy/218690/2 "2020-03-09T23:40:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.