Can't parse haproxy logs without IP address in Grok

Grok is parsing successfully when Haproxy gives a log - from var/log/haproxy.log - similar to:

May 21 08:25:56 ha haproxy[5089]: 12.3.45.67:89012 [21/May/2021:08:25:56.055] www-https~ wss/wssnode website.domain.com 1/1/1/1/111 111 111 - - ---- 11111/11111/11111/111/0 0/0 "GET /ws/site/V3L235F/d88r3567pssllp/ HTTP/1.1"

But when instead of ip_address:port there's a -:port , for example:

May 21 08:25:56 ha haproxy[5089]: -:89012 [21/May/2021:08:25:56.055] www-https~ wss/wssnode website.domain.com 1/1/1/1/111 111 111 - - ---- 11111/11111/11111/111/0 0/0 "GET /ws/site/V3L235F/d88r3567pssllp/ HTTP/1.1"

I have an error:

Provided Grok expressions do not match field value: May 21 08:25:56 ha haproxy[5089]: -:89012 [21/May/2021:08:25:56.055] www-https~ wss/wssnode website.domain.com 1/1/1/1/111 111 111 - - ---- 11111/11111/11111/111/0 0/0 "GET /ws/site/V3L235F/d88r3567pssllp/ HTTP/1.1

Here's my /usr/share/filebeat/module/haproxy/log/pipline.json

I was trying to resolve this by adding a new pattern to grok with message field and by editing grok pattern with source.address field without success.

Is this a repeated issue you're having? Any special config that causes the - instead of an IP address? This should be an easy update to the ingest pipeline. Can you make an issue on GitHub for tracking?

Yes

No, default config. Haproxy doesn't intercept every log with IP addresses.

Actually I already have the correct Grok expression that works in debugger, but still it doesn't work in Kibana. Maybe there's something else that causes the error.
I'll create an issue on GitHub.

Thanks for your help.

Also what version of filebeat and elasticsearch are you using?

Filebeat 7.6.1
Elastic&Kibana 7.7.1

I created a PR, [Filebeat] Update HA Proxy log grok patterns by legoguy1000 · Pull Request #25835 · elastic/beats · GitHub, please take a look.

Thanks. I've replied under the issue discussion.

I've created the repo how to reproduce the error in ~5 minutes - make sure that you've made the all steps from README.md .
github.com/maarsaks/elk-docker-compose