Filebeat Haproxy module configuration

Elastic Stack Beats
,
1

Hi! I want to configure the haproxy module on filebeat. I did it and i am getting some fileds but others are empty.
Here is my filebeat configuration

# Module: haproxy
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.8/filebeat-module-haproxy.html

- module: haproxy
  # All logs
  log:
    enabled: true

    # Set which input to use between syslog (default) or file.
    #var.input:
    var.input: "file"

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:
    var.paths: ["/var/log/haproxy/haproxy.log"]

Here is part of my haproxy.cfg that sets the logging

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull

And here my syslog file (the one that send haproxy logs to the file)

$ModLoad imudp
$UDPServerRun 514
$template Haproxy,"%msg%\n"
local2.=info -/var/log/haproxy/haproxy.log;Haproxy
local2.notice -/var/log/haproxy/haproxy-status.log;Haproxy

And finally here is a log line

127.0.0.1:16939 [27/Sep/2018:13:50:49.527] FRONTEND~ BACKEND/NODE 1/0/13/43/57 200 265 - - ---- 1/1/0/1/0 0/0 {HEADER1|HEADER2|HEADER3} "GET /Information HTTP/1.1"

Something is off because the default haproxy dashboard on kibana have some visualizations empty. Also, i would like to use syslog to get the logs and not the file but there is not much docs about it.

2

By default HAProxy module uses syslog to fetch logs:

The module is by default configured to run via syslog on port 9001. However it can also be configured to read from a file path. See the following example.

To change its config set syslog_host and syslog_port.

3

That is what i don't fully understand. My Haproxy send the logs to syslog with this:

global
        log         127.0.0.1 local2

Should i add another line in the rsyslog config to send the information to localhost to the port 9001 so filebeat can read it? Something like this i imagine:

local2.* @@127.0.0.1:9001

4

Does anyone have any idea about this? I would like to understand the configuration of haproxy y filebeat in order to send the information.

5

Have you seen this HAProxy blog post? https://www.haproxy.com/blog/introduction-to-haproxy-logging/
This is a good guide about configuring HAProxy logging.

In Filebeat you just need to make sure you are setting the correct IP and port number for the module.

6

Sorry for the delay. I was between exams and another project at work.

I took a long read to the article that you mentioned (thanks for that!) but i still can't comprehend the configuration about the IP and port. There is no example in the official documentation on how to configure the module in order to receive information from syslog, only about the file configuration. Also, my status information run in /stats and not / as is mentioned in the link you provided.

I can still use the grok pattern that i created but i wanted to take a look at the dashboards that Kibana brings out of the box with my information.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.