# Filebeat Haproxy module configuration

**URL:** <https://discuss.elastic.co/t/filebeat-haproxy-module-configuration/240011>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [July 6, 2020, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-configuration/240011 "2020-07-06T13:37:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ndg](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@ndg](https://discuss.elastic.co/u/ndg)\
**Post date:** [July 6, 2020, 1:37pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-configuration/240011/1 "2020-07-06T13:37:14Z")

</div>

Hi! I want to configure the haproxy module on filebeat. I did it and i am getting some fileds but others are empty.  
Here is my filebeat configuration

```auto
# Module: haproxy
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.8/filebeat-module-haproxy.html

- module: haproxy
  # All logs
  log:
    enabled: true

    # Set which input to use between syslog (default) or file.
    #var.input:
    var.input: "file"

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:
    var.paths: ["/var/log/haproxy/haproxy.log"]

```

Here is part of my haproxy.cfg that sets the logging

```auto
defaults
        log global
        mode http
        option httplog
        option dontlognull

```

And here my syslog file (the one that send haproxy logs to the file)

```auto
$ModLoad imudp
$UDPServerRun 514
$template Haproxy,"%msg%\n"
local2.=info -/var/log/haproxy/haproxy.log;Haproxy
local2.notice -/var/log/haproxy/haproxy-status.log;Haproxy

```

And finally here is a log line

```auto
127.0.0.1:16939 [27/Sep/2018:13:50:49.527] FRONTEND~ BACKEND/NODE 1/0/13/43/57 200 265 - - ---- 1/1/0/1/0 0/0 {HEADER1|HEADER2|HEADER3} "GET /Information HTTP/1.1"

```

Something is off because the default haproxy dashboard on kibana have some visualizations empty. Also, i would like to use syslog to get the logs and not the file but there is not much docs about it.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [July 6, 2020, 3:21pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-configuration/240011/2 "2020-07-06T15:21:11Z")

</div>

By default HAProxy module uses syslog to fetch logs:

> The module is by default configured to run via syslog on port 9001. However it can also be configured to read from a file path. See the following example.

To change its config set `syslog_host` and `syslog_port`.

---

<div class="post-metadata">

**Author:** ![ndg](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@ndg](https://discuss.elastic.co/u/ndg)\
**Post date:** [July 6, 2020, 3:28pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-configuration/240011/3 "2020-07-06T15:28:50Z")

</div>

That is what i don't fully understand. My Haproxy send the logs to syslog with this:

```
global
        log 127.0.0.1 local2

```

Should i add another line in the rsyslog config to send the information to localhost to the port 9001 so filebeat can read it? Something like this i imagine:

> local2.\* @@127.0.0.1:9001

---

<div class="post-metadata">

**Author:** ![ndg](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@ndg](https://discuss.elastic.co/u/ndg)\
**Post date:** [July 8, 2020, 1:07pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-configuration/240011/4 "2020-07-08T13:07:55Z")

</div>

Does anyone have any idea about this? I would like to understand the configuration of haproxy y filebeat in order to send the information.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [July 9, 2020, 2:21pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-configuration/240011/5 "2020-07-09T14:21:00Z")

</div>

Have you seen this HAProxy blog post? [https://www.haproxy.com/blog/introduction-to-haproxy-logging/](https://www.haproxy.com/blog/introduction-to-haproxy-logging/)  
This is a good guide about configuring HAProxy logging.

In Filebeat you just need to make sure you are setting the correct IP and port number for the module.

---

<div class="post-metadata">

**Author:** ![ndg](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@ndg](https://discuss.elastic.co/u/ndg)\
**Post date:** [July 27, 2020, 6:22pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-configuration/240011/6 "2020-07-27T18:22:08Z")

</div>

Sorry for the delay. I was between exams and another project at work.

I took a long read to the article that you mentioned (thanks for that!) but i still can't comprehend the configuration about the IP and port. There is no example in the official documentation on how to configure the module in order to receive information from syslog, only about the file configuration. Also, my status information run in /stats and not / as is mentioned in the link you provided.

I can still use the grok pattern that i created but i wanted to take a look at the dashboards that Kibana brings out of the box with my information.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2020, 8:22pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-configuration/240011/7 "2020-08-24T20:22:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.