Filebeat Haproxy TCP log grok expressions do not match

Elastic Stack Beats
1

I am sending logs from haproxy to a filebeat via Syslog. Filebeat is able to parse an HTTP log but not a TCP log.

filebeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:06:45 +0000 UTC]

The log format is
log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq"

Example
Feb 26 14:07:42 haproxy[29113]: xxx.xxx.xxx.xxx:49954 [26/Feb/2020:14:07:42.822] HTTPS Backend/SERVER 1/1/119 1886 -- 8/8/0/0/0 0/0

from the haproxy documentation

and I can see this has been resolved in the past here.

2

Got it! I needed to add

"log-send-hostname"

to the global settings.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.