# Filebeat Haproxy TCP log grok expressions do not match

**URL:** <https://discuss.elastic.co/t/filebeat-haproxy-tcp-log-grok-expressions-do-not-match/221055>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 26, 2020, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-tcp-log-grok-expressions-do-not-match/221055 "2020-02-26T14:25:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jacob-N](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@Jacob-N](https://discuss.elastic.co/u/Jacob-N)\
**Post date:** [February 26, 2020, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-tcp-log-grok-expressions-do-not-match/221055/1 "2020-02-26T14:25:08Z")

</div>

I am sending logs from haproxy to a filebeat via Syslog. Filebeat is able to parse an HTTP log but not a TCP log.

filebeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:06:45 +0000 UTC]

The log format is  
log-format "%ci:%cp [%t] %ft %b/%s %Tw/%Tc/%Tt %B %ts %ac/%fc/%bc/%sc/%rc %sq/%bq"

Example  
Feb 26 14:07:42 haproxy[29113]: xxx.xxx.xxx.xxx:49954 [26/Feb/2020:14:07:42.822] HTTPS Backend/SERVER 1/1/119 1886 -- 8/8/0/0/0 0/0

from the haproxy documentation

> **[Introduction to HAProxy Logging - HAProxy Technologies](https://www.haproxy.com/blog/introduction-to-haproxy-logging/)**
>
> How to set up HAProxy logging, target a Syslog server, understand the log fields, and some helpful tools for parsing log files.

and I can see this has been resolved in the past here.

> <https://github.com/elastic/beats/pull/8637>

---

<div class="post-metadata">

**Author:** ![Jacob-N](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@Jacob-N](https://discuss.elastic.co/u/Jacob-N)\
**Post date:** [March 10, 2020, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-tcp-log-grok-expressions-do-not-match/221055/2 "2020-03-10T13:02:01Z")

</div>

Got it! I needed to add

"log-send-hostname"

to the global settings.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 7, 2020, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-tcp-log-grok-expressions-do-not-match/221055/3 "2020-04-07T13:02:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.