# How to parse Haproxy log with grok **URL:** \ **Category:** Logstash\ **Created:** [December 3, 2018, 4:19pm UTC](https://discuss.elastic.co/t/how-to-parse-haproxy-log-with-grok/159217 "2018-12-03T16:19:05Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Momo](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Momo](https://discuss.elastic.co/u/Momo)\ **Post date:** [December 3, 2018, 4:19pm UTC](https://discuss.elastic.co/t/how-to-parse-haproxy-log-with-grok/159217/1 "2018-12-03T16:19:05Z")
Hello, I am a new elastic stack user. I want to parse the following log : Dec 3 14:05:17 f774bd25748a local0.info haproxy[1]: unix:1 [03/Dec/2018:14:05:17.559] frontend.https.services~ https.services.tac/https.services.tac.1 0/0/1/13/14 200 1058 - - ---- 1773/140/0/0/0 0/0 "POST /tac/medias/access HTTP/1.1"Dec 3 14:05:17 10.0.0.3 frontend\_proxy.qed9mwptyw6kdo3i9y9uogdl0.jie6pdr[15900]: Dec 3 14:05:17 f6047fe55160 local0.info haproxy[1]: unix:1 [03/Dec/2018:14:05:17.506] frontend.https.services~ https.services.css/https.services.css.2 0/0/1/70/72 200 1673 - - ---- 1768/145/0/0/0 0/0 "POST /css/catalog/medias/d55c1a3e-1c90-4a8c-8c21-dc23fdab4024?bundleItemT I tried with the following filter from the dev tools console of elasticsearch but it doesn't work : (?:%{SYSLOGTIMESTAMP:syslog\_timestamp}|%{TIMESTAMP\_ISO8601:timestamp8601}) %{IPORHOST:syslog\_server} %{SYSLOGPROG}: %{IP:client\_ip}:%{INT:client\_port} [%{HAPROXYDATE:accept\_date}] %{NOTSPACE:frontend\_name} %{NOTSPACE:backend\_name}/%{NOTSPACE:server\_name} %{INT:time\_queue}/%{INT:time\_backend\_connect}/%{NOTSPACE:time\_duration} %{NOTSPACE:bytes\_read} %{NOTSPACE:termination\_state} %{INT:actconn}/%{INT:feconn}/%{INT:beconn}/%{INT:srvconn}/%{NOTSPACE:retries} %{INT:srv\_queue}/%{INT:backend\_queue} Thank you for your help. ---
**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\ **Post date:** [December 5, 2018, 3:34am UTC](https://discuss.elastic.co/t/how-to-parse-haproxy-log-with-grok/159217/2 "2018-12-05T03:34:37Z")
Try re-creating your grok filter from scratch again using: [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) The example you pasted and the grok filter don't match up at all... it seems to fall apart after: %{IPORHOST:syslog\_server} ---
**Author:** ![Momo](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Momo](https://discuss.elastic.co/u/Momo)\ **Post date:** [December 5, 2018, 9:14am UTC](https://discuss.elastic.co/t/how-to-parse-haproxy-log-with-grok/159217/3 "2018-12-05T09:14:14Z")
Here my solution. ```auto %{SYSLOGTIMESTAMP:timestamp} %{DATA:Aloha_name} %{DATA:SyslogFacility} %{DATA:Haproxy_process}: %{DATA:client_ip}:%{INT:client_port} \[%{HAPROXYDATE:accept_date}\] %{NOTSPACE:frontend_name} %{NOTSPACE:backend_name}/%{NOTSPACE:server_name} %{INT:Tq}/%{INT:Tw}/%{INT:Tc}/%{INT:Tr}/%{INT:Tt} %{INT:http_status_code} %{NOTSPACE:bytes_read} - - ---- %{INT:actconn}/%{INT:feconn}/%{INT:beconn}/%{INT:srvconn}/%{NOTSPACE:retries} %{INT:srv_queue}/%{INT:backend_queue} "%{WORD:Method} %{URIPATHPARAM:request} HTTP/%{NUMBER:http_version}" ``` [https://cdn.haproxy.com/wp-content/uploads/2017/07/aloha\_load\_balancer\_memo\_log.pdf](https://cdn.haproxy.com/wp-content/uploads/2017/07/aloha_load_balancer_memo_log.pdf) ---
**Author:** ![Momo](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Momo](https://discuss.elastic.co/u/Momo)\ **Post date:** [December 5, 2018, 9:18am UTC](https://discuss.elastic.co/t/how-to-parse-haproxy-log-with-grok/159217/4 "2018-12-05T09:18:11Z")
That's what I did 😉 ---
**Author:** ![monica](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monica/32/3696_2.png) [@monica](https://discuss.elastic.co/u/monica)\ **Post date:** [December 6, 2018, 11:17am UTC](https://discuss.elastic.co/t/how-to-parse-haproxy-log-with-grok/159217/5 "2018-12-06T11:17:40Z")
If you are using Filebeat to collect the logs, then you can enable the haproxy module that does the parsing for you, without the need to write your own grok filter. ---
**Author:** ![Momo](https://avatars.discourse-cdn.com/v4/letter/m/f4b2a3/32.png) [@Momo](https://discuss.elastic.co/u/Momo)\ **Post date:** [December 6, 2018, 6:00pm UTC](https://discuss.elastic.co/t/how-to-parse-haproxy-log-with-grok/159217/6 "2018-12-06T18:00:56Z")
I don't think I can do that because my logs are prefixed by syslog. syslog + haproxy log ```auto Dec 4 15:21:02 10.0.0.3 frontend_proxy.qed9mwptyw6kdo3i9y9uogdl0.jie6pdr[15900]: Dec 4 15:21:02 f6047fe55160 local0.info haproxy[1]: unix:1 [04/Dec/2018:15:21:02.563] frontend.https.services~ https.services.cmm/https.services.cmm.2 0/0/1/18/20 200 3920 - - ---- 1968/186/0/0/0 0/0 "GET /cmm/customers/b296a899-0421-4e00-9bf8-f5e7331c6a9a HTTP/1.1" ``` I don't have access to the host machine ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 3, 2019, 6:00pm UTC](https://discuss.elastic.co/t/how-to-parse-haproxy-log-with-grok/159217/7 "2019-01-03T18:00:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.