Make log from socket listener

[Badb0y (Bad)]

Hi,

Is there a way to make a log entry with filebeat from these entries that logstash can consume?

I have entries like this

Thu Mar 24 17:34:49 +07 2022
# table: https, type: ip, size:1048576, used:0

# table: http, type: ip, size:1048576, used:2
0x55dfab70bbd0: key=10.121.91.77 use=1 exp=4281 http_req_rate(10000)=1
0x55dfab726830: key=10.121.91.88 use=7 exp=6174 http_req_rate(10000)=7

Thu Mar 24 17:34:50 +07 2022
# table: https, type: ip, size:1048576, used:0

# table: http, type: ip, size:1048576, used:2
0x55dfab70bbd0: key=10.121.91.77 use=1 exp=3268 http_req_rate(10000)=1
0x55dfab726830: key=10.121.91.88 use=8 exp=9104 http_req_rate(10000)=8

Somehow I'd like to have like the following, take the date, put the hostname and app name followed by the entry.

From this:

Thu Mar 24 17:34:49 +07 2022
# table: https, type: ip, size:1048576, used:0

# table: http, type: ip, size:1048576, used:2
0x55dfab70bbd0: key=10.121.91.77 use=1 exp=4281 http_req_rate(10000)=1
0x55dfab726830: key=10.121.91.88 use=7 exp=6174 http_req_rate(10000)=7

I'd like to have the following log entry sent by filebeat:

Thu Mar 24 17:34:49 +07 2022 hostname haproxy_rate_limit: key=10.121.91.77 use=1 exp=4281 http_req_rate(10000)=1
Thu Mar 24 17:34:49 +07 2022 hostname haproxy_rate_limit: key=10.121.91.88 use=7 exp=6174 http_req_rate(10000)=7

How to achieve this? Appreciate your help.

[mtojek (Marcin Tojek)]

I'm not sure if it isn't faster to simply modify those files on the fly to the required format. What's the source of those entries? Can you adjust the source formatting instead?

[Badb0y (Bad)]

YEs, that's what I've done finally create log on the fly.
It is an haproxy listened information from socket with netcat.