# Need help in creating grok patterns for haproxy logs

**URL:** <https://discuss.elastic.co/t/need-help-in-creating-grok-patterns-for-haproxy-logs/134180>\
**Category:** Logstash\
**Created:** [June 1, 2018, 9:05am UTC](https://discuss.elastic.co/t/need-help-in-creating-grok-patterns-for-haproxy-logs/134180 "2018-06-01T09:05:20Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![nareshreddyp](https://avatars.discourse-cdn.com/v4/letter/n/e56c9b/32.png) [@nareshreddyp](https://discuss.elastic.co/u/nareshreddyp)\
**Post date:** [June 1, 2018, 4:08pm UTC](https://discuss.elastic.co/t/need-help-in-creating-grok-patterns-for-haproxy-logs/134180/8 "2018-06-01T16:08:40Z")

</div>

Finally able to get it. Thank you very much for your support.

\<%{NUMBER:number}\>0 %{TIMESTAMP\_ISO8601:timestamp} %{WORD:hostname} (%{WORD:service}-%{WORD:ServiceName}) %{INT:Process} %{PROG:string1} [type=%{PROG:haproxy}] [%{INT:processid}] [%{GREEDYDATA:unixtimestamp}] %{INT:ac}/%{INT:fc}/%{INT:bc}/%{INT:bq}/%{INT:sc}/%{INT:sq}/%{INT:rc} %{INT:Tq}/%{INT:Tw}/%{INT:Tc}/%{INT:Tr}/%{INT:Tt}/({|%{USER:username}|%{GREEDYDATA:LoginTicket}=|%{GREEDYDATA:header}}/) %{PROG:tws} %{IP:ClientIP}:%{INT:ClientPort} %{IP:FrontendIP}:%{INT:FrontendPort} %{IP:BackendIP}:%{INT:BackendPort} %{PROG:Transport\_Type}~ RequestCookies=- | "%{WORD:Method} %{URIPATHPARAM:request} HTTP/%{NUMBER:http\_version}" %{INT:HTTP\_Response\_Code} | %{WORD:backend}:%{WORD:backendserver}

---

_[View the full topic](https://discuss.elastic.co/t/need-help-in-creating-grok-patterns-for-haproxy-logs/134180)._