Getting this error when ingesting HAProxy logs:
Provided Grok expressions do not match field value:
[Jun 13 19:08:46 xxx-xxxxxx-mysql-lb-oltp-01 haproxy[991739]: Connect from 127.0.0.1:18714 to 127.0.0.1:3306 (mysql-cluster/TCP)]
From looking at the Elastic HAProxy integration documentation, it looks like the log is the default log format.
Any suggestions would be appreciated. I've looked at other posts and issues and it seems that this should be working - that's why I wanted to report this. I found suggestions on enabling other log modes - not very clear on how/where to do that, but I'll work with the people that own the server to try some of those options.
Using:
Elastic 8.14.1
HA-Proxy version 2.0.33-0ubuntu0.1 2023/10/31
HAProxy integration:
tried both logs-haproxy.log-1.12.0 and logs-haproxy.log-1.11.1
haproxy.cfg: (I've removed non-relevant configs)
global
external-check
stats socket /var/run/haproxy.sock mode 600 expose-fd listeners level user
maxconn 20000
log /dev/log local0 info
defaults
log global
retries 2
timeout connect 3000s
timeout server 5000s
timeout client 5000s
listen mysql-cluster-us-xxx-xxxxxxx-xxx
bind 0.0.0.0:3306
mode tcp
option external-check
maxconn 10000
log global
listen stats
mode http
bind 0.0.0.0:14567
stats enable
stats uri /stats