haproxy

[pccwglobalit]

we want to filtering haproxy tcp log, can we use the below filter?

Code: Select all

if [program] == 'haproxy' {
        grok {
            match => [ 'message', '%{HAPROXY} ]
        }
        date {
            match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z' ]
        }
    geoip {
        source => 'client_ip'
    }
    }

will above filter ok?
thanks.

[cdienger]

I would try the following slight variation instead:

Code: Select all

if [program] == 'haproxy' {
        grok {
            match => [ 'message', '%{HAPROXYTCP}' ]
        }
        date {
            match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z' ]
        }
    geoip {
        source => 'client_ip'
    }
    }