haproxy-logs

1filter: "evt.Parsed.program startsWith 'haproxy'"1
2onsuccess: next_stage2
3name: crowdsecurity/haproxy-logs
4description: "Parse haproxy http logs"
5nodes:3
6- grok:4
7    pattern: '%{IP:client_ip}:%{INT:client_port} \[%{HAPROXYDATE:accept_date}\] %{NOTSPACE:frontend_name} %{NOTSPACE:backend_name}/%{NOTSPACE:server_name} %{INT:time_request}/%{INT:time_queue}/%{INT:time_backend_connect}/%{INT:time_backend_response}/%{NOTSPACE:time_duration} %{INT:http_status_code} %{NOTSPACE:bytes_read} %{DATA:captured_request_cookie} %{DATA:captured_response_cookie} %{NOTSPACE:termination_state} %{INT:actconn}/%{INT:feconn}/%{INT:beconn}/%{INT:srvconn}/%{NOTSPACE:retries} %{INT:srv_queue}/%{INT:backend_queue} (\{%{HAPROXYCAPTUREDREQUESTHEADERS}\})?( )?(\{%{HAPROXYCAPTUREDRESPONSEHEADERS}\})?( )?"(<BADREQ>|(%{WORD:http_verb} (%{URIPROTO:http_proto}://)?(?:%{USER:http_user}(?::[^@]*)?@)?(?:%{URIHOST:http_host})?(?:%{URIPATHPARAM:http_request})?( HTTP/%{NUMBER:http_version})?))?"'
8    apply_on: message
9  statics:5
10  - meta: log_type
11    value: http_access-log
12    
13- grok:4
14    pattern: '%{IP:client_ip}:%{INT:client_port} \[%{HAPROXYDATE:accept_date}\] %{NOTSPACE:frontend_name}/%{NOTSPACE:server_name}: SSL handshake failure'
15    apply_on: message
16  statics:5
17    - meta: log_type
18      value: bad_ssl_handshake
19
20statics:
21    #HAPROXYDATE format is unknown to dateparse, let convert it to a format we know to parse
22  - target: evt.StrTime
23    expression: evt.Parsed.haproxy_monthday + '/' + evt.Parsed.haproxy_month   + '/' + evt.Parsed.haproxy_year  + ':' +   evt.Parsed.haproxy_hour + ':' + evt.Parsed.haproxy_minute + ':' +  evt.Parsed.haproxy_second[0:2] + ' -0000'
24  - meta: service
25    value: http
26  - meta: source_ip
27    expression: evt.Parsed.client_ip
28  - meta: http_path
29    expression: evt.Parsed.http_request
30  - meta: http_status
31    expression: evt.Parsed.http_status_code
32  - meta: http_verb
33    expression: evt.Parsed.http_verb
34  - parsed: request
35    expression: evt.Parsed.http_request
36  - parsed: verb
37    expression: evt.Parsed.http_verb
38