HAProxy HTTP Log Format Regex Extractor & Grok Expressions

Explicit Grok Pattern (with Type Coercion)

^(?:%{SYSLOGTIMESTAMP:syslog_timestamp}\s+%{HOSTNAME:syslog_host}\s+haproxy\[%{POSINT:syslog_pid:int}\]:\s+)?%{IPORHOST:client_ip}:%{POSINT:client_port:int}\s+\[%{NOTSPACE:accept_date}\]\s+%{NOTSPACE:frontend_name}\s+%{NOTSPACE:backend_name}/%{NOTSPACE:server_name}\s+%{INT:time_wait_request:int}/%{INT:time_wait_queue:int}/%{INT:time_connect_tcp:int}/%{INT:time_response_server:int}/%{INT:time_total_active:int}\s+%{INT:status_code:int}\s+%{INT:bytes_read:int}\s+%{NOTSPACE:client_cookie}\s+%{NOTSPACE:server_cookie}\s+%{NOTSPACE:termination_state}\s+%{INT:actconn:int}/%{INT:feconn:int}/%{INT:beconn:int}/%{INT:srvconn:int}/%{INT:retries:int}\s+%{INT:srv_queue:int}/%{INT:backend_queue:int}\s+"(?:%{WORD:http_verb}\s+%{NOTSPACE:http_request}(?:\s+HTTP/%{NUMBER:http_version})?|%{DATA:raw_request})"$

High-Performance PCRE Regex (Named Capture Groups)

Optimized for Fluent Bit, Vector VRL, ClickHouse, and Python re modules:

^(?:(?[A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2})\s+(?\S+)\s+haproxy\[(?\d+)\]:\s+)?(?[\w\.\:]+):(?\d+)\s+\[(?[^\]]+)\]\s+(?\S+)\s+(?\S+)\/(?\S+)\s+(?-?\d+)\/(?-?\d+)\/(?-?\d+)\/(?-?\d+)\/(?-?\d+)\s+(?\d+)\s+(?\d+)\s+(?\S+)\s+(?\S+)\s+(?[A-Za-z\-]{2,4})\s+(?\d+)\/(?\d+)\/(?\d+)\/(?\d+)\/(?\d+)\s+(?\d+)\/(?\d+)\s+"(?:(?[A-Z]+)\s+(?[^\s"]+)(?:\s+HTTP\/(?[\d\.]+))?|(?[^"]+))"$

Vector Remap Language (VRL) Transform

Native Rust parsing with regex pattern extraction, type casting, and timestamp parsing:

# Vector Remap Language (VRL) - HAProxy HTTP Parser
parsed, err = parse_regex(.message, r'^(?:(?P[A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2})\s+(?P\S+)\s+haproxy\[(?P\d+)\]:\s+)?(?P[\w\.\:]+):(?P\d+)\s+\[(?P[^\]]+)\]\s+(?P\S+)\s+(?P\S+)\/(?P\S+)\s+(?P-?\d+)\/(?P-?\d+)\/(?P-?\d+)\/(?P-?\d+)\/(?P-?\d+)\s+(?P\d+)\s+(?P\d+)\s+(?P\S+)\s+(?P\S+)\s+(?P[A-Za-z\-]{2,4})\s+(?P\d+)\/(?P\d+)\/(?P\d+)\/(?P\d+)\/(?P\d+)\s+(?P\d+)\/(?P\d+)\s+"(?:(?P[A-Z]+)\s+(?P[^\s"]+)(?:\s+HTTP\/(?P[\d\.]+))?|(?P[^"]+))"$')

if err != null {
  log("HAProxy parse error: " + err, level: "warn")
} else {
  . = merge(., parsed)
  .client_port = to_int!(.client_port)
  .status = to_int!(.status)
  .bytes = to_int!(.bytes)
  .tr_wait_ms = to_int!(.tr_wait)
  .tw_queue_ms = to_int!(.tw_queue)
  .tc_conn_ms = to_int!(.tc_conn)
  .tr_resp_ms = to_int!(.tr_resp)
  .ta_active_ms = to_int!(.ta_active)
  .timestamp = parse_timestamp!(.timestamp, "%d/%b/%Y:%T%.3f")
  del(.message)
}

Fluent Bit Regex Parser (parsers.conf)

Oniguruma regex parser configuration for edge logging:

[PARSER]
    Name        haproxy_httplog
    Format      regex
    Regex       ^(?:(?[A-Z][a-z]{2}\s+\d+\s+\d{2}:\d{2}:\d{2})\s+(?\S+)\s+haproxy\[(?\d+)\]:\s+)?(?[\w\.\:]+):(?\d+)\s+\[(?[^\]]+)\]\s+(?\S+)\s+(?\S+)\/(?\S+)\s+(?-?\d+)\/(?-?\d+)\/(?-?\d+)\/(?-?\d+)\/(?-?\d+)\s+(?\d+)\s+(?\d+)\s+(?\S+)\s+(?\S+)\s+(?\S+)\s+(?\S+)\s+(?\S+)\s+"(?[^"]+)"$
    Time_Key    time
    Time_Format %d/%b/%Y:%H:%M:%S.%L
    Types       client_port:integer status_code:integer bytes_read:integer tr_wait:integer tw_queue:integer tc_conn:integer tr_resp:integer ta_active:integer