Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend filebeat logstash patterns for the haproxy modul #21332

Closed
itsx opened this issue Sep 25, 2020 · 2 comments
Closed

Extend filebeat logstash patterns for the haproxy modul #21332

itsx opened this issue Sep 25, 2020 · 2 comments
Labels
Stalled Team:Service-Integrations Label for the Service Integrations team

Comments

@itsx
Copy link

itsx commented Sep 25, 2020

Enhancement:
Enhance Logstash patterns in the haproxy module to match yet another specific kind of a logline (example of the logline is below).

Specific use case for the enhancement:
We are using ELK stack to collect logs. In our setup we don't use haproxy module, using our own filebeat and logstash configs.
But we have examined and used logstash grok patterns in a haproxy module to have rather complete cover of possible haproxy loglines.

After some time we spotted a couple of loglines, which were not matched and generated _grokparsefailure tag.
Apparently this logline correspond to a haproxy connection/availability problem and is quite uncommon.

In our setup we are using all grok patterns from the haproxy module with one added pattern to catch this logline (pattern below).

HAProxy version:
HA-Proxy version 1.8.8-1ubuntu0.10 2020/04/03
Unmatched logline:
Sep 21 14:54:37 api-lb1 haproxy[17648]: Server api-backend/api3 is DOWN, reason: Layer4 connection problem, info: "Connection refused", check duration: 0ms. 2 active and 0 backup servers left. 0 sessions active, 0 requeued, 0 remaining in queue.
Used grok patterns from a haproxy module:

- '%{HAPROXY_DATE:haproxy.request_date} %{IPORHOST:haproxy.source} %{PROG:process.name}(?:\[%{POSINT:process.pid:long}\])?:

Our added Logstash grok pattern:
%{SYSLOGTIMESTAMP:[@metadata][timestamp]} %{GREEDYDATA} %{NOTSPACE:process.name}\[%{NUMBER:process.pid}\]: Server %{NOTSPACE:haproxy.backend_name}/%{NOTSPACE:haproxy.server_name} %{GREEDYDATA}

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Sep 25, 2020
@andresrc andresrc added the Team:Services (Deprecated) Label for the former Integrations-Services team label Sep 27, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/integrations-services (Team:Services)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Sep 27, 2020
@jsoriano jsoriano added the Team:Integrations Label for the Integrations team label Dec 9, 2021
@jlind23 jlind23 added Team:Service-Integrations Label for the Service Integrations team and removed Team:Integrations Label for the Integrations team Team:Services (Deprecated) Label for the former Integrations-Services team labels Mar 31, 2022
@botelastic
Copy link

botelastic bot commented Mar 31, 2023

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

@botelastic botelastic bot added the Stalled label Mar 31, 2023
@botelastic botelastic bot closed this as completed Sep 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Stalled Team:Service-Integrations Label for the Service Integrations team
Projects
None yet
Development

No branches or pull requests

5 participants