Halog not able to parse logfile

Hi
I noticed that halog is not able to parse my logfile.
I did not specify a custom log format.

> cat access.log | halog -u -H -q
#req err ttot tavg oktot okavg bavg btot src
>

It seems that the first field is not written to the log. (Notice the leading space)

> cat access.log | head -1
 91.1.2.3:52057 [17/Feb/2021:03:09:01.597] EXT_WEB~ be/srv2:443 0/0/0/11/11 401 1737 - - --NI 469/346/156/268009/0 0/0 "GET / HTTP/1.1"

I assume that halog would be able to parse the log, if the first field was written by haproxy.
What do I need to do, to get a logfile, that becomes parsable to halog?

> haproxy -v
HA-Proxy version 2.2.8-7bf78d7 2021/01/13 - https://haproxy.org/
Status: long-term supported branch - will stop receiving fixes around Q2 2025.
Known bugs: http://www.haproxy.org/bugs/bugs-2.2.8.html
Running on: Linux 3.10.0-1160.11.1.el7.x86_64 #1 SMP Fri Dec 18 16:34:56 UTC 2020 x86_64

Excerpts from haproxy.cfg:

global
    chroot      /var/lib/haproxy
    log         /dev/log local0 info
    pidfile     /var/run/haproxy.pid
    user        haproxy
    group       haproxy
    daemon

defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull

/etc/rsyslog.d/49-haproxy.conf :

$AddUnixListenSocket /var/lib/haproxy/dev/log
$template HAProxy,"%TIMESTAMP% %syslogseverity-text:::UPPERCASE%: %msg:::drop-last-lf%\n"
$template HAProxyAccess,"%msg%\n"

if $programname startswith 'haproxy' then {
  if $syslogseverity == 6 then {
      action(type="omfile" file="/data/log/haproxy/access.log" template="HAProxyAccess")
      stop
  }
  if $syslogseverity <= 3 then {
      action(type="omfile" file="/data/log/haproxy/error.log" template="HAProxy")
      stop
  }
  if $syslogseverity <= 5 then {
      action(type="omfile" file="/data/log/haproxy/status.log" template="HAProxy")
      stop
  }
}

1 post - 1 participant

Read full topic