A Content Pack for Graylog2/Graylog3 which supports HTTP Real-Time logging and Monitoring from HAProxy[1.5/1.8].
Graylog2 Content Pack - Refer graylog2_contentPack branch
Web Applications — Centralized Logging and Monitoring with Graylog
This content pack includes following configurations for one click setup:
JSON Logging
Inputs
Extractors
Streams
Dashboards
Centralized logging is an important component of any production-grade infrastructure.Analyzing log data can help in debugging issues with your deployed applications and services, such as determining the reason for service termination or application crash.
Compatible/Tested with following versions:
Enabling custom HAProxy logging in JSON format
$ vi /etc/haproxy/haproxy.cfg
```
Only Mentioning changes for full configuration refer haproxy.cfg
global
log 127.0.0.1 len 8096 local2
log-send-hostname
defaults
log-format {\”haproxy_clientIP\”:\”%ci\”,\”haproxy_clientPort\”:\”%cp\”,\”haproxy_dateTime\”:\”%t\”,\”haproxy_frontendNameTransport\”:\”%ft\”,\”haproxy_backend\”:\”%b\”,\”haproxy_serverName\”:\”%s\”,\”haproxy_Tw\”:\”%Tw\”,\”haproxy_Tc\”:\”%Tc\”,\”haproxy_Tt\”:\”%Tt\”,\”haproxy_bytesRead\”:\”%B\”,\”haproxy_terminationState\”:\”%ts\”,\”haproxy_actconn\”:%ac,\”haproxy_FrontendCurrentConn\”:%fc,\”haproxy_backendCurrentConn\”:%bc,\”haproxy_serverConcurrentConn\”:%sc,\”haproxy_retries\”:%rc,\”haproxy_srvQueue\”:%sq,\”haproxy_backendQueue\”:%bq,\”haproxy_backendSourceIP\”:\”%bi\”,\”haproxy_backendSourcePort\”:\”%bp\”,\”haproxy_statusCode\”:\”%ST\”,\”haproxy_serverIP\”:\”%si\”,\”haproxy_serverPort\”:\”%sp\”,\”haproxy_frontendIP\”:\”%fi\”,\”haproxy_frontendPort\”:\”%fp\”,\”haproxy_capturedRequestHeaders\”:\”%hr\”,\”haproxy_httpRequest\”:\”%r\”}
frontend Local_Server
capture request header Host len 30
capture request header User-Agent len 200
capture request header Referer len 800
capture request header X-Forwarded-For len 20
bind 0.0.0.0:80
mode http
default_backend My_Web_Servers
backend My_Web_Servers
mode http
balance roundrobin
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request add-header X-Forwarded-Proto https if { ssl_fc }
option httpchk HEAD / HTTP/1.1rnHost:localhost
server app1 127.0.0.1:8081
server app2 127.0.0.1:8082
listen stats
bind 0.0.0.0:1936
stats enable
stats hide-version
stats refresh 30s
stats show-node
stats auth admin:admin
stats uri /stats
> rsyslogd 8.32.0> Enabling rsyslog to receive logs on 127.0.0.1 -> UDP port 514#### $ vi /etc/rsyslog.conf [Add at the end of Module section - Refer rsyslog.conf]
$ModLoad imudp
$UDPServerAddress 127.0.0.1
$UDPServerRun 514
#### $ vi /etc/rsyslog.d/49-haproxy.conf [Refer 49-haproxy.conf]
$template GRAYLOGRFC5424,”<%PRI%>%PROTOCOL-VERSION% %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\$
local2.=info -/var/log/haproxy/haproxy.log;GRAYLOGRFC5424
local2.=info @172.31.10.107:12211;GRAYLOGRFC5424
& stop
local2.=notice -/var/log/haproxy/haproxy-status.log;GRAYLOGRFC5424
& stop
#### Extractors of HAProxy log input [import it if not created by content pack ~ haproxy-graylog-extractors.json]
Extract JSON fields
Empty JSON field
Reduced message to path
HTTP Method from haproxy_httpRequest
HTTP URI from haproxy_httpRequest
HTTP Request Protocol version from haproxy_httpRequest
Empty haproxy_httpRequest Field
Removing parenthesis from String
Host Extraction from Captured HTTP Request
User Agent Extraction from Captured HTTP Request
HTTP Referer Extraction from Captured HTTP Request
#### graylog-custom-mapping.json - custom index mappingswhy we need custom mapping?haproxy_Tc,haproxy_Tt and haproxy_bytesRead fields are saved as a string.Sometimes it’s useful to not rely on Elasticsearch’s dynamic mapping but to define a stricter schema for messages.In order to extend the default mapping of Elasticsearch and Graylog, you can create one or more custom index mappings and add them as index templates to Elasticsearch.- Creating a new index templateSave the following index template for the custom index mapping into a file named graylog-custom-mapping.json:
{
“template”: “graylog_*”,
“mappings” : {
“message” : {
“properties” : {
“haproxy_Tc” : {
“type” : “long”
},
“haproxy_Tt” : {
“type” : “long”
},
“haproxy_Tw” : {
“type” : “long”
},
“haproxy_bytesRead” : {
“type” : “long”
}
}
}
}
}
Finally, load the index mapping into Elasticsearch with the following command:
$ curl -X PUT -d @’graylog-custom-mapping.json’ -H ‘Content-Type: application/json’ ‘http://localhost:9200/_template/graylog-custom-mapping?pretty‘
{
“acknowledged” : true
}
If you've Elasticsearch 7.X then the above custom mapping won't work but don't worry we've the fix. Thanks to this issue reporter: [Link](https://github.com/hariom282538/graylog-content-pack-haproxy-json/issues/5)Graylog custom mapping for Elasticsearch version 7.x
{
“template”: “graylog_*”,
“mappings” : {
"properties" : {"haproxy_Tc" : {"type" : "long"},"haproxy_Tt" : {"type" : "long"},"haproxy_Tw" : {"type" : "long"},"haproxy_bytesRead" : {"type" : "long"}}
}
}
- Rotate indices manually- GUI : System>Indices> | Select "Default index set" Maintenace>Rotate Active write index- verify : ``` $ curl -X GET 'http://localhost:9200/graylog_deflector/_mapping?pretty'
Want to contribute? Great!
support developers/maintainers you depend on, too!