Parsers and Generated Fields
Tag Fields Created by Parser haproxy
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser haproxy
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| None | @timestamp | Event timestamp | Parsed from @timestamp using parseTimestamp() with format "MMM [ ]d HH:mm:ss" |
| Vendor.client_ip (indirect) | client.address | Client address | Copied from source.address |
| Vendor.client_ip (indirect) | client.ip | Client IP address | Copied from client.address after IP validation |
| Vendor.client_port (indirect) | client.port | Client port | Copied from source.port |
| Vendor.BytesRead | destination.bytes | Destination bytes | Copied from Vendor.BytesRead |
| None | ecs.version | ECS schema version | Static value: 9.2.0 |
| Vendor.message | error.code | Error code | Extracted from Vendor.message using regex for error codes |
| Vendor.message | error.message | Error message | Copied from Vendor.message for error logs |
| None | event.category[] | Event categorization | Array populated based on log type: ["network"] for errors/TCP, ["web","network"] for HTTP |
| Vendor.bind_name, Vendor.status_code, Vendor.client_ip | event.dataset | Dataset identifier | Conditionally set based on log type: haproxy.error, haproxy.http, or haproxy.tcp |
| None | event.kind | Event kind | Static value: event |
| None | event.module | Module name | Static value: haproxy |
| Vendor.status_code, Vendor.bind_name | event.outcome | Event outcome | Conditionally set to "success" for 2xx status codes, "failure" for 4xx/5xx or errors |
| Vendor.status_code, Vendor.bind_name | event.type[] | Event type | Array populated based on context: ["connection","denied"] for errors, ["access","connection","allowed/denied"] for HTTP, ["connection","allowed"] for TCP |
| log.syslog.hostname | host.name | Host name | Copied from log.syslog.hostname |
| Vendor.method | http.request.method | HTTP request method | Copied from Vendor.method (extracted from HTTP request) |
| Vendor.bytes_read | http.response.bytes | HTTP response bytes | Copied from Vendor.bytes_read |
| Vendor.status_code | http.response.status_code | HTTP response status code | Copied from Vendor.status_code |
| Vendor.protocol | http.version | HTTP version | Extracted from Vendor.protocol using regex |
| None | log.syslog.appname | Syslog application name | Extracted from syslog header using regex |
| None | log.syslog.hostname | Syslog hostname | Extracted from syslog header using regex |
| None | log.syslog.priority | Syslog priority | Extracted from syslog header using regex |
| None | log.syslog.procid | Syslog process ID | Extracted from syslog header using regex |
| None | message | Log message content | Extracted from syslog header after timestamp and process info |
| Vendor.protocol | network.protocol | Network protocol | Extracted from Vendor.protocol using regex and converted to lowercase |
| log.syslog.hostname | observer.name | Observer name | Copied from log.syslog.hostname |
| log.syslog.appname | process.name | Process name | Copied from log.syslog.appname |
| log.syslog.procid | process.pid | Process ID | Copied from log.syslog.procid |
| Vendor.BytesRead (indirect) | server.bytes | Server bytes | Copied from destination.bytes |
| Vendor.frontend | service.name | Service name | Copied from Vendor.frontend |
| Vendor.client_ip | source.address | Source address | Copied from Vendor.client_ip and converted to lowercase |
| Vendor.client_ip (indirect) | source.ip | Source IP address | Copied from source.address after IP validation |
| Vendor.client_port | source.port | Source port | Copied from Vendor.client_port |
| Vendor.tls | tls.established | TLS connection established | Set to "true" when Vendor.tls equals "~" |
| Vendor.ssl_version | tls.version | TLS version | Extracted from Vendor.ssl_version using regex |
| Vendor.ssl_version | tls.version_protocol | TLS protocol version | Extracted from Vendor.ssl_version using regex and converted to lowercase |
| Vendor.path | url.domain | URL domain | Parsed from Vendor.path using parseUrl() function |
| Vendor.path | url.path | URL path | Parsed from Vendor.path using parseUrl() function |
| Vendor.path | url.query | URL query parameters | Parsed from Vendor.path using parseUrl() function |