From a300f1bcbccce1c54cfb41c08d5e88cab18c87c0 Mon Sep 17 00:00:00 2001 From: Alex Resnick Date: Wed, 23 Jun 2021 10:18:46 -0500 Subject: [PATCH] [Filebeat] Update HA Proxy log grok patterns (#25835) * #25827: Update HA Proxy log grok patterns * update changelog * add more sample data --- CHANGELOG.next.asciidoc | 2 +- .../module/haproxy/log/ingest/pipeline.yml | 23 +- filebeat/module/haproxy/log/test/haproxy.log | 9 + .../log/test/haproxy.log-expected.json | 434 ++++++++++++++++++ 4 files changed, 462 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index d5b2edf2e3d..f9612a4a427 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -824,7 +824,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add `log.flags` to events created by the `aws-s3` input. {pull}26267[26267] - Add `include_s3_metadata` config option to the `aws-s3` input for including object metadata in events. {pull}26267[26267] - RFC 5424 and UNIX socket support in the Syslog input are now GA {pull}26293[26293] - +- Update grok patterns for HA Proxy module {issue}25827[25827] {pull}25835[25835] *Heartbeat* diff --git a/filebeat/module/haproxy/log/ingest/pipeline.yml b/filebeat/module/haproxy/log/ingest/pipeline.yml index f491556bd81..2813beaa155 100644 --- a/filebeat/module/haproxy/log/ingest/pipeline.yml +++ b/filebeat/module/haproxy/log/ingest/pipeline.yml @@ -8,21 +8,21 @@ processors: field: message patterns: - '%{HAPROXY_DATE:haproxy.request_date} %{IPORHOST:haproxy.source} %{PROG:process.name}(?:\[%{POSINT:process.pid:long}\])?: - %{GREEDYDATA} %{IPORHOST:source.address}:%{POSINT:source.port:long} %{WORD} + %{GREEDYDATA} (%{IPORHOST:source.address}|-):%{POSINT:source.port:long} %{WORD} %{IPORHOST:destination.ip}:%{POSINT:destination.port:long} \(%{WORD:haproxy.frontend_name}/%{WORD:haproxy.mode}\)' - - '(%{NOTSPACE:process.name}\[%{NUMBER:process.pid:long}\]: )?%{IP:source.address}:%{NUMBER:source.port:long} + - '(%{NOTSPACE:process.name}\[%{NUMBER:process.pid:long}\]: )?(%{IP:source.address}|-):%{NUMBER:source.port:long} \[%{NOTSPACE:haproxy.request_date}\] %{NOTSPACE:haproxy.frontend_name} %{NOTSPACE:haproxy.backend_name}/%{NOTSPACE:haproxy.server_name} - %{NUMBER:haproxy.http.request.time_wait_ms:long}/%{NUMBER:haproxy.total_waiting_time_ms:long}/%{NUMBER:haproxy.connection_wait_time_ms:long}/%{NUMBER:haproxy.http.request.time_wait_without_data_ms:long}/%{NUMBER:temp.duration:long} + (%{IPORHOST:destination.address} )?%{NUMBER:haproxy.http.request.time_wait_ms:long}/%{NUMBER:haproxy.total_waiting_time_ms:long}/%{NUMBER:haproxy.connection_wait_time_ms:long}/%{NUMBER:haproxy.http.request.time_wait_without_data_ms:long}/%{NUMBER:temp.duration:long} %{NUMBER:http.response.status_code:long} %{NUMBER:haproxy.bytes_read:long} %{NOTSPACE:haproxy.http.request.captured_cookie} %{NOTSPACE:haproxy.http.response.captured_cookie} %{NOTSPACE:haproxy.termination_state} %{NUMBER:haproxy.connections.active:long}/%{NUMBER:haproxy.connections.frontend:long}/%{NUMBER:haproxy.connections.backend:long}/%{NUMBER:haproxy.connections.server:long}/%{NUMBER:haproxy.connections.retries:long} %{NUMBER:haproxy.server_queue:long}/%{NUMBER:haproxy.backend_queue:long} (\{%{DATA:haproxy.http.request.captured_headers}\} \{%{DATA:haproxy.http.response.captured_headers}\} |\{%{DATA}\} )?"%{GREEDYDATA:haproxy.http.request.raw_request_line}"' - - '(%{NOTSPACE:process.name}\[%{NUMBER:process.pid:long}\]: )?%{IP:source.address}:%{NUMBER:source.port:long} + - '(%{NOTSPACE:process.name}\[%{NUMBER:process.pid:long}\]: )?(%{IP:source.address}|-):%{NUMBER:source.port:long} \[%{NOTSPACE:haproxy.request_date}\] %{NOTSPACE:haproxy.frontend_name}/%{NOTSPACE:haproxy.bind_name} %{GREEDYDATA:haproxy.error_message}' - '%{HAPROXY_DATE} %{IPORHOST:haproxy.source} (%{NOTSPACE:process.name}\[%{NUMBER:process.pid:long}\]: - )?%{IP:source.address}:%{NUMBER:source.port:long} \[%{NOTSPACE:haproxy.request_date}\] + )?(%{IP:source.address}|-):%{NUMBER:source.port:long} \[%{NOTSPACE:haproxy.request_date}\] %{NOTSPACE:haproxy.frontend_name} %{NOTSPACE:haproxy.backend_name}/%{NOTSPACE:haproxy.server_name} %{NUMBER:haproxy.total_waiting_time_ms:long}/%{NUMBER:haproxy.connection_wait_time_ms:long}/%{NUMBER:temp.duration:long} %{NUMBER:haproxy.bytes_read:long} %{NOTSPACE:haproxy.termination_state} %{NUMBER:haproxy.connections.active:long}/%{NUMBER:haproxy.connections.frontend:long}/%{NUMBER:haproxy.connections.backend:long}/%{NUMBER:haproxy.connections.server:long}/%{NUMBER:haproxy.connections.retries:long} @@ -71,6 +71,15 @@ processors: ignore_failure: true patterns: - ^%{IP:source.ip}$ +- grok: + field: destination.address + patterns: + - ^%{IP:destination.ip}$ + on_failure: + - set: + field: destination.domain + value: "{{destination.address}}" + ignore_empty_value: true - geoip: field: source.ip target_field: source.geo @@ -121,6 +130,10 @@ processors: field: related.ip value: "{{destination.ip}}" if: "ctx?.destination?.ip != null" +- append: + field: related.hosts + value: "{{destination.domain}}" + if: "ctx?.destination?.domain != null" - set: field: event.kind value: event diff --git a/filebeat/module/haproxy/log/test/haproxy.log b/filebeat/module/haproxy/log/test/haproxy.log index ad3550d19c9..1f50b581c73 100644 --- a/filebeat/module/haproxy/log/test/haproxy.log +++ b/filebeat/module/haproxy/log/test/haproxy.log @@ -1 +1,10 @@ Jul 30 09:03:52 localhost haproxy[32450]: 1.2.3.4:38862 [30/Jul/2018:09:03:52.726] incoming~ docs_microservice/docs 0/0/1/0/2 304 168 - - ---- 6/6/0/0/0 0/0 {docs.example.internal||} {|||} "GET /component---src-pages-index-js-4b15624544f97cf0bb8f.js HTTP/1.1" +May 22 02:22:22 server1 haproxy[5089]: -:22222 [22/May/2021:02:22:22.222] www-https~ myapp/node2 site.domain.com 0/0/0/18/18 200 200 - - ---- 222/222/2/0/0 0/0 "OPTIONS /api/v2/app/ HTTP/1.1" +Jun 22 12:02:53 node2 haproxy[23034]: -:47625 [22/Jun/2021:12:02:53.473] www-https~ app/app-node2 app.domain.com 0/0/1/17/18 302 291 - - ---- 1/1/0/0/0 0/0 "GET / HTTP/1.1" +Jun 22 12:03:01 node2 haproxy[23034]: -:47445 [22/Jun/2021:12:03:01.501] www-https~ app/node16 app.domain.com 0/0/1/55/56 200 3097 - - ---- 2/2/0/0/0 0/0 "GET /app/login/ HTTP/1.1" +Jun 22 12:03:01 node2 haproxy[23034]: -:43662 [22/Jun/2021:12:03:01.427] www-https~ app/node7 app.domain.com 0/0/1/30/31 200 1235 - - ---- 1/1/0/0/0 0/0 "GET /23rfsa/ HTTP/1.1" +Jun 22 12:02:59 node2 haproxy[23034]: -:47481 [22/Jun/2021:12:02:59.590] www-https~ app/node16 app.domain.com 0/0/3/32/35 403 142 - - ---- 1/1/0/0/0 0/0 "GET /app/event/ HTTP/1.1" +Jun 22 12:02:57 node2 haproxy[23034]: -:47642 [22/Jun/2021:12:02:55.202] www-https~ app/app-node2 app.domain.com 1/0/1/15/2606 200 325791 - - ---- 1/1/0/0/0 0/0 "GET /static/files/3rsdfas3.js HTTP/1.1" +Jun 22 12:03:08 node2 haproxy[23034]: -:11178 [22/Jun/2021:12:03:08.833] www-https~ app/node7 app.domain.com 0/0/1/29/30 404 448 - - ---- 3/3/0/0/0 0/0 "GET /favicon.ico HTTP/1.1" +Jun 22 12:03:04 node2 haproxy[23034]: -:21278 [22/Jun/2021:12:03:04.060] www-https~ app/node16 app.domain.com 0/0/2/39/41 200 1235 - - ---- 3/3/0/0/0 0/0 "GET /qfe32/ HTTP/1.1" +Jun 22 12:03:08 node3 haproxy[23034]: -:21978 [22/Jun/2021:12:03:08.339] www-https~ app/server app.domain.eu 0/0/2/45/47 404 448 - - ---- 3/3/0/0/0 0/0 "GET /dsffdssdf HTTP/1.1" diff --git a/filebeat/module/haproxy/log/test/haproxy.log-expected.json b/filebeat/module/haproxy/log/test/haproxy.log-expected.json index b8e839b8da6..9633ab57190 100644 --- a/filebeat/module/haproxy/log/test/haproxy.log-expected.json +++ b/filebeat/module/haproxy/log/test/haproxy.log-expected.json @@ -59,5 +59,439 @@ "url.extension": "js", "url.original": "/component---src-pages-index-js-4b15624544f97cf0bb8f.js", "url.path": "/component---src-pages-index-js-4b15624544f97cf0bb8f.js" + }, + { + "destination.address": "site.domain.com", + "destination.domain": "site.domain.com", + "event.category": [ + "web" + ], + "event.dataset": "haproxy.log", + "event.duration": 18000000, + "event.kind": "event", + "event.module": "haproxy", + "event.outcome": "success", + "event.timezone": "-02:00", + "fileset.name": "log", + "haproxy.backend_name": "myapp", + "haproxy.backend_queue": 0, + "haproxy.bytes_read": 200, + "haproxy.connection_wait_time_ms": 0, + "haproxy.connections.active": 222, + "haproxy.connections.backend": 2, + "haproxy.connections.frontend": 222, + "haproxy.connections.retries": 0, + "haproxy.connections.server": 0, + "haproxy.frontend_name": "www-https~", + "haproxy.http.request.captured_cookie": "-", + "haproxy.http.request.raw_request_line": "OPTIONS /api/v2/app/ HTTP/1.1", + "haproxy.http.request.time_wait_ms": 0, + "haproxy.http.request.time_wait_without_data_ms": 18, + "haproxy.http.response.captured_cookie": "-", + "haproxy.server_name": "node2", + "haproxy.server_queue": 0, + "haproxy.termination_state": "----", + "haproxy.total_waiting_time_ms": 0, + "http.request.method": "OPTIONS", + "http.response.bytes": 200, + "http.response.status_code": 200, + "http.version": "1.1", + "input.type": "log", + "log.offset": 260, + "process.name": "haproxy", + "process.pid": 5089, + "related.hosts": [ + "site.domain.com" + ], + "service.type": "haproxy", + "source.port": 22222, + "url.original": "/api/v2/app/", + "url.path": "/api/v2/app/" + }, + { + "destination.address": "app.domain.com", + "destination.domain": "app.domain.com", + "event.category": [ + "web" + ], + "event.dataset": "haproxy.log", + "event.duration": 18000000, + "event.kind": "event", + "event.module": "haproxy", + "event.outcome": "success", + "event.timezone": "-02:00", + "fileset.name": "log", + "haproxy.backend_name": "app", + "haproxy.backend_queue": 0, + "haproxy.bytes_read": 291, + "haproxy.connection_wait_time_ms": 1, + "haproxy.connections.active": 1, + "haproxy.connections.backend": 0, + "haproxy.connections.frontend": 1, + "haproxy.connections.retries": 0, + "haproxy.connections.server": 0, + "haproxy.frontend_name": "www-https~", + "haproxy.http.request.captured_cookie": "-", + "haproxy.http.request.raw_request_line": "GET / HTTP/1.1", + "haproxy.http.request.time_wait_ms": 0, + "haproxy.http.request.time_wait_without_data_ms": 17, + "haproxy.http.response.captured_cookie": "-", + "haproxy.server_name": "app-node2", + "haproxy.server_queue": 0, + "haproxy.termination_state": "----", + "haproxy.total_waiting_time_ms": 0, + "http.request.method": "GET", + "http.response.bytes": 291, + "http.response.status_code": 302, + "http.version": "1.1", + "input.type": "log", + "log.offset": 452, + "process.name": "haproxy", + "process.pid": 23034, + "related.hosts": [ + "app.domain.com" + ], + "service.type": "haproxy", + "source.port": 47625, + "url.original": "/", + "url.path": "/" + }, + { + "destination.address": "app.domain.com", + "destination.domain": "app.domain.com", + "event.category": [ + "web" + ], + "event.dataset": "haproxy.log", + "event.duration": 56000000, + "event.kind": "event", + "event.module": "haproxy", + "event.outcome": "success", + "event.timezone": "-02:00", + "fileset.name": "log", + "haproxy.backend_name": "app", + "haproxy.backend_queue": 0, + "haproxy.bytes_read": 3097, + "haproxy.connection_wait_time_ms": 1, + "haproxy.connections.active": 2, + "haproxy.connections.backend": 0, + "haproxy.connections.frontend": 2, + "haproxy.connections.retries": 0, + "haproxy.connections.server": 0, + "haproxy.frontend_name": "www-https~", + "haproxy.http.request.captured_cookie": "-", + "haproxy.http.request.raw_request_line": "GET /app/login/ HTTP/1.1", + "haproxy.http.request.time_wait_ms": 0, + "haproxy.http.request.time_wait_without_data_ms": 55, + "haproxy.http.response.captured_cookie": "-", + "haproxy.server_name": "node16", + "haproxy.server_queue": 0, + "haproxy.termination_state": "----", + "haproxy.total_waiting_time_ms": 0, + "http.request.method": "GET", + "http.response.bytes": 3097, + "http.response.status_code": 200, + "http.version": "1.1", + "input.type": "log", + "log.offset": 625, + "process.name": "haproxy", + "process.pid": 23034, + "related.hosts": [ + "app.domain.com" + ], + "service.type": "haproxy", + "source.port": 47445, + "url.original": "/app/login/", + "url.path": "/app/login/" + }, + { + "destination.address": "app.domain.com", + "destination.domain": "app.domain.com", + "event.category": [ + "web" + ], + "event.dataset": "haproxy.log", + "event.duration": 31000000, + "event.kind": "event", + "event.module": "haproxy", + "event.outcome": "success", + "event.timezone": "-02:00", + "fileset.name": "log", + "haproxy.backend_name": "app", + "haproxy.backend_queue": 0, + "haproxy.bytes_read": 1235, + "haproxy.connection_wait_time_ms": 1, + "haproxy.connections.active": 1, + "haproxy.connections.backend": 0, + "haproxy.connections.frontend": 1, + "haproxy.connections.retries": 0, + "haproxy.connections.server": 0, + "haproxy.frontend_name": "www-https~", + "haproxy.http.request.captured_cookie": "-", + "haproxy.http.request.raw_request_line": "GET /23rfsa/ HTTP/1.1", + "haproxy.http.request.time_wait_ms": 0, + "haproxy.http.request.time_wait_without_data_ms": 30, + "haproxy.http.response.captured_cookie": "-", + "haproxy.server_name": "node7", + "haproxy.server_queue": 0, + "haproxy.termination_state": "----", + "haproxy.total_waiting_time_ms": 0, + "http.request.method": "GET", + "http.response.bytes": 1235, + "http.response.status_code": 200, + "http.version": "1.1", + "input.type": "log", + "log.offset": 806, + "process.name": "haproxy", + "process.pid": 23034, + "related.hosts": [ + "app.domain.com" + ], + "service.type": "haproxy", + "source.port": 43662, + "url.original": "/23rfsa/", + "url.path": "/23rfsa/" + }, + { + "destination.address": "app.domain.com", + "destination.domain": "app.domain.com", + "event.category": [ + "web" + ], + "event.dataset": "haproxy.log", + "event.duration": 35000000, + "event.kind": "event", + "event.module": "haproxy", + "event.outcome": "failure", + "event.timezone": "-02:00", + "fileset.name": "log", + "haproxy.backend_name": "app", + "haproxy.backend_queue": 0, + "haproxy.bytes_read": 142, + "haproxy.connection_wait_time_ms": 3, + "haproxy.connections.active": 1, + "haproxy.connections.backend": 0, + "haproxy.connections.frontend": 1, + "haproxy.connections.retries": 0, + "haproxy.connections.server": 0, + "haproxy.frontend_name": "www-https~", + "haproxy.http.request.captured_cookie": "-", + "haproxy.http.request.raw_request_line": "GET /app/event/ HTTP/1.1", + "haproxy.http.request.time_wait_ms": 0, + "haproxy.http.request.time_wait_without_data_ms": 32, + "haproxy.http.response.captured_cookie": "-", + "haproxy.server_name": "node16", + "haproxy.server_queue": 0, + "haproxy.termination_state": "----", + "haproxy.total_waiting_time_ms": 0, + "http.request.method": "GET", + "http.response.bytes": 142, + "http.response.status_code": 403, + "http.version": "1.1", + "input.type": "log", + "log.offset": 983, + "process.name": "haproxy", + "process.pid": 23034, + "related.hosts": [ + "app.domain.com" + ], + "service.type": "haproxy", + "source.port": 47481, + "url.original": "/app/event/", + "url.path": "/app/event/" + }, + { + "destination.address": "app.domain.com", + "destination.domain": "app.domain.com", + "event.category": [ + "web" + ], + "event.dataset": "haproxy.log", + "event.duration": 2606000000, + "event.kind": "event", + "event.module": "haproxy", + "event.outcome": "success", + "event.timezone": "-02:00", + "fileset.name": "log", + "haproxy.backend_name": "app", + "haproxy.backend_queue": 0, + "haproxy.bytes_read": 325791, + "haproxy.connection_wait_time_ms": 1, + "haproxy.connections.active": 1, + "haproxy.connections.backend": 0, + "haproxy.connections.frontend": 1, + "haproxy.connections.retries": 0, + "haproxy.connections.server": 0, + "haproxy.frontend_name": "www-https~", + "haproxy.http.request.captured_cookie": "-", + "haproxy.http.request.raw_request_line": "GET /static/files/3rsdfas3.js HTTP/1.1", + "haproxy.http.request.time_wait_ms": 1, + "haproxy.http.request.time_wait_without_data_ms": 15, + "haproxy.http.response.captured_cookie": "-", + "haproxy.server_name": "app-node2", + "haproxy.server_queue": 0, + "haproxy.termination_state": "----", + "haproxy.total_waiting_time_ms": 0, + "http.request.method": "GET", + "http.response.bytes": 325791, + "http.response.status_code": 200, + "http.version": "1.1", + "input.type": "log", + "log.offset": 1163, + "process.name": "haproxy", + "process.pid": 23034, + "related.hosts": [ + "app.domain.com" + ], + "service.type": "haproxy", + "source.port": 47642, + "url.extension": "js", + "url.original": "/static/files/3rsdfas3.js", + "url.path": "/static/files/3rsdfas3.js" + }, + { + "destination.address": "app.domain.com", + "destination.domain": "app.domain.com", + "event.category": [ + "web" + ], + "event.dataset": "haproxy.log", + "event.duration": 30000000, + "event.kind": "event", + "event.module": "haproxy", + "event.outcome": "failure", + "event.timezone": "-02:00", + "fileset.name": "log", + "haproxy.backend_name": "app", + "haproxy.backend_queue": 0, + "haproxy.bytes_read": 448, + "haproxy.connection_wait_time_ms": 1, + "haproxy.connections.active": 3, + "haproxy.connections.backend": 0, + "haproxy.connections.frontend": 3, + "haproxy.connections.retries": 0, + "haproxy.connections.server": 0, + "haproxy.frontend_name": "www-https~", + "haproxy.http.request.captured_cookie": "-", + "haproxy.http.request.raw_request_line": "GET /favicon.ico HTTP/1.1", + "haproxy.http.request.time_wait_ms": 0, + "haproxy.http.request.time_wait_without_data_ms": 29, + "haproxy.http.response.captured_cookie": "-", + "haproxy.server_name": "node7", + "haproxy.server_queue": 0, + "haproxy.termination_state": "----", + "haproxy.total_waiting_time_ms": 0, + "http.request.method": "GET", + "http.response.bytes": 448, + "http.response.status_code": 404, + "http.version": "1.1", + "input.type": "log", + "log.offset": 1365, + "process.name": "haproxy", + "process.pid": 23034, + "related.hosts": [ + "app.domain.com" + ], + "service.type": "haproxy", + "source.port": 11178, + "url.extension": "ico", + "url.original": "/favicon.ico", + "url.path": "/favicon.ico" + }, + { + "destination.address": "app.domain.com", + "destination.domain": "app.domain.com", + "event.category": [ + "web" + ], + "event.dataset": "haproxy.log", + "event.duration": 41000000, + "event.kind": "event", + "event.module": "haproxy", + "event.outcome": "success", + "event.timezone": "-02:00", + "fileset.name": "log", + "haproxy.backend_name": "app", + "haproxy.backend_queue": 0, + "haproxy.bytes_read": 1235, + "haproxy.connection_wait_time_ms": 2, + "haproxy.connections.active": 3, + "haproxy.connections.backend": 0, + "haproxy.connections.frontend": 3, + "haproxy.connections.retries": 0, + "haproxy.connections.server": 0, + "haproxy.frontend_name": "www-https~", + "haproxy.http.request.captured_cookie": "-", + "haproxy.http.request.raw_request_line": "GET /qfe32/ HTTP/1.1", + "haproxy.http.request.time_wait_ms": 0, + "haproxy.http.request.time_wait_without_data_ms": 39, + "haproxy.http.response.captured_cookie": "-", + "haproxy.server_name": "node16", + "haproxy.server_queue": 0, + "haproxy.termination_state": "----", + "haproxy.total_waiting_time_ms": 0, + "http.request.method": "GET", + "http.response.bytes": 1235, + "http.response.status_code": 200, + "http.version": "1.1", + "input.type": "log", + "log.offset": 1545, + "process.name": "haproxy", + "process.pid": 23034, + "related.hosts": [ + "app.domain.com" + ], + "service.type": "haproxy", + "source.port": 21278, + "url.original": "/qfe32/", + "url.path": "/qfe32/" + }, + { + "destination.address": "app.domain.eu", + "destination.domain": "app.domain.eu", + "event.category": [ + "web" + ], + "event.dataset": "haproxy.log", + "event.duration": 47000000, + "event.kind": "event", + "event.module": "haproxy", + "event.outcome": "failure", + "event.timezone": "-02:00", + "fileset.name": "log", + "haproxy.backend_name": "app", + "haproxy.backend_queue": 0, + "haproxy.bytes_read": 448, + "haproxy.connection_wait_time_ms": 2, + "haproxy.connections.active": 3, + "haproxy.connections.backend": 0, + "haproxy.connections.frontend": 3, + "haproxy.connections.retries": 0, + "haproxy.connections.server": 0, + "haproxy.frontend_name": "www-https~", + "haproxy.http.request.captured_cookie": "-", + "haproxy.http.request.raw_request_line": "GET /dsffdssdf HTTP/1.1", + "haproxy.http.request.time_wait_ms": 0, + "haproxy.http.request.time_wait_without_data_ms": 45, + "haproxy.http.response.captured_cookie": "-", + "haproxy.server_name": "server", + "haproxy.server_queue": 0, + "haproxy.termination_state": "----", + "haproxy.total_waiting_time_ms": 0, + "http.request.method": "GET", + "http.response.bytes": 448, + "http.response.status_code": 404, + "http.version": "1.1", + "input.type": "log", + "log.offset": 1722, + "process.name": "haproxy", + "process.pid": 23034, + "related.hosts": [ + "app.domain.eu" + ], + "service.type": "haproxy", + "source.port": 21978, + "url.original": "/dsffdssdf", + "url.path": "/dsffdssdf" } ] \ No newline at end of file