logstash/logstash — pull request #185 by knuckolls (2012-08-14 04:04:49+00:00)
Title: Fixed two known problems with the haproxy grok pattern

These fixes are for real problems found in the wild and reported on the mailing list.

My original pattern did not take into account the case where someone didn't have any header captures configured in their haproxy config. In this case, haproxy skips the {} {} sections of the log format. This pull request makes those sections optional captures.

Another problem encountered in production is this: if haproxy recieves a very long url, and haproxy writes to a syslogger like rsyslog or syslog-ng over udp it will truncate the request almost certainly somewhere within the URL. This pattern takes that possibility into account by making everything after the URL an optional capture. That ensures that the pattern falls back gracefully so that everything that didn't get truncated gets captured and parsed properly.