Merge pull request #1379 from SEKOIA-IO/update/haproxy-support-aktci

update HA procy
SEKOIA-IO · Dec 10, 2024 · 5e69d09 · 5e69d09
2 parents 017dab7 + e09d3e1
commit 5e69d09
Show file tree

Hide file tree

Showing 3 changed files with 50 additions and 1 deletion.
diff --git a/HAProxy/haproxy/CHANGELOG.md b/HAProxy/haproxy/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## 2024-12.04 - 1.0.1
+
+- Add support for aktci at the end of the log
+
 ## 2024-03.04 - 1.0.0
 
 ### Added

diff --git a/HAProxy/haproxy/ingest/parser.yml b/HAProxy/haproxy/ingest/parser.yml
@@ -14,7 +14,7 @@ pipeline:
             ([0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})([0-9])
           HAPROXYURL: "(%{URIPROTO:url_scheme}://)?(?:%{USER:url_username}(?::[^@]*)?@)?(?:%{URIHOST:url_domain})?(?:%{URIPATHPARAM:url_path})"
           TLS_PROTOCOL: "TLS"
-          HAPROXYHTTPBASE: '%{IP:source_ip}:%{INT:source_port} \[%{HAPROXYDATE}\] %{NOTSPACE} %{NOTSPACE}/%{NOTSPACE} %{INT}/%{INT}/%{INT}/%{INT}/%{NOTSPACE} %{INT:http_response_status_code} %{NOTSPACE:http_response_bytes} %{DATA:http_request_cookie} %{DATA:http_response_cookie} %{NOTSPACE} %{INT}/%{INT}/%{INT}/%{INT}/%{NOTSPACE} %{INT}/%{INT} (\{%{DATA:captured_request_headers}\})?( )?(\{%{DATA:captured_response_headers}\})?( )?"(<BADREQ>|(%{WORD:http_request_method} (?:%{HAPROXYURL:url_original})?( HTTP/%{NUMBER:http_version})?))?"( %{TLS_PROTOCOL:tls_protocol}v%{NUMBER:tls_version})?'
+          HAPROXYHTTPBASE: '%{IP:source_ip}:%{INT:source_port} \[%{HAPROXYDATE}\] %{NOTSPACE} %{NOTSPACE}/%{NOTSPACE} %{INT}/%{INT}/%{INT}/%{INT}/%{NOTSPACE} %{INT:http_response_status_code} %{NOTSPACE:http_response_bytes} %{DATA:http_request_cookie} %{DATA:http_response_cookie} %{NOTSPACE} %{INT}/%{INT}/%{INT}/%{INT}/%{NOTSPACE} %{INT}/%{INT} (\{%{DATA:captured_request_headers}\})?( )?(\{%{DATA:captured_response_headers}\})?( )?"(<BADREQ>|(%{WORD:http_request_method} (?:%{HAPROXYURL:url_original})?( HTTP/%{NUMBER:http_version})?))?"( %{TLS_PROTOCOL:tls_protocol}v%{NUMBER:tls_version})?%{GREEDYDATA}'
 
   - name: json
     filter: "{{grok.message.json_msg | length > 0}}"

diff --git a/HAProxy/haproxy/tests/access4.json b/HAProxy/haproxy/tests/access4.json
@@ -0,0 +1,45 @@
+{
+  "input": {
+    "message": "90.83.225.109:54761 [10/Apr/2024:15:41:58.284] frontend_https~ backend_lb/LB100 1796/0/0/28/1824 200 1060 - - --VN 296/296/33/6/0 0/0 {saas.ms.example.com} \"GET /path/get/resource HTTP/1.1\" TLSv1.2 aktci:\"46.193.65.202\"\n",
+    "sekoiaio": {
+      "intake": {
+        "dialect": "HAProxy",
+        "dialect_uuid": "ff1873e7-8757-4b1a-b0ca-b33f9b27f3d9"
+      }
+    }
+  },
+  "expected": {
+    "message": "90.83.225.109:54761 [10/Apr/2024:15:41:58.284] frontend_https~ backend_lb/LB100 1796/0/0/28/1824 200 1060 - - --VN 296/296/33/6/0 0/0 {saas.ms.example.com} \"GET /path/get/resource HTTP/1.1\" TLSv1.2 aktci:\"46.193.65.202\"\n",
+    "event": {
+      "kind": "access"
+    },
+    "http": {
+      "request": {
+        "method": "GET"
+      },
+      "response": {
+        "bytes": 1060,
+        "status_code": 200
+      },
+      "version": "1.1"
+    },
+    "related": {
+      "ip": [
+        "90.83.225.109"
+      ]
+    },
+    "source": {
+      "address": "90.83.225.109",
+      "ip": "90.83.225.109",
+      "port": 54761
+    },
+    "tls": {
+      "version": "1.2",
+      "version_protocol": "TLS"
+    },
+    "url": {
+      "original": "/path/get/resource",
+      "path": "/path/get/resource"
+    }
+  }
+}